Files

 develop

/

lookups

/

Copy path

Directory actions

More options

Directory actions

More options

Latest commit

pyth0n1c

Update the deprecation_info.csv file, manually generated with a versi…

Mar 18, 2025

58aca7d · Mar 18, 2025

History

History

/

lookups

/

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
3cx_ioc_domains.csv		3cx_ioc_domains.csv	dns	Mar 30, 2023
3cx_ioc_domains.yml		3cx_ioc_domains.yml	first batch of updates to	Dec 23, 2024
__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.mlmodel		__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.mlmodel	Adding missing lookup files	Jun 12, 2023
__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml		__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml	first batch of updates to	Dec 23, 2024
__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.mlmodel		__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.mlmodel	adding detect suspicious dns txt records using pretrained model in dsdl	Jan 17, 2023
__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml		__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml	first batch of updates to	Dec 23, 2024
__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel		__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel	Detection name update	Feb 7, 2023
__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml		__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml	first batch of updates to	Dec 23, 2024
__mlspl_pretrained_dga_model_dsdl.mlmodel		__mlspl_pretrained_dga_model_dsdl.mlmodel	changing files	Sep 28, 2022
__mlspl_pretrained_dga_model_dsdl.yml		__mlspl_pretrained_dga_model_dsdl.yml	first batch of updates to	Dec 23, 2024
__mlspl_unusual_commandline_detection.mlmodel		__mlspl_unusual_commandline_detection.mlmodel	Updating mlmodel to 5.3.x specification as well as the test apparatus	Jan 26, 2022
__mlspl_unusual_commandline_detection.yml		__mlspl_unusual_commandline_detection.yml	first batch of updates to	Dec 23, 2024
ace_access_rights_lookup.csv		ace_access_rights_lookup.csv	adding AD ACL and GPO related detections	Jul 2, 2024
ace_access_rights_lookup.yml		ace_access_rights_lookup.yml	first batch of updates to	Dec 23, 2024
ace_flag_lookup.csv		ace_flag_lookup.csv	adding AD ACL and GPO related detections	Jul 2, 2024
ace_flag_lookup.yml		ace_flag_lookup.yml	more cleanup of lookups to follow new format.	Jan 3, 2025
ace_type_lookup.csv		ace_type_lookup.csv	adding AD ACL and GPO related detections	Jul 2, 2024
ace_type_lookup.yml		ace_type_lookup.yml	first batch of updates to	Dec 23, 2024
advanced_audit_policy_guids.csv		advanced_audit_policy_guids.csv	renaming advanced audit policy guids lookup	Feb 13, 2023
advanced_audit_policy_guids.yml		advanced_audit_policy_guids.yml	first batch of updates to	Dec 23, 2024
api_call_by_user_baseline.yml		api_call_by_user_baseline.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
applockereventcodes.csv		applockereventcodes.csv	ESCU Release Branch - v4.30.0	Apr 17, 2024
applockereventcodes.yml		applockereventcodes.yml	first batch of updates to	Dec 23, 2024
asr_rules.csv		asr_rules.csv	update: lookups with additional data	Jan 30, 2025
asr_rules.yml		asr_rules.yml	update: lookups with additional data	Jan 30, 2025
attacker_tools.csv		attacker_tools.csv	spl duplicate and fixes	Jul 28, 2023
attacker_tools.yml		attacker_tools.yml	first batch of updates to	Dec 23, 2024
aws_service_accounts.csv		aws_service_accounts.csv	Added lookup files that weren't there	Sep 30, 2019
aws_service_accounts.yml		aws_service_accounts.yml	first batch of updates to	Dec 23, 2024
baseline_blocked_outbound_connections.csv		baseline_blocked_outbound_connections.csv	Added lookup files that weren't there	Sep 30, 2019
baseline_blocked_outbound_connections.yml		baseline_blocked_outbound_connections.yml	more cleanup of lookups to follow new format.	Jan 3, 2025
brandmonitoring_lookup.csv		brandmonitoring_lookup.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
brandmonitoring_lookup.yml		brandmonitoring_lookup.yml	first batch of updates to	Dec 23, 2024
browser_app_list.csv		browser_app_list.csv	ESCU Release Branch v4.27.0	Mar 20, 2024
browser_app_list.yml		browser_app_list.yml	More cleanup of lookups	Dec 24, 2024
builtin_groups_lookup.csv		builtin_groups_lookup.csv	update: lookups with additional data	Jan 30, 2025
builtin_groups_lookup.yml		builtin_groups_lookup.yml	update: lookups with additional data	Jan 30, 2025
char_conversion_matrix.csv		char_conversion_matrix.csv	Release 4.19.0	Jan 10, 2024
char_conversion_matrix.yml		char_conversion_matrix.yml	More cleanup of lookups	Dec 24, 2024
cloud_instances_enough_data.yml		cloud_instances_enough_data.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
decommissioned_buckets.yml		decommissioned_buckets.yml	convert csv lookup to kvstore lookup.	Feb 19, 2025
deprecation_info.csv		deprecation_info.csv	Update the deprecation_info.csv file, manually generated with a versi…	Mar 18, 2025
deprecation_info.yml		deprecation_info.yml	updating lookups from latest mapping	Mar 14, 2025
discovered_dns_records.csv		discovered_dns_records.csv	app inspect failures fixes	Dec 8, 2020
discovered_dns_records.yml		discovered_dns_records.yml	more cleanup of lookups to follow new format.	Jan 3, 2025
domain_admins.csv		domain_admins.csv	adding new detection - diamond ticket	Oct 6, 2023
domain_admins.yml		domain_admins.yml	Second round of lookup file cleanup	Dec 23, 2024
domains.csv		domains.csv	Updated macro definition in detections, investigations, and baselines…	Sep 30, 2019
domains.yml		domains.yml	Second round of lookup file cleanup	Dec 23, 2024
dynamic_dns_providers_default.csv		dynamic_dns_providers_default.csv	update: lookups with additional data	Jan 30, 2025
dynamic_dns_providers_default.yml		dynamic_dns_providers_default.yml	update: lookups with additional data	Jan 30, 2025
dynamic_dns_providers_local.csv		dynamic_dns_providers_local.csv	Added lookup files that weren't there	Sep 30, 2019
dynamic_dns_providers_local.yml		dynamic_dns_providers_local.yml	Second round of lookup file cleanup	Dec 23, 2024
hijacklibs.csv		hijacklibs.csv	T1003.001 Update	Aug 25, 2022
hijacklibs.yml		hijacklibs.yml	Second round of lookup file cleanup	Dec 23, 2024
hijacklibs_loaded.csv		hijacklibs_loaded.csv	ESCU Release Branch v4.27.0	Mar 20, 2024
hijacklibs_loaded.yml		hijacklibs_loaded.yml	Second round of lookup file cleanup	Dec 23, 2024
images_to_repository.csv		images_to_repository.csv	updated detections	Sep 6, 2021
images_to_repository.yml		images_to_repository.yml	Second round of lookup file cleanup	Dec 23, 2024
is_net_windows_file.csv		is_net_windows_file.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
is_net_windows_file.yml		is_net_windows_file.yml	Second round of lookup file cleanup	Dec 23, 2024
is_nirsoft_software.csv		is_nirsoft_software.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
is_nirsoft_software.yml		is_nirsoft_software.yml	Second round of lookup file cleanup	Dec 23, 2024
is_suspicious_file_extension_lookup.csv		is_suspicious_file_extension_lookup.csv	add additional suspicious file extensions	Nov 18, 2020
is_suspicious_file_extension_lookup.yml		is_suspicious_file_extension_lookup.yml	Second round of lookup file cleanup	Dec 23, 2024
is_windows_system_file.csv		is_windows_system_file.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
is_windows_system_file.yml		is_windows_system_file.yml	another round of lookup file updates	Dec 23, 2024
k8s_container_network_io_baseline.yml		k8s_container_network_io_baseline.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
k8s_container_network_io_ratio_baseline.yml		k8s_container_network_io_ratio_baseline.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
k8s_process_resource_baseline.yml		k8s_process_resource_baseline.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
k8s_process_resource_ratio_baseline.yml		k8s_process_resource_ratio_baseline.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
legit_domains.csv		legit_domains.csv	Updated macro definition in detections, investigations, and baselines…	Sep 30, 2019
legit_domains.yml		legit_domains.yml	another round of lookup file updates	Dec 23, 2024
linux_tool_discovery_process.csv		linux_tool_discovery_process.csv	combined the rest 2	Feb 18, 2022
linux_tool_discovery_process.yml		linux_tool_discovery_process.yml	another round of lookup file updates	Dec 23, 2024
local_file_inclusion_paths.csv		local_file_inclusion_paths.csv	new detection	Aug 23, 2021
local_file_inclusion_paths.yml		local_file_inclusion_paths.yml	another round of lookup file updates	Dec 23, 2024
lolbas_file_path.csv		lolbas_file_path.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
lolbas_file_path.yml		lolbas_file_path.yml	another round of lookup file updates	Dec 23, 2024
loldrivers.csv		loldrivers.csv	Bespoke Drivers	Dec 31, 2022
loldrivers.yml		loldrivers.yml	another round of lookup file updates	Dec 23, 2024
lookup_rare_process_allow_list_default.csv		lookup_rare_process_allow_list_default.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
lookup_rare_process_allow_list_default.yml		lookup_rare_process_allow_list_default.yml	another round of lookup file updates	Dec 23, 2024
lookup_rare_process_allow_list_local.csv		lookup_rare_process_allow_list_local.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
lookup_rare_process_allow_list_local.yml		lookup_rare_process_allow_list_local.yml	another round of lookup file updates	Dec 23, 2024
lookup_uncommon_processes_default.csv		lookup_uncommon_processes_default.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
lookup_uncommon_processes_default.yml		lookup_uncommon_processes_default.yml	another round of lookup file updates	Dec 23, 2024
lookup_uncommon_processes_local.csv		lookup_uncommon_processes_local.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
lookup_uncommon_processes_local.yml		lookup_uncommon_processes_local.yml	another round of lookup file updates	Dec 23, 2024
malicious_powershell_strings.csv		malicious_powershell_strings.csv	updating lookup	Mar 4, 2025
malicious_powershell_strings.yml		malicious_powershell_strings.yml	updating lookup	Mar 4, 2025
mandatory_job_for_workflow.csv		mandatory_job_for_workflow.csv	circle ci detecction	Sep 2, 2021
mandatory_job_for_workflow.yml		mandatory_job_for_workflow.yml	More cleanup of lookups	Dec 24, 2024
mandatory_step_for_job.csv		mandatory_step_for_job.csv	circle ci detecction	Sep 1, 2021
mandatory_step_for_job.yml		mandatory_step_for_job.yml	another round of lookup file updates	Dec 23, 2024
msad_guid_lookup.csv		msad_guid_lookup.csv	adding AD ACL and GPO related detections	Jul 2, 2024
msad_guid_lookup.yml		msad_guid_lookup.yml	another round of lookup file updates	Dec 23, 2024
network_acl_activity_baseline.csv		network_acl_activity_baseline.csv	Added lookup files that weren't there	Sep 30, 2019
network_acl_activity_baseline.yml		network_acl_activity_baseline.yml	finish lookup cleanup	Jan 3, 2025
previously_seen_api_calls_from_user_roles.yml		previously_seen_api_calls_from_user_roles.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_aws_cross_account_activity.yml		previously_seen_aws_cross_account_activity.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_aws_regions.yml		previously_seen_aws_regions.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_cloud_api_calls_per_user_role.yml		previously_seen_cloud_api_calls_per_user_role.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_cloud_compute_creations_by_user.yml		previously_seen_cloud_compute_creations_by_user.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_cloud_compute_images.yml		previously_seen_cloud_compute_images.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_cloud_compute_instance_types.yml		previously_seen_cloud_compute_instance_types.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_cloud_instance_modifications_by_user.yml		previously_seen_cloud_instance_modifications_by_user.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_cloud_provisioning_activity_sources.yml		previously_seen_cloud_provisioning_activity_sources.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_cloud_regions.yml		previously_seen_cloud_regions.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_cmd_line_arguments.csv		previously_seen_cmd_line_arguments.csv	Added lookup files that weren't there	Sep 30, 2019
previously_seen_cmd_line_arguments.yml		previously_seen_cmd_line_arguments.yml	more cleanup of lookups to follow new format.	Jan 3, 2025
previously_seen_ec2_amis_lookup.yml		previously_seen_ec2_amis_lookup.yml	Fix more errors with missing lookups, baselines, and detections	Jan 16, 2025
previously_seen_ec2_instance_types_lookup.yml		previously_seen_ec2_instance_types_lookup.yml	Fix more errors with missing lookups, baselines, and detections	Jan 16, 2025
previously_seen_ec2_launches_by_user_lookup.yml		previously_seen_ec2_launches_by_user_lookup.yml	Fix more errors with missing lookups, baselines, and detections	Jan 16, 2025
previously_seen_ec2_modifications_by_user.csv		previously_seen_ec2_modifications_by_user.csv	Added lookup files that weren't there	Sep 30, 2019
previously_seen_ec2_modifications_by_user.yml		previously_seen_ec2_modifications_by_user.yml	more cleanup of lookups to follow new format.	Jan 3, 2025
previously_seen_gcp_storage_access_from_remote_ip.yml		previously_seen_gcp_storage_access_from_remote_ip.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_provisioning_activity_src.yml		previously_seen_provisioning_activity_src.yml	progress on input/output lookup	Jan 4, 2025
previously_seen_running_windows_services.yml		previously_seen_running_windows_services.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_s3_access_from_remote_ip.yml		previously_seen_s3_access_from_remote_ip.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
previously_seen_users_console_logins.yml		previously_seen_users_console_logins.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
privileged_azure_ad_roles.csv		privileged_azure_ad_roles.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
privileged_azure_ad_roles.yml		privileged_azure_ad_roles.yml	another round of lookup file updates	Dec 23, 2024
prohibited_apps_launching_cmd.csv		prohibited_apps_launching_cmd.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
prohibited_apps_launching_cmd.yml		prohibited_apps_launching_cmd.yml	finish lookup cleanup	Jan 3, 2025
prohibited_processes.csv		prohibited_processes.csv	Updated macro definition in detections, investigations, and baselines…	Sep 30, 2019
prohibited_processes.yml		prohibited_processes.yml	first batch of updates to	Dec 23, 2024
ransomware_extensions_lookup.csv		ransomware_extensions_lookup.csv	systembc	Mar 3, 2025
ransomware_extensions_lookup.yml		ransomware_extensions_lookup.yml	More cleanup of lookups	Dec 24, 2024
ransomware_notes_lookup.csv		ransomware_notes_lookup.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
ransomware_notes_lookup.yml		ransomware_notes_lookup.yml	systembc	Mar 3, 2025
remote_access_software.csv		remote_access_software.csv	Update remote_access_software.csv	Feb 10, 2025
remote_access_software.yml		remote_access_software.yml	Update remote_access_software.yml	Feb 10, 2025
remote_access_software_exceptions.yml		remote_access_software_exceptions.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
s3_deletion_baseline.yml		s3_deletion_baseline.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
security_group_activity_baseline.yml		security_group_activity_baseline.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
security_services_lookup.csv		security_services_lookup.csv	update: lookups with additional data	Jan 30, 2025
security_services_lookup.yml		security_services_lookup.yml	Update security_services_lookup.yml	Jan 31, 2025
suspicious_writes_lookup.csv		suspicious_writes_lookup.csv	more cleanup of lookups to follow new format.	Jan 3, 2025
suspicious_writes_lookup.yml		suspicious_writes_lookup.yml	another round of lookup file updates	Dec 23, 2024
windows_protocol_handlers.csv		windows_protocol_handlers.csv	Windows Protocol Handler	Jul 12, 2022
windows_protocol_handlers.yml		windows_protocol_handlers.yml	another round of lookup file updates	Dec 23, 2024
windows_suspicious_services.csv		windows_suspicious_services.csv	Update windows_suspicious_services.csv	Feb 19, 2025
windows_suspicious_services.yml		windows_suspicious_services.yml	Add files via upload	Feb 7, 2025
windows_suspicious_tasks.csv		windows_suspicious_tasks.csv	Add files via upload	Feb 7, 2025
windows_suspicious_tasks.yml		windows_suspicious_tasks.yml	Add files via upload	Feb 7, 2025
zoom_first_time_child_process.yml		zoom_first_time_child_process.yml	remove collection for all kvstores. this will just come from the name…	Jan 3, 2025
View all files