Skip to content

Commit 32da5d2

Browse files
pyth0n1cpyth0n1c
committed
another round of lookup file updates
1 parent 27c9cb5 commit 32da5d2

25 files changed

+270
-94
lines changed

‎lookups/api_call_by_user_baseline.yml

+12-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
1+
name: api_call_by_user_baseline
2+
date: 2024-12-23
3+
version: 2
4+
id: 6f4b0d42-5f24-4992-98f9-aebbc7ced9bf
5+
author: Splunk Threat Research Team
6+
lookup_type: kvstore
17
description: A collection that will contain the baseline information for number of
28
AWS API calls per user
39
collection: api_call_by_user_baseline
4-
name: api_call_by_user_baseline
5-
fields_list: arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls
10+
fields_list:
11+
- arn
12+
- latestCount
13+
- numDataPoints
14+
- avgApiCalls
15+
- stdevApiCalls

‎lookups/is_windows_system_file.yml

+8-4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1-
default_match: 'false'
1+
name: is_windows_system_file
2+
date: 2024-12-23
3+
version: 2
4+
id: ce238622-4d8f-41a4-a747-5d0adab9c854
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
default_match: false
28
description: A full baseline of executable files in Windows\System32 and Windows\Syswow64, including sub-directories from Server 2016 and Windows 10.
3-
filename: is_windows_system_file20231221.csv
49
min_matches: 1
5-
name: is_windows_system_file
6-
case_sensitive_match: 'false'
10+
case_sensitive_match: false

‎lookups/k8s_process_resource_baseline.yml

+28-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,30 @@
1+
name: k8s_process_resource_baseline
2+
date: 2024-12-23
3+
version: 2
4+
id: 6deb2883-faf8-4f78-bf88-ad67ccc8dfc0
5+
author: Splunk Threat Research Team
6+
lookup_type: kvstore
17
description: A place holder for a list of used Kuberntes Process Resource
28
collection: k8s_process_resource_baseline
3-
name: k8s_process_resource_baseline
4-
fields_list: host.name, k8s.cluster.name, k8s.node.name, process.executable.name, avg_process.cpu.time, avg_process.cpu.utilization, avg_process.disk.io, avg_process.disk.operations, avg_process.memory.usage, avg_process.memory.utilization, avg_process.memory.virtual, avg_process.threads, stdev_process.cpu.time, stdev_process.cpu.utilization, stdev_process.disk.io, stdev_process.disk.operations, stdev_process.memory.usage, stdev_process.memory.utilization, stdev_process.memory.virtual, stdev_process.threads, key
9+
fields_list:
10+
- host.name
11+
- k8s.cluster.name
12+
- k8s.node.name
13+
- process.executable.name
14+
- avg_process.cpu.time
15+
- avg_process.cpu.utilization
16+
- avg_process.disk.io
17+
- avg_process.disk.operations
18+
- avg_process.memory.usage
19+
- avg_process.memory.utilization
20+
- avg_process.memory.virtual
21+
- avg_process.threads
22+
- stdev_process.cpu.time
23+
- stdev_process.cpu.utilization
24+
- stdev_process.disk.io
25+
- stdev_process.disk.operations
26+
- stdev_process.memory.usage
27+
- stdev_process.memory.utilization
28+
- stdev_process.memory.virtual
29+
- stdev_process.threads
30+
- key

‎lookups/legit_domains.yml

+6-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1-
description: A list of legit domains to be used as an ignore list for possible phishing sites
2-
filename: legit_domains.csv
31
name: legit_domains
2+
date: 2024-12-23
3+
version: 2
4+
id: 06602f3e-0dcc-47ef-aabc-85a4ad782442
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A list of legit domains to be used as an ignore list for possible phishing sites

‎lookups/linux_tool_discovery_process.yml

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
description: A list of suspicious bash commonly used by attackers via scripts
2-
filename: linux_tool_discovery_process.csv
31
name: linux_tool_discovery_process
4-
default_match: 'false'
5-
match_type: WILDCARD(process)
2+
date: 2024-12-23
3+
version: 2
4+
id: f0d8b1c8-4ca0-4765-858a-ab0dea68c399
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A list of suspicious bash commonly used by attackers via scripts
8+
default_match: false
9+
match_type:
10+
- WILDCARD(process)
611
min_matches: 1
7-
case_sensitive_match: 'false'
12+
case_sensitive_match: false

‎lookups/local_file_inclusion_paths.yml

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
description: A list of interesting files in a local file inclusion attack
2-
filename: local_file_inclusion_paths.csv
31
name: local_file_inclusion_paths
4-
default_match: 'false'
5-
match_type: WILDCARD(local_file_inclusion_paths)
2+
date: 2024-12-23
3+
version: 2
4+
id: 10efe0a8-ec54-4f86-8d11-677a7ac65d64
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A list of interesting files in a local file inclusion attack
8+
default_match: false
9+
match_type:
10+
- WILDCARD(local_file_inclusion_paths)
611
min_matches: 1
7-
case_sensitive_match: 'false'
12+
case_sensitive_match: false

‎lookups/lolbas_file_path.yml

+11-5
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,14 @@
1-
description: A list of LOLBAS and their file path used in determining if a script or binary is valid on windows, Updated for 2024 from lolbas project.
2-
filename: lolbas_file_path20240725.csv
31
name: lolbas_file_path
4-
default_match: 'false'
5-
match_type: WILDCARD(lolbas_file_name),WILDCARD(lolbas_file_path)
2+
date: 2024-12-23
3+
version: 2
4+
id: b88d9c91-33c6-408a-8ef0-00806932f8c5
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A list of LOLBAS and their file path used in determining if a script or binary is valid on windows, Updated for 2024 from lolbas project.
8+
default_match: false
9+
match_type:
10+
- WILDCARD(lolbas_file_name)
11+
- WILDCARD(lolbas_file_path)
612
min_matches: 1
713
max_matches: 1
8-
case_sensitive_match: 'false'
14+
case_sensitive_match: false

‎lookups/loldrivers.yml

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
description: A list of known vulnerable drivers
2-
filename: loldrivers.csv
31
name: loldrivers
4-
default_match: 'false'
5-
match_type: WILDCARD(driver_name)
2+
date: 2024-12-23
3+
version: 2
4+
id: a4c71880-bb4a-4e2c-9b44-be70cf181fb3
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A list of known vulnerable drivers
8+
default_match: false
9+
match_type:
10+
- WILDCARD(driver_name)
611
min_matches: 1
7-
case_sensitive_match: 'false'
12+
case_sensitive_match: false

‎lookups/lookup_rare_process_allow_list_default.yml

+11-6
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
case_sensitive_match: 'false'
2-
default_match: 'false'
3-
description: A list of rare processes that are legitimate that is provided by Splunk
4-
filename: rare_process_allow_list_default.csv
5-
match_type: WILDCARD(process)
6-
min_matches: 1
71
name: lookup_rare_process_allow_list_default
2+
date: 2024-12-23
3+
version: 2
4+
id: fc0c452e-47b1-4931-ba41-de5b7c6ed92b
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
case_sensitive_match: false
8+
default_match: false
9+
description: A list of rare processes that are legitimate that is provided by Splunk
10+
match_type:
11+
- WILDCARD(process)
12+
min_matches: 1

‎lookups/lookup_rare_process_allow_list_local.yml

+11-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
1-
case_sensitive_match: 'false'
2-
default_match: 'false'
1+
name: lookup_rare_process_allow_list_local
2+
date: 2024-12-23
3+
version: 2
4+
id: 7aec9c17-69b8-4a0b-8f8d-d3ea9b0e2adb
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
case_sensitive_match: false
8+
default_match: false
39
description: A list of rare processes that are legitimate provided by the end user
4-
filename: rare_process_allow_list_local.csv
5-
match_type: WILDCARD(process)
10+
match_type:
11+
- WILDCARD(process)
612
min_matches: 1
7-
name: lookup_rare_process_allow_list_local
13+

‎lookups/lookup_uncommon_processes_default.yml

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
1-
case_sensitive_match: 'false'
2-
description: A list of processes that are not common
3-
filename: uncommon_processes_default.csv
4-
match_type: WILDCARD(process)
51
name: lookup_uncommon_processes_default
2+
date: 2024-12-23
3+
version: 2
4+
id: 486eba44-2238-4246-98ca-1ff9b6e1c023
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
case_sensitive_match: false
8+
description: A list of processes that are not common
9+
match_type:
10+
- WILDCARD(process)
11+

‎lookups/lookup_uncommon_processes_local.yml

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
1-
case_sensitive_match: 'false'
2-
description: A list of processes that are not common
3-
filename: uncommon_processes_local.csv
4-
match_type: WILDCARD(process)
51
name: lookup_uncommon_processes_local
2+
date: 2024-12-23
3+
version: 2
4+
id: 3ece1ae5-4389-485e-b2b9-4cafdb6924dc
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
case_sensitive_match: false
8+
description: A list of processes that are not common
9+
match_type:
10+
- WILDCARD(process)
11+

‎lookups/mandatory_job_for_workflow.yml

+8-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1-
description: A lookup file that will be used to define the mandatory job for workflow
2-
filename: mandatory_job_for_workflow.csv
31
name: mandatory_job_for_workflow
2+
date: 2024-12-23
3+
version: 2
4+
id: 76d805e3-b538-43c7-bd8b-f5fd62af596a
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A lookup file that will be used to define the mandatory job for workflow
8+
9+

‎lookups/mandatory_step_for_job.yml

+6-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1-
description: A lookup file that will be used to define the mandatory step for job
2-
filename: mandatory_step_for_job.csv
31
name: mandatory_step_for_job
2+
date: 2024-12-23
3+
version: 2
4+
id: ac92a35c-26c4-4f6c-a005-d152b5b343b2
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A lookup file that will be used to define the mandatory step for job

‎lookups/msad_guid_lookup.yml

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
name: msad_guid_lookup
2+
date: 2024-12-23
3+
version: 2
4+
id: d8812c9c-9a4c-4b4b-9995-31db35c0b8cf
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
17
description: A lookup file that will contain translations for AD object ace control access rights guids
2-
filename: msad_guid_lookup.csv
3-
name: msad_guid_lookup
8+

‎lookups/privileged_azure_ad_roles.yml

+11-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
1-
description: A list of privileged Azure Active Directory roles, includes updates for 2024 and template IDs.
2-
filename: privileged_azure_ad_roles20240807.csv
31
name: privileged_azure_ad_roles
4-
default_match: 'false'
5-
match_type: WILDCARD(azureadrole),WILDCARD(azuretemplateid)
2+
date: 2024-12-23
3+
version: 2
4+
id: 4dbf0357-b5fc-4be2-9058-804d6a60b126
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A list of privileged Azure Active Directory roles, includes updates for 2024 and template IDs.
8+
default_match: false
9+
match_type:
10+
- WILDCARD(azureadrole)
11+
- WILDCARD(azuretemplateid)
612
min_matches: 1
7-
case_sensitive_match: 'false'
13+
case_sensitive_match: false

‎lookups/ransomware_extensions_lookup.yml

+10-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
1-
default_match: 'false'
1+
name: ransomware_extensions_lookup
2+
date: 2024-12-23
3+
version: 2
4+
id: eaf9e6bb-55fa-4bab-89a5-b0229638c526
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
default_match: false
28
description: A list of file extensions that are associated with ransomware
39
filename: ransomware_extensions_20241212.csv
4-
match_type: WILDCARD(Extensions)
10+
match_type:
11+
- WILDCARD(Extensions)
512
min_matches: 1
6-
name: ransomware_extensions_lookup
7-
case_sensitive_match: 'false'
13+
case_sensitive_match: false

‎lookups/ransomware_notes_lookup.yml

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
default_match: 'false'
1+
name: ransomware_notes_lookup
2+
date: 2024-12-23
3+
version: 2
4+
id: 93d9fb06-035e-496c-91d5-7a79543ce1e1
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
default_match: false
28
description: A list of file names that are ransomware note files
3-
filename: ransomware_notes_20231219.csv
4-
match_type: WILDCARD(ransomware_notes)
9+
match_type:
10+
- WILDCARD(ransomware_notes)
511
min_matches: 1
6-
name: ransomware_notes_lookup
7-
case_sensitive_match: 'false'
12+
case_sensitive_match: false

‎lookups/remote_access_software.yml

+12-5
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,15 @@
1-
description: A list of Remote Access Software
2-
filename: remote_access_software20240726.csv
31
name: remote_access_software
4-
default_match: 'false'
5-
match_type: WILDCARD(remote_utility),WILDCARD(remote_domain),WILDCARD(remote_utility_fileinfo)
2+
date: 2024-12-23
3+
version: 2
4+
id: f3b92ff9-667c-481f-b29d-458e10d48508
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A list of Remote Access Software
8+
default_match: false
9+
match_type:
10+
- WILDCARD(remote_utility)
11+
- WILDCARD(remote_domain)
12+
- WILDCARD(remote_utility_fileinfo)
613
min_matches: 1
714
max_matches: 1
8-
case_sensitive_match: 'false'
15+
case_sensitive_match: false

‎lookups/remote_access_software_exceptions.yml

+14-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,16 @@
1+
name: remote_access_software_exceptions
2+
date: 2024-12-23
3+
version: 2
4+
id: 2742e885-0706-494b-8f56-a90a3e8d33b4
5+
author: Splunk Threat Research Team
6+
lookup_type: kvstore
17
description: A list used to provide global exceptions to remote access monitoring content.
28
collection: remote_access_software_exceptions
3-
name: remote_access_software_exceptions
4-
fields_list: _key, asset, software, exception_date, exception_ttl_days, exception, comment
9+
fields_list:
10+
- _key
11+
- asset
12+
- software
13+
- exception_date
14+
- exception_ttl_days
15+
- exception
16+
- comment

‎lookups/s3_deletion_baseline.yml

+13-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,15 @@
1+
name: s3_deletion_baseline
2+
date: 2024-12-23
3+
version: 2
4+
id: 45e5d266-f80b-43f8-b4a7-87e070da4e70
5+
author: Splunk Threat Research Team
6+
lookup_type: kvstore
17
description: A placeholder for the baseline information for AWS S3 deletions
28
collection: s3_deletion_baseline
3-
name: s3_deletion_baseline
4-
fields_list: _key, arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls
9+
fields_list:
10+
- _key
11+
- arn
12+
- latestCount
13+
- numDataPoints
14+
- avgApiCalls
15+
- stdevApiCalls

0 commit comments

Comments
 (0)