Skip to content

Commit 8b1b3d5

Browse files
pyth0n1cpyth0n1c
committed
first batch of updates to
lookup ymls
1 parent e1dde45 commit 8b1b3d5

16 files changed

+129
-58
lines changed

‎lookups/3cx_ioc_domains.yml

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
description: A list of domains from the 3CX supply chain attack.
2-
filename: 3cx_ioc_domains.csv
31
name: 3cx_ioc_domains
4-
default_match: 'false'
5-
match_type: WILDCARD(domain)
2+
date: 2024-12-23
3+
version: 2
4+
id: 65c25399-4081-4ef1-b791-86f497d3380d
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A list of domains from the 3CX supply chain attack.
8+
default_match: false
9+
match_type:
10+
- WILDCARD(domain)
611
min_matches: 1
7-
case_sensitive_match: 'false'
12+
case_sensitive_match: false

‎lookups/__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

+7-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
description: Detect DNS Data Exfiltration using pretrained Model in DSDL
2-
filename: __mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.mlmodel
31
name: __mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl
4-
case_sensitive_match: 'false'
2+
date: 2024-12-23
3+
version: 2
4+
id: db5df924-c34c-4b0f-9333-a08b2af98e65
5+
author: Splunk Threat Research Team
6+
lookup_type: mlmodel
7+
description: Detect DNS Data Exfiltration using pretrained Model in DSDL
8+
case_sensitive_match: false

‎lookups/__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml

+7-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
description: Detect suspicious DNS txt records using Pretrained Model in DSDL
2-
filename: __mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.mlmodel
31
name: __mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl
4-
case_sensitive_match: 'false'
2+
date: 2024-12-23
3+
version: 2
4+
id: d5099bcb-420e-4eec-9714-db0590ea4f03
5+
author: Splunk Threat Research Team
6+
lookup_type: mlmodel
7+
description: Detect suspicious DNS txt records using Pretrained Model in DSDL
8+
case_sensitive_match: false

‎lookups/__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml

+7-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
description: Detect a suspicious processname using Pretrained Model in DSDL
2-
filename: __mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel
31
name: __mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl
4-
case_sensitive_match: 'false'
2+
date: 2024-12-23
3+
version: 2
4+
id: 4660425a-4fdb-4a25-895b-abbd2557aa64
5+
author: Splunk Threat Research Team
6+
lookup_type: mlmodel
7+
description: Detect a suspicious processname using Pretrained Model in DSDL
8+
case_sensitive_match: false

‎lookups/__mlspl_pretrained_dga_model_dsdl.yml

+7-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
description: Detect DGA domains using Pretrained Model in DSDL
2-
filename: __mlspl_pretrained_dga_model_dsdl.mlmodel
31
name: __mlspl_pretrained_dga_model_dsdl
4-
case_sensitive_match: 'false'
2+
date: 2024-12-23
3+
version: 2
4+
id: 6c55ccdb-7006-4367-80b6-55bee5eae1a2
5+
author: Splunk Threat Research Team
6+
lookup_type: mlmodel
7+
description: Detect DGA domains using Pretrained Model in DSDL
8+
case_sensitive_match: false

‎lookups/__mlspl_unusual_commandline_detection.yml

+8-4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1-
description: An MLTK model for detecting malicious commandlines
2-
filename: __mlspl_unusual_commandline_detection.mlmodel
31
name: __mlspl_unusual_commandline_detection
4-
case_sensitive_match: 'false'
2+
date: 2024-12-23
3+
version: 2
4+
id: e340177d-f2c5-4cb7-8b13-9f484934f648
5+
author: Splunk Threat Research Team
6+
lookup_type: mlmodel
7+
description: An MLTK model for detecting malicious commandlines
8+
case_sensitive_match: false
59
min_matches: 1
6-
default_match: 'false'
10+
default_match: false

‎lookups/ace_access_rights_lookup.yml

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
name: ace_access_rights_lookup
2+
date: 2024-12-23
3+
version: 2
4+
id: 26cf3fc4-cee2-431a-9583-c4a404a25275
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
17
description: A lookup file that will contain translations for AD object ace access rights strings
2-
filename: ace_access_rights_lookup.csv
3-
name: ace_access_rights_lookup
8+

‎lookups/ace_flag_lookup.yml

+7-3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1-
description: A lookup file that will contain translations for AD object ace flags strings
2-
filename: ace_flag_lookup.csv
3-
name: ace_flag_lookup
1+
name: ace_flag_lookup
2+
date: 2024-12-23
3+
version: 2
4+
id: 6f4b0d42-5f24-4992-98f9-aebbc7ced9bf
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A lookup file that will contain translations for AD object ace flags strings

‎lookups/ace_type_lookup.yml

+7-3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1-
description: A lookup file that will contain translations for AD object ace type strings
2-
filename: ace_type_lookup.csv
3-
name: ace_type_lookup
1+
name: ace_type_lookup
2+
date: 2024-12-23
3+
version: 2
4+
id: 86e4531f-a37e-430c-9d5f-1447af2bc619
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A lookup file that will contain translations for AD object ace type strings

‎lookups/advanced_audit_policy_guids.yml

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
description: List of GUIDs associated with Windows advanced audit policies
2-
filename: advanced_audit_policy_guids.csv
31
name: advanced_audit_policy_guids
4-
default_match: 'false'
5-
match_type: WILDCARD(GUID)
2+
date: 2024-12-23
3+
version: 2
4+
id: e2581a3a-1254-4b93-ae8f-ccde22362f0c
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: List of GUIDs associated with Windows advanced audit policies
8+
default_match: false
9+
match_type:
10+
- WILDCARD(GUID)
611
min_matches: 1
7-
case_sensitive_match: 'false'
12+
case_sensitive_match: false

‎lookups/applockereventcodes.yml

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
description: A csv of the ID and rule name for AppLocker event codes.
2-
filename: applockereventcodes.csv
31
name: applockereventcodes
4-
default_match: 'false'
5-
match_type: WILDCARD(AppLocker_Event_Code)
2+
date: 2024-12-23
3+
version: 2
4+
id: 2fd8cc84-f4c8-4ab6-bd57-596f714a315f
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A csv of the ID and rule name for AppLocker event codes.
8+
default_match: false
9+
match_type:
10+
- WILDCARD(AppLocker_Event_Code)
611
min_matches: 1
7-
case_sensitive_match: 'false'
12+
case_sensitive_match: false

‎lookups/asr_rules.yml

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
description: A csv of the ID and rule name for ASR, Microsoft Attack Surface Reduction rules.
2-
filename: asr_rules.csv
31
name: asr_rules
4-
default_match: 'false'
5-
match_type: WILDCARD(ASR_Rule)
2+
date: 2024-12-23
3+
version: 2
4+
id: 3886d687-ae77-4a61-99eb-e745083e391e
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A csv of the ID and rule name for ASR, Microsoft Attack Surface Reduction rules.
8+
default_match: false
9+
match_type:
10+
- WILDCARD(ASR_Rule)
611
min_matches: 1
7-
case_sensitive_match: 'false'
12+
case_sensitive_match: false

‎lookups/attacker_tools.yml

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
description: A list of tools used by attackers
2-
filename: attacker_tools.csv
31
name: attacker_tools
4-
default_match: 'false'
5-
match_type: WILDCARD(attacker_tool_names)
2+
date: 2024-12-23
3+
version: 2
4+
id: 72620fe1-26cb-4cee-a6ee-8c6127056d81
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A list of tools used by attackers
8+
default_match: false
9+
match_type:
10+
- WILDCARD(attacker_tool_names)
611
min_matches: 1
7-
case_sensitive_match: 'false'
12+
case_sensitive_match: false

‎lookups/aws_service_accounts.yml

+6-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1-
description: A lookup file that will contain AWS Service accounts
2-
filename: aws_service_accounts.csv
31
name: aws_service_accounts
2+
date: 2024-12-23
3+
version: 2
4+
id: 33868b47-48b2-42ad-8acb-0416772ae664
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A lookup file that will contain AWS Service accounts

‎lookups/brandmonitoring_lookup.yml

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
default_match: 'false'
1+
name: brandMonitoring_lookup
2+
date: 2024-12-23
3+
version: 2
4+
id: 6fff763a-d654-42dc-8e56-92c8e255ac55
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
default_match: false
28
description: A file that contains look-a-like domains for brands that you want to
39
monitor
4-
filename: brand_monitoring.csv
5-
match_type: WILDCARD(domain)
6-
min_matches: 1
7-
name: brandMonitoring_lookup
10+
match_type:
11+
- WILDCARD(domain)
12+
min_matches: 1

‎lookups/prohibited_processes.yml

+6-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1-
description: A list of processes that have been marked as prohibited
2-
filename: prohibited_processes.csv
31
name: prohibited_processes
2+
date: 2024-12-23
3+
version: 2
4+
id: 310910fe-5158-4f87-8e45-9a307b6ffa8c
5+
author: Splunk Threat Research Team
6+
lookup_type: csv
7+
description: A list of processes that have been marked as prohibited

0 commit comments

Comments
 (0)