macros.conf

#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2024-01-30T21:29:48 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############

[detect_new_login_attempts_to_routers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_risky_spl_using_pretrained_ml_model_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[email_attachments_with_lots_of_spaces_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[email_files_written_outside_of_the_outlook_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[email_servers_sending_high_volume_traffic_to_hosts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[monitor_email_for_brand_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[no_windows_updates_in_a_time_frame_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_account_locked_out_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_account_lockout_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_failed_sso_attempts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_mfa_exhaustion_hunt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_mismatch_between_source_and_response_for_verify_push_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_multiple_failed_requests_to_access_applications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_new_api_token_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_new_device_enrolled_on_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_phishing_detection_with_fastpass_origin_check_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_risk_threshold_exceeded_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_suspicious_activity_reported_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_suspicious_use_of_a_session_cookie_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_threatinsight_login_failure_with_high_unknown_users_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_threatinsight_suspected_passwordspray_attack_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_threatinsight_threat_detected_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_two_or_more_rejected_okta_pushes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_user_logins_from_multiple_cities_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[path_traversal_spl_injection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[pingid_mismatch_auth_source_and_verification_response_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[pingid_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[pingid_new_mfa_method_after_credential_reset_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[pingid_new_mfa_method_registered_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_absolute_path_traversal_using_runshellscript_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_account_discovery_drilldown_dashboard_disclosure_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_app_for_lookup_file_editing_rce_via_user_xslt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_code_injection_via_custom_dashboard_leading_to_rce_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_command_and_scripting_interpreter_delete_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_command_and_scripting_interpreter_risky_commands_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_command_and_scripting_interpreter_risky_spl_mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_data_exfiltration_from_analytics_workspace_using_sid_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_digital_certificates_infrastructure_version_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_digital_certificates_lack_of_encryption_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_dos_using_malformed_saml_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_dos_via_dump_spl_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_dos_via_malformed_s2s_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_dos_via_printf_search_function_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_edit_user_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_endpoint_denial_of_service_dos_zip_bomb_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_enterprise_kv_store_incorrect_authorization_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_enterprise_windows_deserialization_file_partition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_es_dos_investigations_manager_via_investigation_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_es_dos_through_investigation_attachments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_http_response_splitting_via_rest_spl_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_improperly_formatted_parameter_crashes_splunkd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_information_disclosure_in_splunk_add_on_builder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_list_all_nonstandard_admin_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_low_privilege_user_can_view_hashed_splunk_password_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[persistent_xss_in_rapiddiag_through_user_interface_views_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_persistent_xss_via_url_validation_bypass_w_dashboard_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_process_injection_forwarder_bundle_downloads_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_protocol_impersonation_weak_encryption_configuration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_protocol_impersonation_weak_encryption_selfsigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_protocol_impersonation_weak_encryption_simplerequest_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_rce_via_serialized_session_payload_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_rce_via_user_xslt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_reflected_xss_in_the_templates_lists_radio_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_reflected_xss_on_app_search_table_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_risky_command_abuse_disclosed_february_2023_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_stored_xss_via_data_model_objectname_field_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_unauthenticated_log_injection_web_service_log_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_user_enumeration_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_xss_in_highlighted_json_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_xss_in_monitoring_console_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_xss_in_save_table_dialog_header_in_search_page_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_xss_via_view_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_email_attachment_extensions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_java_classes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[web_servers_executing_suspicious_processes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[abnormally_high_number_of_cloud_instances_destroyed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[abnormally_high_number_of_cloud_instances_launched_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[abnormally_high_number_of_cloud_security_group_api_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[amazon_eks_kubernetes_cluster_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[amazon_eks_kubernetes_pod_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[asl_aws_concurrent_sessions_from_different_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[asl_aws_createaccesskey_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[asl_aws_defense_evasion_delete_cloudtrail_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[asl_aws_defense_evasion_delete_cloudwatch_log_group_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[asl_aws_defense_evasion_impair_security_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[asl_aws_excessive_security_scanning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[asl_aws_iam_delete_policy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[asl_aws_multi_factor_authentication_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[asl_aws_new_mfa_method_registered_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[asl_aws_password_policy_changes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_ami_atttribute_modification_for_exfiltration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_concurrent_sessions_from_different_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_console_login_failed_during_mfa_challenge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_create_policy_version_to_allow_all_resources_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_createaccesskey_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_createloginprofile_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_credential_access_failed_login_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_credential_access_getpassworddata_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_credential_access_rds_password_reset_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_cross_account_activity_from_previously_unseen_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_defense_evasion_delete_cloudtrail_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_defense_evasion_delete_cloudwatch_log_group_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_defense_evasion_impair_security_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_defense_evasion_putbucketlifecycle_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_defense_evasion_stop_logging_cloudtrail_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_defense_evasion_update_cloudtrail_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_detect_attach_to_role_policy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_detect_permanent_key_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_detect_role_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_detect_sts_assume_role_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_detect_sts_get_session_token_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_detect_users_with_kms_keys_performing_encryption_s3_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_disable_bucket_versioning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_ec2_snapshot_shared_externally_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_ecr_container_scanning_findings_high_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_ecr_container_scanning_findings_low_informational_unknown_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_ecr_container_scanning_findings_medium_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_ecr_container_upload_outside_business_hours_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_ecr_container_upload_unknown_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_excessive_security_scanning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_exfiltration_via_anomalous_getobject_api_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_exfiltration_via_batch_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_exfiltration_via_bucket_replication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_exfiltration_via_datasync_task_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_exfiltration_via_ec2_snapshot_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_high_number_of_failed_authentications_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_high_number_of_failed_authentications_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_iam_accessdenied_discovery_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_iam_assume_role_policy_brute_force_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_iam_delete_policy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_iam_failure_group_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_iam_successful_group_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_lambda_updatefunctioncode_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_multi_factor_authentication_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_multiple_users_failing_to_authenticate_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_network_access_control_list_created_with_all_open_ports_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_network_access_control_list_deleted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_new_mfa_method_registered_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_password_policy_changes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_s3_exfiltration_behavior_identified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_saml_access_by_provider_user_and_principal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_saml_update_identity_provider_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_setdefaultpolicyversion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_successful_console_authentication_from_multiple_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_successful_single_factor_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_unusual_number_of_failed_authentications_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_updateloginprofile_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_active_directory_high_risk_sign_in_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_application_administrator_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_authentication_failed_during_mfa_challenge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_block_user_consent_for_risky_apps_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_concurrent_sessions_from_different_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_device_code_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_external_guest_user_invited_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_global_administrator_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_high_number_of_failed_authentications_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_high_number_of_failed_authentications_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_multi_factor_authentication_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_multi_source_failed_authentications_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_multiple_appids_and_useragents_authentication_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_multiple_denied_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_multiple_users_failing_to_authenticate_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_new_custom_domain_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_new_federated_domain_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_new_mfa_method_registered_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_new_mfa_method_registered_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_oauth_application_consent_granted_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_pim_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_pim_role_assignment_activated_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_privileged_authentication_administrator_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_privileged_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_privileged_role_assigned_to_service_principal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_service_principal_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_service_principal_new_client_credentials_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_service_principal_owner_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_successful_authentication_from_different_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_successful_powershell_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_successful_single_factor_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_tenant_wide_admin_consent_granted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_unusual_number_of_failed_authentications_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_user_consent_blocked_for_risky_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_user_consent_denied_for_oauth_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_user_enabled_and_password_reset_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_ad_user_immutableid_attribute_updated_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_automation_account_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_automation_runbook_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[azure_runbook_webhook_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[circle_ci_disable_security_job_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[circle_ci_disable_security_step_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cloud_api_calls_from_previously_unseen_user_roles_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cloud_compute_instance_created_by_previously_unseen_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cloud_compute_instance_created_in_previously_unused_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cloud_compute_instance_created_with_previously_unseen_image_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cloud_compute_instance_created_with_previously_unseen_instance_type_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cloud_instance_modified_by_previously_unseen_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cloud_provisioning_activity_from_previously_unseen_city_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cloud_provisioning_activity_from_previously_unseen_country_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cloud_provisioning_activity_from_previously_unseen_ip_address_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cloud_provisioning_activity_from_previously_unseen_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_aws_console_login_by_new_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_aws_console_login_by_user_from_new_city_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_aws_console_login_by_user_from_new_country_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_aws_console_login_by_user_from_new_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_gcp_storage_access_from_a_new_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_new_open_gcp_storage_buckets_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_new_open_s3_buckets_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_new_open_s3_buckets_over_aws_cli_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_s3_access_from_a_new_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_spike_in_aws_security_hub_alerts_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_spike_in_s3_bucket_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_authentication_failed_during_mfa_challenge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_detect_gcploit_framework_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_kubernetes_cluster_pod_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_multi_factor_authentication_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_multiple_users_failing_to_authenticate_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_successful_single_factor_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_unusual_number_of_failed_authentications_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gdrive_suspicious_file_sharing_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[github_actions_disable_security_workflow_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[github_commit_changes_in_master_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[github_commit_in_develop_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[github_dependabot_alert_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[github_pull_request_from_unknown_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gsuite_drive_share_in_external_email_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gsuite_email_suspicious_attachment_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gsuite_email_suspicious_subject_with_attachment_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gsuite_email_with_known_abuse_web_service_link_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gsuite_outbound_email_with_attachment_to_external_domain_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gsuite_suspicious_calendar_invite_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gsuite_suspicious_shared_file_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[high_number_of_login_failures_from_a_single_source_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_abuse_of_secret_by_unusual_location_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_abuse_of_secret_by_unusual_user_agent_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_abuse_of_secret_by_unusual_user_group_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_abuse_of_secret_by_unusual_user_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_access_scanning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_anomalous_inbound_network_activity_from_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_anomalous_inbound_outbound_network_io_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_anomalous_inbound_to_outbound_network_io_ratio_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_anomalous_outbound_network_activity_from_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_anomalous_traffic_on_network_edge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_aws_detect_suspicious_kubectl_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_create_or_update_privileged_pod_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_cron_job_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_daemonset_deployed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_falco_shell_spawned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_newly_seen_tcp_edge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_newly_seen_udp_edge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_nginx_ingress_lfi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_nginx_ingress_rfi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_node_port_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_pod_created_in_default_namespace_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_pod_with_host_network_attachment_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_previously_unseen_container_image_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_previously_unseen_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_process_running_from_new_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_process_with_anomalous_resource_utilisation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_process_with_resource_ratio_anomalies_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_scanner_image_pulling_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_scanning_by_unauthenticated_ip_address_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_shell_running_on_worker_node_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_shell_running_on_worker_node_with_cpu_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_suspicious_image_pulling_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_unauthorized_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_add_app_role_assignment_grant_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_added_service_principal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_advanced_audit_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_application_registration_owner_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_applicationimpersonation_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_block_user_consent_for_risky_apps_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_bypass_mfa_via_trusted_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_concurrent_sessions_from_different_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_disable_mfa_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_excessive_authentication_failures_alert_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_excessive_sso_logon_errors_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_file_permissioned_application_consent_granted_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_high_number_of_failed_authentications_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_high_privilege_role_granted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_mail_permissioned_application_consent_granted_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_mailbox_inbox_folder_shared_with_all_users_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_mailbox_read_access_granted_to_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_multi_source_failed_authentications_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_multiple_appids_and_useragents_authentication_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_multiple_users_failing_to_authenticate_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_new_federated_domain_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_new_mfa_method_registered_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_pst_export_alert_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_service_principal_new_client_credentials_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_suspicious_admin_email_forwarding_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_suspicious_rights_delegation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_suspicious_user_email_forwarding_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_tenant_wide_admin_consent_granted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_user_consent_blocked_for_risky_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[o365_user_consent_denied_for_oauth_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[risk_rule_for_dev_sec_ops_by_repository_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[abnormally_high_aws_instances_launched_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[abnormally_high_aws_instances_launched_by_user___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[abnormally_high_aws_instances_terminated_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[abnormally_high_aws_instances_terminated_by_user___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_cloud_provisioning_from_previously_unseen_city_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_cloud_provisioning_from_previously_unseen_country_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_cloud_provisioning_from_previously_unseen_ip_address_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_cloud_provisioning_from_previously_unseen_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[aws_eks_kubernetes_cluster_sensitive_object_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[clients_connecting_to_multiple_dns_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cloud_network_access_control_list_deleted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[correlation_by_repository_and_risk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[correlation_by_user_and_risk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_activity_related_to_pass_the_hash_attacks_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_api_activity_from_users_without_mfa_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_aws_api_activities_from_unapproved_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_long_dns_txt_record_response_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_mimikatz_using_loaded_images_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_mimikatz_via_powershell_and_eventcode_4703_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_new_api_calls_from_user_roles_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_new_user_aws_console_login_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_spike_in_aws_api_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_spike_in_network_acl_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_spike_in_security_group_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_usb_device_insertion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_web_traffic_to_dynamic_domain_providers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detection_of_dns_tunnels_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[dns_query_requests_resolved_by_unauthorized_dns_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[dns_record_changed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[dump_lsass_via_procdump_rename_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ec2_instance_modified_with_previously_unseen_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ec2_instance_started_in_previously_unseen_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ec2_instance_started_with_previously_unseen_ami_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ec2_instance_started_with_previously_unseen_instance_type_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ec2_instance_started_with_previously_unseen_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[execution_of_file_with_spaces_before_extension_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[extended_period_without_successful_netbackup_backups_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[first_time_seen_command_line_argument_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_detect_accounts_with_high_risk_roles_by_project_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_detect_high_risk_permissions_by_resource_and_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_detect_oauth_token_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gcp_kubernetes_cluster_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[identify_new_user_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_aws_detect_most_active_service_accounts_by_pod_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_aws_detect_sensitive_role_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_azure_active_service_accounts_by_pod_namespace_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_azure_detect_rbac_authorization_by_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_azure_detect_sensitive_object_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_azure_detect_sensitive_role_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_azure_pod_scan_fingerprint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_azure_scan_fingerprint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_gcp_detect_rbac_authorizations_by_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_gcp_detect_sensitive_object_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_gcp_detect_sensitive_role_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kubernetes_gcp_detect_suspicious_kubectl_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[monitor_dns_for_brand_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[open_redirect_in_splunk_web_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[osquery_pack___coldroot_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[processes_created_by_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[prohibited_software_on_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[reg_exe_used_to_hide_files_directories_via_registry_keys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_registry_key_modifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[scheduled_tasks_used_in_badrabbit_ransomware_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[spectre_and_meltdown_vulnerable_systems_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_enterprise_information_disclosure_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_changes_to_file_associations_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_email___uba_anomaly_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_file_write_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_powershell_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_rundll32_rename_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_writes_to_system_volume_information_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[uncommon_processes_on_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unsigned_image_loaded_by_lsass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unsuccessful_netbackup_backups_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[web_fraud___account_harvesting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[web_fraud___anomalous_user_clickspeed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[web_fraud___password_sharing_across_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_connhost_exe_started_forcefully_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_hosts_file_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[3cx_supply_chain_attack_network_indicators_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[7zip_commandline_to_smb_share_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[access_lsass_memory_for_dump_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[account_discovery_with_net_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[active_directory_lateral_movement_identified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[active_directory_privilege_escalation_identified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[active_setup_registry_autostart_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[add_defaultuser_and_password_in_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[add_or_set_windows_defender_exclusion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[adsisearcher_account_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[allow_file_and_printing_sharing_in_firewall_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[allow_inbound_traffic_by_firewall_rule_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[allow_inbound_traffic_in_firewall_rule_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[allow_network_discovery_in_firewall_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[allow_operation_with_consent_admin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[anomalous_usage_of_7zip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[any_powershell_downloadfile_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[any_powershell_downloadstring_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[attacker_tools_on_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[attempt_to_add_certificate_to_untrusted_store_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[attempt_to_stop_security_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[attempted_credential_dump_from_registry_via_reg_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[auto_admin_logon_registry_entry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[batch_file_write_to_system32_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[bcdedit_command_back_to_normal_mode_boot_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[bcdedit_failure_recovery_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[bits_job_persistence_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[bitsadmin_download_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[certutil_download_with_urlcache_and_split_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[certutil_download_with_verifyctl_and_split_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[certutil_exe_certificate_extraction_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[certutil_with_decode_argument_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[change_default_file_association_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[change_to_safe_mode_with_network_config_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[chcp_command_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[check_elevated_cmd_using_whoami_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[child_processes_of_spoolsv_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[clear_unallocated_sector_using_cipher_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[clop_common_exec_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[clop_ransomware_known_service_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cmd_carry_out_string_command_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cmd_echo_pipe___escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cmdline_tool_not_executed_in_cmd_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cmlua_or_cmstplua_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cobalt_strike_named_pipes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[common_ransomware_extensions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[common_ransomware_notes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[conti_common_exec_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[control_loading_from_world_writable_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[create_local_admin_accounts_using_net_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[create_or_delete_windows_shares_using_net_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[create_remote_thread_in_shell_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[create_remote_thread_into_lsass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[creation_of_lsass_dump_with_taskmgr_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[creation_of_shadow_copy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[creation_of_shadow_copy_with_wmic_and_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[credential_dumping_via_copy_command_from_shadow_copy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[credential_dumping_via_symlink_to_shadow_copy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[csc_net_on_the_fly_compilation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[curl_download_and_bash_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[delete_shadowcopy_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[deleting_of_net_users_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[deleting_shadow_copies_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_azurehound_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_azurehound_file_modifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_baron_samedit_cve_2021_3156_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_baron_samedit_cve_2021_3156_segfault_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_baron_samedit_cve_2021_3156_via_osquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_certify_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_certify_with_powershell_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_certipy_file_modifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_computer_changed_with_anonymous_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_copy_of_shadowcopy_with_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_credential_dumping_through_lsass_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_empire_with_powershell_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_excessive_account_lockouts_from_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_excessive_user_account_lockouts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_exchange_web_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_html_help_renamed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_html_help_spawn_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_html_help_url_in_command_line_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_html_help_using_infotech_storage_handlers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_mimikatz_with_powershell_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_mshta_inline_hta_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_mshta_renamed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_mshta_url_in_command_line_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_new_local_admin_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_outlook_exe_writing_a_zip_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_path_interception_by_creation_of_program_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_processes_used_for_system_network_configuration_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_prohibited_applications_spawning_cmd_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_psexec_with_accepteula_flag_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_rare_executables_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_rclone_command_line_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_regasm_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_regasm_with_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_regasm_with_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_regsvcs_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_regsvcs_with_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_regsvcs_with_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_regsvr32_application_control_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_renamed_7_zip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_renamed_psexec_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_renamed_rclone_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_renamed_winrar_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_rtlo_in_file_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_rtlo_in_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_rundll32_application_control_bypass___advpack_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_rundll32_application_control_bypass___setupapi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_rundll32_application_control_bypass___syssetup_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_rundll32_inline_hta_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_sharphound_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_sharphound_file_modifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_sharphound_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_suspicious_processnames_using_pretrained_model_in_dsdl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_use_of_cmd_exe_to_launch_script_interpreters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_webshell_exploit_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_wmi_event_subscription_persistence_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detection_of_tools_built_by_nirsoft_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_amsi_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_defender_antivirus_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_defender_blockatfirstseen_feature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_defender_enhanced_notification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_defender_mpengine_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_defender_spynet_reporting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_defender_submit_samples_consent_feature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_etw_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_logs_using_wevtutil_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_registry_tool_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_schedule_task_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_security_logs_using_minint_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_show_hidden_files_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_uac_remote_restriction_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_windows_app_hotkeys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_windows_behavior_monitoring_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disable_windows_smartscreen_protection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabled_kerberos_pre_authentication_discovery_with_powerview_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabling_cmd_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabling_controlpanel_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabling_defender_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabling_firewall_with_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabling_folderoptions_windows_feature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabling_net_user_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabling_norun_windows_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabling_remote_user_account_control_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabling_systemrestore_in_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabling_task_manager_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[disabling_windows_local_security_authority_defences_via_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[dllhost_with_no_command_line_arguments_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[dns_exfiltration_using_nslookup_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[domain_account_discovery_with_dsquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[domain_account_discovery_with_net_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[domain_account_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[domain_controller_discovery_with_nltest_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[domain_controller_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[domain_group_discovery_with_adsisearcher_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[domain_group_discovery_with_dsquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[domain_group_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[domain_group_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[download_files_using_telegram_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[drop_icedid_license_dat_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[dsquery_domain_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[dump_lsass_via_comsvcs_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[dump_lsass_via_procdump_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[elevated_group_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[elevated_group_discovery_with_powerview_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[elevated_group_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[enable_rdp_in_other_port_number_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[enable_wdigest_uselogoncredential_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[enumerate_users_local_group_using_telegram_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[esentutl_sam_copy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[etw_registry_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[eventvwr_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excel_spawning_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excel_spawning_windows_script_host_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_attempt_to_disable_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_distinct_processes_from_windows_temp_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_file_deletion_in_windefender_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_number_of_service_control_start_as_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_number_of_taskhost_processes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_service_stop_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_usage_of_cacls_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_usage_of_net_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_usage_of_nslookup_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_usage_of_sc_service_utility_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_usage_of_taskkill_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[exchange_powershell_abuse_via_ssrf_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[exchange_powershell_module_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[executable_file_written_in_administrative_smb_share_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[executables_or_script_creation_in_suspicious_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[execute_javascript_with_jscript_com_clsid_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[execution_of_file_with_multiple_extensions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[extraction_of_registry_hives_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[file_with_samsam_extension_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[firewall_allowed_program_enable_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[first_time_seen_child_process_of_zoom_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[first_time_seen_running_windows_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[fodhelper_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[fsutil_zeroing_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_addefaultdomainpasswordpolicy_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_aduser_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_aduser_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_aduserresultantpasswordpolicy_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_aduserresultantpasswordpolicy_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_domainpolicy_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_domainpolicy_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_domaintrust_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_domaintrust_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_domainuser_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_domainuser_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_foresttrust_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_foresttrust_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_wmiobject_group_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[get_wmiobject_group_discovery_with_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getadcomputer_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getadcomputer_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getadgroup_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getadgroup_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getcurrent_user_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getcurrent_user_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getdomaincomputer_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getdomaincomputer_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getdomaincontroller_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getdomaincontroller_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getdomaingroup_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getdomaingroup_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getlocaluser_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getlocaluser_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getnettcpconnection_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getnettcpconnection_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getwmiobject_ds_computer_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getwmiobject_ds_computer_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getwmiobject_ds_group_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getwmiobject_ds_group_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getwmiobject_ds_user_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getwmiobject_ds_user_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getwmiobject_user_account_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[getwmiobject_user_account_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[gpupdate_with_no_command_line_arguments_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[headless_browser_mockbin_or_mocky_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[headless_browser_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[hide_user_account_from_sign_in_screen_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[hiding_files_and_directories_with_attrib_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[high_frequency_copy_of_files_in_network_share_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[high_process_termination_frequency_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[hunting_3cxdesktopapp_software_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[icacls_deny_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[icacls_grant_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[icedid_exfiltrated_archived_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[impacket_lateral_movement_commandline_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[impacket_lateral_movement_smbexec_commandline_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[impacket_lateral_movement_wmiexec_commandline_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[interactive_session_on_remote_endpoint_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[java_class_file_download_by_java_user_agent_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[java_writing_jsp_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[jscript_execution_using_cscript_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kerberoasting_spn_request_with_rc4_encryption_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kerberos_pre_authentication_flag_disabled_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kerberos_service_ticket_request_using_rc4_encryption_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kerberos_tgt_request_using_rc4_encryption_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[kerberos_user_enumeration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[known_services_killed_by_ransomware_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_account_manipulation_of_ssh_config_and_keys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_add_files_in_known_crontab_directories_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_add_user_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_adding_crontab_using_list_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_apt_get_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_apt_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_at_allow_config_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_at_application_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_awk_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_busybox_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_c89_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_c99_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_change_file_owner_to_root_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_clipboard_data_copy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_common_process_for_elevation_control_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_composer_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_cpulimit_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_csvtool_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_curl_upload_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_data_destruction_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_dd_file_overwrite_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_decode_base64_to_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_deleting_critical_directory_using_rm_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_deletion_of_cron_jobs_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_deletion_of_init_daemon_script_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_deletion_of_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_deletion_of_ssl_certificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_disable_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_doas_conf_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_doas_tool_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_docker_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_edit_cron_table_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_emacs_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_file_created_in_kernel_driver_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_file_creation_in_init_boot_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_file_creation_in_profile_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_find_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_gdb_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_gem_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_gnu_awk_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_hardware_addition_swapoff_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_high_frequency_of_file_deletion_in_boot_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_high_frequency_of_file_deletion_in_etc_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_impair_defenses_process_kill_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_indicator_removal_clear_cache_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_indicator_removal_service_file_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_ingress_tool_transfer_hunting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_ingress_tool_transfer_with_curl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_insert_kernel_module_using_insmod_utility_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_install_kernel_module_using_modprobe_utility_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_iptables_firewall_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_java_spawning_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_kernel_module_enumeration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_kworker_process_in_writable_process_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_make_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_mysql_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_ngrok_reverse_proxy_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_node_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_nopasswd_entry_in_sudoers_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_obfuscated_files_or_information_base64_decode_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_octave_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_openvpn_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_persistence_and_privilege_escalation_risk_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_php_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_pkexec_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_possible_access_or_modification_of_sshd_config_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_possible_access_to_credential_files_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_possible_access_to_sudoers_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_possible_append_command_to_at_allow_config_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_possible_append_command_to_profile_config_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_possible_cronjob_modification_with_editor_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_possible_ssh_key_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_preload_hijack_library_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_proxy_socks_curl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_puppet_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_rpm_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_ruby_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_service_file_created_in_systemd_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_service_restarted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_service_started_or_enabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_setuid_using_chmod_utility_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_setuid_using_setcap_utility_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_shred_overwrite_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_sqlite3_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_ssh_authorized_keys_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_ssh_remote_services_script_execute_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_stdout_redirection_to_dev_null_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_stop_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_sudo_or_su_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_sudoers_tmp_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_system_network_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_system_reboot_via_system_request_key_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_unix_shell_enable_all_sysrq_functions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[linux_visudo_utility_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[living_off_the_land_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[loading_of_dynwrapx_module_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[local_account_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[local_account_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[log4shell_cve_2021_44228_exploitation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[logon_script_event_trigger_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[lolbas_with_network_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[macos___re_opened_applications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[macos_lolbin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[macos_plutil_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[mailsniper_invoke_functions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[malicious_inprocserver32_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[malicious_powershell_executed_as_a_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[malicious_powershell_process___encoded_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[malicious_powershell_process___execution_policy_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[malicious_powershell_process_with_obfuscation_techniques_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[mimikatz_passtheticket_commandline_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[mmc_lolbas_execution_process_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[modification_of_wallpaper_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[modify_acl_permission_to_files_or_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[monitor_registry_keys_for_print_monitors_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ms_exchange_mailbox_replication_service_writing_active_server_pages_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ms_scripting_process_loading_ldap_module_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ms_scripting_process_loading_wmi_module_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[msbuild_suspicious_spawned_by_script_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[mshta_spawning_rundll32_or_regsvr32_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[mshtml_module_load_in_office_product_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[msi_module_loaded_by_non_system_binary_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[msmpeng_application_dll_side_loading_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[net_localgroup_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[net_profiler_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[network_connection_discovery_with_arp_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[network_connection_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[network_connection_discovery_with_netstat_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[network_discovery_using_route_windows_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[network_share_discovery_via_dir_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[nishang_powershelltcponeline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[nltest_domain_trust_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[non_chrome_process_accessing_chrome_default_dir_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[non_firefox_process_access_firefox_profile_dir_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[notepad_with_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ntdsutil_export_ntds_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_application_drop_executable_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_application_spawn_regsvr32_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_application_spawn_rundll32_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_document_creating_schedule_task_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_document_executing_macro_code_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_document_spawned_child_process_to_download_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_product_spawn_cmd_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_product_spawning_bitsadmin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_product_spawning_certutil_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_product_spawning_mshta_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_product_spawning_rundll32_with_no_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_product_spawning_windows_script_host_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_product_spawning_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_product_writing_cab_or_inf_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[office_spawning_control_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[outbound_network_connection_from_java_using_default_ports_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[overwriting_accessibility_binaries_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[papercut_ng_suspicious_behavior_debug_log_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[password_policy_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[permission_modification_using_takeown_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[petitpotam_network_share_access_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[petitpotam_suspicious_kerberos_tgt_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ping_sleep_batch_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[possible_browser_pass_view_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[possible_lateral_movement_powershell_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[potential_password_in_username_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[potentially_malicious_code_on_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_4104_hunting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell___connect_to_internet_with_hidden_window_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_com_hijacking_inprocserver32_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_creating_thread_mutex_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_disable_security_monitoring_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_domain_enumeration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_enable_powershell_remoting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_enable_smb1protocol_feature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_execute_com_object_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_fileless_process_injection_via_getprocaddress_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_fileless_script_contains_base64_encoded_content_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_get_localgroup_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_get_localgroup_discovery_with_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_invoke_cimmethod_cimsession_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_invoke_wmiexec_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_load_module_in_meterpreter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_loading_dotnet_into_memory_via_reflection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_processing_stream_of_data_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_remote_services_add_trustedhost_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_remote_thread_to_known_windows_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_remove_windows_defender_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_script_block_with_url_chain_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_start_bitstransfer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_start_or_stop_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_using_memory_as_backing_store_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_webrequest_using_memory_stream_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[powershell_windows_defender_exclusion_commands_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[prevent_automatic_repair_mode_using_bcdedit_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[print_processor_registry_autostart_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[print_spooler_adding_a_printer_driver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[print_spooler_failed_to_load_a_plug_in_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[process_creating_lnk_file_in_suspicious_location_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[process_deleting_its_process_file_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[process_execution_via_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[process_kill_base_on_file_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[process_writing_dynamicwrapperx_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[processes_launching_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[processes_tapping_keyboard_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[randomly_generated_scheduled_task_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[randomly_generated_windows_service_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ransomware_notes_bulk_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[recon_avproduct_through_pwh_or_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[recon_using_wmi_class_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[recursive_delete_of_directory_in_batch_cmd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[reg_exe_manipulating_windows_services_registry_keys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[registry_keys_for_creating_shim_databases_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[registry_keys_used_for_persistence_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[registry_keys_used_for_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[regsvr32_silent_and_install_param_dll_loading_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[regsvr32_with_known_silent_switch_cmdline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remcos_client_registry_install_entry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remcos_rat_file_creation_in_remcos_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_desktop_process_running_on_system_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_process_instantiation_via_dcom_and_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_process_instantiation_via_dcom_and_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_process_instantiation_via_winrm_and_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_process_instantiation_via_winrm_and_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_process_instantiation_via_winrm_and_winrs_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_process_instantiation_via_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_process_instantiation_via_wmi_and_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_process_instantiation_via_wmi_and_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_system_discovery_with_adsisearcher_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_system_discovery_with_dsquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_system_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_system_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_wmi_command_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[resize_shadowstorage_volume_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[revil_common_exec_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[revil_registry_entry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rubeus_command_line_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rubeus_kerberos_ticket_exports_through_winlogon_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[runas_execution_in_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rundll32_control_rundll_hunt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rundll32_control_rundll_world_writable_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rundll32_create_remote_thread_to_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rundll32_createremotethread_in_browser_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rundll32_dnsquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rundll32_lockworkstation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rundll32_process_creating_exe_dll_files_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rundll32_shimcache_flush_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rundll32_with_no_command_line_arguments_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[rundll_loading_dll_by_ordinal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ryuk_test_files_detected_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ryuk_wake_on_lan_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[sam_database_file_access_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[samsam_test_file_write_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[sc_exe_manipulating_windows_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[schcache_change_by_app_connect_and_create_adsi_object_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[schedule_task_with_http_command_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[schedule_task_with_rundll32_command_trigger_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[scheduled_task_creation_on_remote_endpoint_using_at_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[scheduled_task_deleted_or_created_via_cmd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[scheduled_task_initiation_on_remote_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[schtasks_run_task_on_demand_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[schtasks_scheduling_job_on_remote_system_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[schtasks_used_for_forcing_a_reboot_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[screensaver_event_trigger_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[script_execution_via_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[sdclt_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[sdelete_application_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[searchprotocolhost_with_no_command_line_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[secretdumps_offline_ntds_dumping_tool_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[serviceprincipalnames_discovery_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[serviceprincipalnames_discovery_with_setspn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[services_escalate_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[services_lolbas_execution_process_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[shim_database_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[shim_database_installation_with_suspicious_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[short_lived_scheduled_task_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[short_lived_windows_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[silentcleanup_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[single_letter_process_on_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[slui_runas_elevated_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[slui_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[spike_in_file_writes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[spoolsv_spawning_rundll32_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[spoolsv_suspicious_loaded_modules_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[spoolsv_suspicious_process_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[spoolsv_writing_a_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[spoolsv_writing_a_dll___sysmon_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[sqlite_module_in_temp_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[steal_or_forge_authentication_certificates_behavior_identified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[sunburst_correlation_dll_and_network_event_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_computer_account_name_change_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_copy_on_system32_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_curl_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_dllhost_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_driver_loaded_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_event_log_service_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_gpupdate_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_icedid_rundll32_cmdline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_image_creation_in_appdata_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_kerberos_service_ticket_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_linux_discovery_commands_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_microsoft_workflow_compiler_rename_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_microsoft_workflow_compiler_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_msbuild_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_msbuild_rename_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_msbuild_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_mshta_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_mshta_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_plistbuddy_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_plistbuddy_usage_via_osquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_process_dns_query_known_abuse_web_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_process_executed_from_container_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_process_file_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_process_with_discord_dns_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_reg_exe_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_regsvr32_register_suspicious_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_rundll32_dllregisterserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_rundll32_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_rundll32_plugininit_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_rundll32_startw_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_scheduled_task_from_public_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_searchprotocolhost_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_sqlite3_lsquarantine_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_ticket_granting_ticket_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_wav_file_in_appdata_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_wevtutil_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_writes_to_windows_recycle_bin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[svchost_lolbas_execution_process_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[system_info_gathering_using_dxdiag_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[system_information_discovery_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[system_processes_run_from_unexpected_locations_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[system_user_discovery_with_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[system_user_discovery_with_whoami_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[time_provider_persistence_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[trickbot_named_pipe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[uac_bypass_mmc_load_unsigned_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[uac_bypass_with_colorui_com_object_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[uninstall_app_using_msiexec_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unknown_process_using_the_kerberos_protocol_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unload_sysmon_filter_driver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unloading_amsi_via_reflection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unusual_number_of_computer_service_tickets_requested_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unusual_number_of_kerberos_service_tickets_requested_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unusual_number_of_remote_endpoint_authentication_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unusually_long_command_line_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unusually_long_command_line___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[user_discovery_with_env_vars_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[user_discovery_with_env_vars_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[usn_journal_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[vbscript_execution_using_wscript_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[verclsid_clsid_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[w3wp_spawning_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wbadmin_delete_system_backups_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wbemprox_com_object_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wermgr_process_connecting_to_ip_check_web_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wermgr_process_create_executable_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wermgr_process_spawned_cmd_or_powershell_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wget_download_and_bash_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_abused_web_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_access_token_manipulation_sedebugprivilege_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_access_token_manipulation_winlogon_duplicate_token_handle_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_account_discovery_for_none_disable_user_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_account_discovery_for_sam_account_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_account_discovery_with_netuser_preauthnotrequire_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_abnormal_object_access_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_adminsdholder_acl_modified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_cross_domain_sid_history_addition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_domain_controller_audit_policy_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_domain_controller_promotion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_domain_replication_acl_addition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_dsrm_account_changes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_dsrm_password_reset_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_privileged_account_sid_history_addition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_privileged_object_access_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_replication_request_initiated_by_user_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_replication_request_initiated_from_unsanctioned_location_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_same_domain_sid_history_addition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_serviceprincipalname_added_to_domain_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_short_lived_domain_account_serviceprincipalname_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_short_lived_domain_controller_spn_attribute_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_short_lived_server_object_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_sid_history_attribute_modified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_adfind_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_admin_permission_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_administrative_shares_accessed_on_multiple_hosts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_admon_default_group_policy_object_modified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_admon_group_policy_object_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_alternate_datastream___base64_content_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_alternate_datastream___executable_content_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_alternate_datastream___process_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_apache_benchmark_binary_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_app_layer_protocol_qakbot_namedpipe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_app_layer_protocol_wermgr_connect_to_namedpipe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_archive_collected_data_via_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_archive_collected_data_via_rar_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_autoit3_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_autostart_execution_lsass_driver_registry_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_binary_proxy_execution_mavinject_dll_injection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_boot_or_logon_autostart_execution_in_startup_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_bootloader_inventory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_bypass_uac_via_pkgmgr_tool_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_cab_file_on_disk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_cached_domain_credentials_reg_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_change_default_file_association_for_no_file_ext_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_clipboard_data_via_get_clipboard_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_com_hijacking_inprocserver32_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_command_and_scripting_interpreter_hunting_path_traversal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_command_and_scripting_interpreter_path_traversal_exec_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_command_shell_dcrat_forkbomb_payload_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_command_shell_fetch_env_variables_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_common_abused_cmd_shell_risk_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_computer_account_created_by_computer_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_computer_account_requesting_kerberos_ticket_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_computer_account_with_spn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_conhost_with_headless_argument_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_create_local_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_credential_dumping_lsass_memory_createdump_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_credentials_from_password_stores_chrome_extension_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_credentials_from_password_stores_chrome_localstate_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_credentials_from_password_stores_chrome_login_data_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_credentials_from_password_stores_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_credentials_from_password_stores_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_credentials_from_password_stores_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_credentials_in_registry_reg_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_curl_download_to_suspicious_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_curl_upload_to_remote_destination_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_data_destruction_recursive_exec_files_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_defacement_modify_transcodedwallpaper_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_default_group_policy_object_modified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_default_group_policy_object_modified_with_gpme_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_defender_asr_audit_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_defender_asr_block_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_defender_asr_registry_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_defender_asr_rule_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_defender_asr_rules_stacking_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_defender_exclusion_registry_entry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_delete_or_modify_system_firewall_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_deleted_registry_by_a_non_critical_process_file_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_disable_change_password_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_disable_lock_workstation_feature_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_disable_logoff_button_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_disable_memory_crash_dump_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_disable_notification_center_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_disable_or_modify_tools_via_taskkill_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_disable_shutdown_button_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_disable_windows_event_logging_disable_http_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_disable_windows_group_policy_features_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_disableantispyware_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_diskcryptor_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_diskshadow_proxy_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_dism_remove_defender_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_dll_search_order_hijacking_hunt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_dll_search_order_hijacking_hunt_with_sysmon_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_dll_search_order_hijacking_with_iscsicpl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_dll_side_loading_in_calc_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_dll_side_loading_process_child_of_calc_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_dns_gather_network_info_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_dnsadmins_new_member_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_domain_account_discovery_via_get_netcomputer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_domain_admin_impersonation_indicator_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_dotnet_binary_in_non_standard_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_driver_inventory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_driver_load_non_standard_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_drivers_loaded_by_signature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_enable_win32_scheduledjob_via_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_event_for_service_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_event_log_cleared_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_event_triggered_image_file_execution_options_injection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_excessive_disabled_services_event_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_executable_in_loaded_modules_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_execute_arbitrary_commands_with_msdt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_exfiltration_over_c2_via_invoke_restmethod_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_exfiltration_over_c2_via_powershell_uploadstring_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_export_certificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_file_share_discovery_with_powerview_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_file_transfer_protocol_in_non_common_process_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_file_without_extension_in_critical_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_njrat_fileless_storage_via_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_files_and_dirs_access_rights_modification_via_icacls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_find_domain_organizational_units_with_getdomainou_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_find_interesting_acl_with_findinterestingdomainacl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_findstr_gpp_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_forest_discovery_with_getforestdomain_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_gather_victim_host_information_camera_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_gather_victim_identity_sam_info_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_gather_victim_network_info_through_ip_check_web_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_get_adcomputer_unconstrained_delegation_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_get_local_admin_with_findlocaladminaccess_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_group_policy_object_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_hidden_schedule_task_settings_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_hide_notification_features_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_high_file_deletion_frequency_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_hijack_execution_flow_version_dll_side_load_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_hunting_system_account_targeting_lsass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_identify_protocol_handlers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_iis_components_add_new_module_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_iis_components_get_webglobalmodule_module_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_iis_components_module_failed_to_load_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_iis_components_new_module_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_add_xml_applocker_rules_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_change_win_defender_health_check_intervals_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_change_win_defender_quick_scan_interval_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_change_win_defender_throttle_rate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_change_win_defender_tracing_level_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_configure_app_install_control_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_define_win_defender_threat_action_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_delete_win_defender_context_menu_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_delete_win_defender_profile_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_deny_security_software_with_applocker_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_controlled_folder_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_defender_firewall_and_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_defender_protocol_recognition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_pua_protection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_realtime_signature_delivery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_web_evaluation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_win_defender_app_guard_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_win_defender_compute_file_hashes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_win_defender_gen_reports_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_win_defender_network_protection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_win_defender_report_infection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_win_defender_scan_on_update_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_disable_win_defender_signature_retirement_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_overide_win_defender_phishing_filter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_override_smartscreen_prompt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defense_set_win_defender_smart_screen_level_to_warn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defenses_disable_hvci_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_impair_defenses_disable_win_defender_auto_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_indicator_removal_via_rmdir_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_indirect_command_execution_via_forfiles_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_indirect_command_execution_via_pcalua_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_indirect_command_execution_via_series_of_forfiles_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_information_discovery_fsutil_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ingress_tool_transfer_using_explorer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_input_capture_using_credential_ui_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_installutil_credential_theft_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_installutil_in_non_standard_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_installutil_remote_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_installutil_uninstall_option_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_installutil_uninstall_option_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_installutil_url_in_command_line_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_iso_lnk_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_java_spawning_shells_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_kerberos_local_successful_logon_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_known_graphicalproton_loaded_modules_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_krbrelayup_service_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_large_number_of_computer_service_tickets_requested_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_lateral_tool_transfer_remcom_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ldifde_directory_object_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_linked_policies_in_adsi_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_local_administrator_credential_stuffing_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_lsa_secrets_nolmhash_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_mail_protocol_in_non_common_process_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_mark_of_the_web_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_masquerading_explorer_as_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_masquerading_msdtc_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_mimikatz_binary_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_mimikatz_crypto_export_file_extensions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_authenticationleveloverride_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_auto_minor_updates_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_auto_update_notif_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_default_icon_setting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_disable_restricted_admin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_disable_toast_notifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_disable_win_defender_raw_write_notif_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_disable_windefender_notifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_disable_windows_security_center_notif_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_disableremotedesktopantialias_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_disablesecuritysettings_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_disabling_wer_settings_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_disallow_windows_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_do_not_connect_to_win_update_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_dontshowui_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_enablelinkedconnections_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_longpathsenabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_maxconnectionperserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_no_auto_reboot_with_logon_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_no_auto_update_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_nochangingwallpaper_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_proxyenable_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_proxyserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_qakbot_binary_data_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_reg_restore_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_regedit_silent_reg_import_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_risk_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_suppress_win_defender_notif_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_tamper_protection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_updateserviceurlalternate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_usewuserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_with_md5_reg_key_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_wuserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_registry_wustatusserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_show_compress_color_and_info_tip_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_modify_system_firewall_with_notable_process_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_mof_event_triggered_execution_via_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_moveit_transfer_writing_aspx_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_msexchange_management_mailbox_cmdlet_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_mshta_execution_in_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_msiexec_dllregisterserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_msiexec_hidewindow_rundll32_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_msiexec_remote_download_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_msiexec_spawn_discovery_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_msiexec_spawn_windbg_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_msiexec_unregister_dllregisterserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_msiexec_with_network_connections_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_multi_hop_proxy_tor_website_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_multiple_invalid_users_fail_to_authenticate_using_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_multiple_invalid_users_failed_to_authenticate_using_ntlm_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_multiple_users_fail_to_authenticate_wth_explicitcredentials_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_multiple_users_failed_to_authenticate_from_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_multiple_users_failed_to_authenticate_using_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_multiple_users_remotely_failed_to_authenticate_from_host_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ngrok_reverse_proxy_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_nirsoft_advancedrun_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_nirsoft_utilities_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_non_system_account_targeting_lsass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_odbcconf_hunting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_odbcconf_load_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_odbcconf_load_response_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_office_product_spawning_msdt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_papercut_ng_spawn_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_parent_pid_spoofing_with_explorer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_password_managers_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_phishing_pdf_file_executes_url_link_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_phishing_recent_iso_exec_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_possible_credential_dumping_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_post_exploitation_risk_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powershell_add_module_to_global_assembly_cache_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powershell_cryptography_namespace_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powershell_disable_http_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powershell_export_certificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powershell_export_pfxcertificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powershell_get_ciminstance_remote_computer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powershell_iis_components_webglobalmodule_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powershell_import_applocker_policy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powershell_remotesigned_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powershell_scheduletask_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powershell_wmi_win32_scheduledjob_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powersploit_gpp_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powerview_ad_access_control_list_enumeration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powerview_constrained_delegation_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powerview_kerberos_service_ticket_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powerview_spn_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_powerview_unconstrained_delegation_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_private_keys_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_process_commandline_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_process_injection_in_non_service_searchindexer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_process_injection_into_notepad_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_process_injection_of_wermgr_to_known_browser_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_process_injection_remote_thread_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_process_injection_wermgr_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_process_injection_with_public_source_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_process_with_namedpipe_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_processes_killed_by_industroyer2_malware_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_protocol_tunneling_with_plink_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_proxy_via_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_proxy_via_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_query_registry_browser_list_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_query_registry_reg_save_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_query_registry_uninstall_program_list_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_raccine_scheduled_task_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_rapid_authentication_on_multiple_hosts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_rasautou_dll_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_raw_access_to_disk_volume_partition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_raw_access_to_master_boot_record_drive_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_rdp_connection_successful_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_registry_bootexecute_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_registry_certificate_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_registry_delete_task_sd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_registry_modification_for_safe_mode_persistence_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_registry_payload_injection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_registry_sip_provider_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_regsvr32_renamed_binary_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_remote_access_software_brc4_loaded_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_remote_access_software_hunt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_remote_access_software_rms_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_remote_assistance_spawning_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_remote_create_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_remote_service_rdpwinst_tool_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_remote_services_allow_rdp_in_firewall_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_remote_services_allow_remote_assistance_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_remote_services_rdp_enable_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_replication_through_removable_media_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_root_domain_linked_policies_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_rundll32_apply_user_settings_changes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_rundll32_webdav_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_rundll32_webdav_with_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_scheduled_task_created_via_xml_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_scheduled_task_service_spawned_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_scheduled_task_with_highest_privileges_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_schtasks_create_run_as_system_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_screen_capture_via_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_security_account_manager_stopped_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_security_support_provider_reg_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_server_software_component_gacutil_install_to_gac_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_create_kernel_mode_driver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_create_remcomsvc_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_create_sliverc2_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_create_with_tscon_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_created_with_suspicious_service_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_created_within_public_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_creation_on_remote_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_creation_using_registry_entry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_deletion_in_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_initiation_on_remote_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_stop_by_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_stop_via_net__and_sc_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_service_stop_win_updates_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_sip_provider_inventory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_sip_winverifytrust_failed_trust_validation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_snake_malware_file_modification_crmlog_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_snake_malware_kernel_driver_comadmin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_snake_malware_registry_modification_wav_openwithprogids_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_snake_malware_service_create_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_spearphishing_attachment_onenote_spawn_mshta_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_special_privileged_logon_on_multiple_hosts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_sql_spawning_certutil_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_steal_authentication_certificates___esc1_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_steal_authentication_certificates___esc1_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_steal_authentication_certificates_certificate_issued_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_steal_authentication_certificates_certificate_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_steal_authentication_certificates_certutil_backup_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_steal_authentication_certificates_cryptoapi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_steal_authentication_certificates_cs_backup_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_steal_authentication_certificates_export_certificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_steal_authentication_certificates_export_pfxcertificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_steal_or_forge_kerberos_tickets_klist_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_suspect_process_with_authentication_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_binary_proxy_execution_compiled_html_file_decompile_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_discovery_using_ldap_nslookup_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_discovery_using_qwinsta_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_file_on_disk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_logoff_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_network_config_discovery_display_dns_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_network_connections_discovery_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_reboot_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_script_proxy_execution_syncappvpublishingserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_shutdown_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_time_discovery_w32tm_delay_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_user_discovery_via_quser_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_system_user_privilege_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_terminating_lsass_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_time_based_evasion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_uac_bypass_suspicious_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_uac_bypass_suspicious_escalation_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_unsigned_dll_side_loading_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_unusual_count_of_disabled_users_failed_auth_using_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_unusual_count_of_users_failed_to_auth_using_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_unusual_count_of_users_failed_to_authenticate_from_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_unusual_count_of_users_failed_to_authenticate_using_ntlm_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_unusual_count_of_users_remotely_failed_to_auth_from_host_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_user_execution_malicious_url_shortcut_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_valid_account_with_never_expires_password_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_vulnerable_3cx_software_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_vulnerable_driver_loaded_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_windbg_spawning_autoit3_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_winlogon_with_public_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_wmi_impersonate_token_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_wmi_process_and_service_list_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_wmi_process_call_create_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[winevent_scheduled_task_created_to_spawn_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[winevent_scheduled_task_created_within_public_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[winevent_windows_task_scheduler_event_action_started_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[winhlp32_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[winrar_spawning_shell_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[winrm_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[winword_spawning_cmd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[winword_spawning_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[winword_spawning_windows_script_host_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wmi_permanent_event_subscription_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wmi_permanent_event_subscription___sysmon_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wmi_recon_running_process_or_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wmi_temporary_event_subscription_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wmic_group_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wmic_noninteractive_app_uninstallation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wmic_xsl_execution_via_url_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wmiprsve_lolbas_execution_process_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wscript_or_cscript_suspicious_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wsmprovhost_lolbas_execution_process_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wsreset_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[xmrig_driver_loaded_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[xsl_script_execution_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_arp_poisoning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_dga_domains_using_pretrained_model_in_dsdl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_dns_data_exfiltration_using_pretrained_model_in_dsdl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_hosts_connecting_to_dynamic_domain_providers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_ipv6_network_infrastructure_threats_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_large_outbound_icmp_packets_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_outbound_ldap_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_outbound_smb_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_port_security_violation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_rogue_dhcp_server_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_snicat_sni_exfiltration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_software_download_to_network_device_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_traffic_mirroring_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_unauthorized_assets_by_mac_address_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_windows_dns_sigred_via_splunk_stream_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_windows_dns_sigred_via_zeek_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_zerologon_via_zeek_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[dns_query_length_outliers___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[dns_query_length_with_high_standard_deviation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[excessive_dns_failures_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[hosts_receiving_high_volume_of_network_traffic_from_email_server_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[large_volume_of_dns_any_queries_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[multiple_archive_files_http_post_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ngrok_reverse_proxy_on_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[plain_http_post_exfiltrated_data_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[prohibited_network_traffic_allowed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[protocol_or_port_mismatch_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[protocols_passing_authentication_in_cleartext_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_desktop_network_bruteforce_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[remote_desktop_network_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[smb_traffic_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[smb_traffic_spike___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[splunk_identified_ssl_tls_certificates_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ssl_certificates_with_punycode_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[tor_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unusually_long_content_type_length_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_replication_service_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_ad_rogue_domain_controller_network_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[zeek_x509_certificate_with_punycode_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[adobe_coldfusion_access_control_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[adobe_coldfusion_unauthenticated_arbitrary_file_read_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[cisco_ios_xe_implant_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[citrix_adc_and_gateway_unauthorized_data_disclosure_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[citrix_adc_exploitation_cve_2023_3519_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[citrix_sharefile_exploitation_cve_2023_24489_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[confluence_cve_2023_22515_trigger_vulnerability_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[confluence_data_center_and_server_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_attackers_scanning_for_vulnerable_jboss_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_f5_tmui_rce_cve_2020_5902_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[detect_malicious_requests_to_exploit_jboss_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[exploit_public_facing_application_via_apache_commons_text_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[exploit_public_facing_fortinet_fortinac_cve_2022_39952_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[f5_tmui_authentication_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[fortinet_appliance_auth_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[hunting_for_log4shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ivanti_connect_secure_command_injection_attempts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ivanti_connect_secure_system_information_access_via_auth_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ivanti_sentry_authentication_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[jenkins_arbitrary_file_read_cve_2024_23897_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[jetbrains_teamcity_rce_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[juniper_networks_remote_code_execution_exploit_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[log4shell_jndi_payload_injection_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[log4shell_jndi_payload_injection_with_outbound_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[microsoft_sharepoint_server_elevation_of_privilege_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[monitor_web_traffic_for_brand_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[papercut_ng_remote_web_access_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[proxyshell_proxynotshell_behavior_detected_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[spring4shell_payload_url_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[sql_injection_with_long_urls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[supernova_webshell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[vmware_aria_operations_exploit_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[vmware_server_side_template_injection_hunt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[vmware_workspace_one_freemarker_server_side_template_injection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[web_jsp_request_via_url_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[web_remote_shellservlet_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[web_spring4shell_http_request_class_module_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[web_spring_cloud_function_functionrouter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[windows_exchange_autodiscover_ssrf_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[ws_ftp_remote_code_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.


[admon]
definition = source=ActiveDirectory
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[amazon_security_lake]
definition = sourcetype=aws:asl
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[audit_searches]
definition = index=_audit sourcetype=audittrail action=search
description = Macro to enable easy searching of audittrail logs for searches

[audittrail]
definition = index=_audit sourcetype=audittrail
description = Macro to enable easy searching of audittrail logs

[aws_cloudwatchlogs_eks]
definition = sourcetype="aws:cloudwatchlogs:eks"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[aws_config]
definition = sourcetype=aws:config
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[aws_description]
definition = sourcetype="aws:description"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[aws_ecr_users]
definition = userName IN (user)
description = specify the user allowed to push Images to AWS ECR.

[aws_s3_accesslogs]
definition = sourcetype=aws:s3:accesslogs
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[aws_securityhub_finding]
definition = sourcetype="aws:securityhub:finding"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[aws_securityhub_firehose]
definition = sourcetype="aws:securityhub:firehose"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[azure_audit]
definition = sourcetype=mscs:azure:audit
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[azure_monitor_aad]
definition = sourcetype=azure:monitor:aad
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[azuread]
definition = sourcetype=mscs:azure:eventhub
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[base64decode(1)]
args = b64in
definition = eval b64x_split=split($b64in$,"") | lookup char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?<b64x_by8>.{8})" max_match=0 | lookup char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"
description = Content based conversion of UTF8/UTF16 based base64 encoding. Not a full implementation, but good enough for context without additional app installation.

[bootloader_inventory]
definition = sourcetype = PwSh:bootloader
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[brand_abuse_dns]
definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file

[brand_abuse_email]
definition = lookup update=true brandMonitoring_lookup domain as src_user OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file

[brand_abuse_web]
definition = lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file

[capi2_operational]
definition = (source=XmlWinEventLog:Microsoft-Windows-CAPI2/Operational)
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[certificateservices_lifecycle]
definition = (source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational OR source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational)
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[circleci]
definition = sourcetype=circleci
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[cisco_networks]
definition = eventtype=cisco_ios
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[cloud_api_calls_from_previously_unseen_user_roles_activity_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new commands from user roles

[cloudtrail]
definition = sourcetype=aws:cloudtrail
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[cloudwatch_eks]
definition = sourcetype="aws:cloudwatchlogs:eks"
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch eks logs. Replace the macro definition with configurations for your Splunk Environmnent.

[cloudwatch_vpc]
definition = sourcetype=aws:cloudwatchlogs:vpcflow
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.

[cloudwatchlogs_vpcflow]
definition = sourcetype=aws:cloudwatchlogs:vpcflow
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[driverinventory]
definition = sourcetype=PwSh:DriverInventory
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[dynamic_dns_providers]
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_local,isDynDNS_default) |fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user.

[dynamic_dns_web_traffic]
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
description = This is a description

[ec2_modification_api_calls]
definition = (eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)
description = This is a list of AWS event names that have to do with modifying Amazon EC2 instances

[evilginx_phishlets_0365]
definition = (query=login* AND query=www*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Office 365

[evilginx_phishlets_amazon]
definition = (query=fls-na* AND query = www* AND query=images*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Amazon

[evilginx_phishlets_aws]
definition = (query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)
description = This limits the query fields to domains that are associated with evilginx masquerading as an AWS console

[evilginx_phishlets_facebook]
definition = (query=www* AND query = m* AND query=static*)
description = This limits the query fields to domains that are associated with evilginx masquerading as FaceBook

[evilginx_phishlets_github]
definition = (query=api* AND query = github*)
description = This limits the query fields to domains that are associated with evilginx masquerading as GitHub

[evilginx_phishlets_google]
definition = (query=accounts* AND query=ssl* AND query=www*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Google

[evilginx_phishlets_outlook]
definition = (query=outlook* AND query=login* AND query=account*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Outlook

[exchange]
definition = sourcetype="MSWindows:IIS"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[f5_bigip_rogue]
definition = index=netops sourcetype="f5:bigip:rogue"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[filter_rare_process_allow_list]
definition = lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list="false" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list="false"
description = This macro is intended to allow_list processes that have been definied as rare

[github]
definition = sourcetype=aws:firehose:json
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[github_known_users]
definition = user IN (user_names_here)
description = specify the user allowed to create PRs in Github projects.

[google_gcp_pubnet_message]
definition = sourcetype="google:gcp:pubsub:message"
description = customer specific splunk configurations(eg- index, source, sourcetype) for Google GCP. Replace the macro definition with configurations for your Splunk Environmnent.

[google_gcp_pubsub_message]
definition = sourcetype="google:gcp:pubsub:message"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[gsuite_calendar]
definition = sourcetype=gsuite:calendar:json
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[gsuite_drive]
definition = sourcetype=gsuite:drive:json
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[gsuite_gmail]
definition = sourcetype=gsuite:gmail:bigquery
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[gws_login_mfa_methods]
definition = event.parameters{}.multiValue{} IN ("backup_code", "google_authenticator", "google_prompt", "idv_any_phone", "idv_preregistered_phone", "internal_two_factor", "knowledge_employee_id", "knowledge_preregistered_email", "login_location", "knowledge_preregistered_phone", "offline_otp", "security_key", "security_key_otp")
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[gws_reports_admin]
definition = sourcetype=gws:reports:admin
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[gws_reports_login]
definition = sourcetype=gws:reports:login
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[iis_get_webglobalmodule]
definition = sourcetype="Pwsh:InstalledIISModules"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[iis_operational_logs]
definition = sourcetype="IIS:Configuration:Operational"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[is_net_windows_file]
definition = lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true
description = This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11.

[is_nirsoft_software]
definition = lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true
description = This macro is related to potentially identifiable software related to NirSoft. Remove or filter as needed based.

[is_windows_system_file]
definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
description = This macro limits the output to process names that are in the Windows System directory

[kube_allowed_images]
definition = objectRef.name IN (*splunk*, *falco*)
description = Define your images which are allowed to connect to your kubernetes cluster.

[kube_allowed_loactions]
definition = Country="United States"
description = Define your locations which are allowed to connect to your kubernetes cluster.

[kube_allowed_user_agents]
definition = userAgent=Helm/3.13.2
description = Define your user agents which are allowed to connect to your kubernetes cluster.

[kube_allowed_user_groups]
definition = user.groups{} IN (admin)
description = Define your user groups which are allowed to connect to your kubernetes cluster.

[kube_allowed_user_names]
definition = user.username=admin
description = Define your user names which are allowed to connect to your kubernetes cluster.

[kube_audit]
definition = source="kubernetes"
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes audit data. Replace the macro definition with configurations for your Splunk Environmnent.

[kube_container_falco]
definition = sourcetype="kube:container:falco"
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes audit data. Replace the macro definition with configurations for your Splunk Environmnent.

[kube_objects_events]
definition = sourcetype=kube:objects:events
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[kubernetes_azure]
definition = sourcetype=mscs:storage:blob:json
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.

[kubernetes_container_controller]
definition = sourcetype=kube:container:controller
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent.

[kubernetes_metrics]
definition = index=kubernetes_metrics
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[linux_hosts]
definition = index=*
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[linux_shells]
definition = (Processes.process_name IN ("sh", "ksh", "zsh", "bash", "dash", "rbash", "fish", "csh", "tcsh", "ion", "eshell"))
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[ms_defender]
definition = source="WinEventLog:Microsoft-Windows-Windows Defender/Operational"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[msexchange_management]
definition = sourcetype=MSExchange:management
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[netbackup]
definition = sourcetype="netbackup_logs"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[network_acl_events]
definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)
description = This is a list of AWS event names that are associated with Network ACLs

[notable]
definition = index=notable
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[o365_graph]
definition = sourcetype=o365:graph:api
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[o365_management_activity]
definition = sourcetype=o365:management:activity
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[okta]
definition = eventtype=okta_log
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[osquery]
definition = sourcetype=osquery:results
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[osquery_process]
definition = eventtype="osquery-process"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[papercutng]
definition = sourcetype="papercutng"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[path_traversal_spl_injection]
definition = index=_internal sourcetype=splunkd_ui_access
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[pingid]
definition = source=PINGID
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[potential_password_in_username_false_positive_reduction]
definition = search *
description = Add customer specific known false positives to the map command used in detection - Potential password in username

[potentially_malicious_code_on_cmdline_tokenize_score]
definition = eval orig_process=process, process=replace(lower(process), "`", "") | makemv tokenizer="([\w\d\-]+)" process | eval unusual_cmdline_feature_for=if(match(process, "^for$"), mvcount(mvfilter(match(process, "^for$"))), 0), unusual_cmdline_feature_netsh=if(match(process, "^netsh$"), mvcount(mvfilter(match(process, "^netsh$"))), 0), unusual_cmdline_feature_readbytes=if(match(process, "^readbytes$"), mvcount(mvfilter(match(process, "^readbytes$"))), 0), unusual_cmdline_feature_set=if(match(process, "^set$"), mvcount(mvfilter(match(process, "^set$"))), 0), unusual_cmdline_feature_unrestricted=if(match(process, "^unrestricted$"), mvcount(mvfilter(match(process, "^unrestricted$"))), 0), unusual_cmdline_feature_winstations=if(match(process, "^winstations$"), mvcount(mvfilter(match(process, "^winstations$"))), 0), unusual_cmdline_feature_-value=if(match(process, "^-value$"), mvcount(mvfilter(match(process, "^-value$"))), 0), unusual_cmdline_feature_compression=if(match(process, "^compression$"), mvcount(mvfilter(match(process, "^compression$"))), 0), unusual_cmdline_feature_server=if(match(process, "^server$"), mvcount(mvfilter(match(process, "^server$"))), 0), unusual_cmdline_feature_set-mppreference=if(match(process, "^set-mppreference$"), mvcount(mvfilter(match(process, "^set-mppreference$"))), 0), unusual_cmdline_feature_terminal=if(match(process, "^terminal$"), mvcount(mvfilter(match(process, "^terminal$"))), 0), unusual_cmdline_feature_-name=if(match(process, "^-name$"), mvcount(mvfilter(match(process, "^-name$"))), 0), unusual_cmdline_feature_catch=if(match(process, "^catch$"), mvcount(mvfilter(match(process, "^catch$"))), 0), unusual_cmdline_feature_get-wmiobject=if(match(process, "^get-wmiobject$"), mvcount(mvfilter(match(process, "^get-wmiobject$"))), 0), unusual_cmdline_feature_hklm=if(match(process, "^hklm$"), mvcount(mvfilter(match(process, "^hklm$"))), 0), unusual_cmdline_feature_streamreader=if(match(process, "^streamreader$"), mvcount(mvfilter(match(process, "^streamreader$"))), 0), unusual_cmdline_feature_system32=if(match(process, "^system32$"), mvcount(mvfilter(match(process, "^system32$"))), 0), unusual_cmdline_feature_username=if(match(process, "^username$"), mvcount(mvfilter(match(process, "^username$"))), 0), unusual_cmdline_feature_webrequest=if(match(process, "^webrequest$"), mvcount(mvfilter(match(process, "^webrequest$"))), 0), unusual_cmdline_feature_count=if(match(process, "^count$"), mvcount(mvfilter(match(process, "^count$"))), 0), unusual_cmdline_feature_webclient=if(match(process, "^webclient$"), mvcount(mvfilter(match(process, "^webclient$"))), 0), unusual_cmdline_feature_writeallbytes=if(match(process, "^writeallbytes$"), mvcount(mvfilter(match(process, "^writeallbytes$"))), 0), unusual_cmdline_feature_convert=if(match(process, "^convert$"), mvcount(mvfilter(match(process, "^convert$"))), 0), unusual_cmdline_feature_create=if(match(process, "^create$"), mvcount(mvfilter(match(process, "^create$"))), 0), unusual_cmdline_feature_function=if(match(process, "^function$"), mvcount(mvfilter(match(process, "^function$"))), 0), unusual_cmdline_feature_net=if(match(process, "^net$"), mvcount(mvfilter(match(process, "^net$"))), 0), unusual_cmdline_feature_com=if(match(process, "^com$"), mvcount(mvfilter(match(process, "^com$"))), 0), unusual_cmdline_feature_http=if(match(process, "^http$"), mvcount(mvfilter(match(process, "^http$"))), 0), unusual_cmdline_feature_io=if(match(process, "^io$"), mvcount(mvfilter(match(process, "^io$"))), 0), unusual_cmdline_feature_system=if(match(process, "^system$"), mvcount(mvfilter(match(process, "^system$"))), 0), unusual_cmdline_feature_new-object=if(match(process, "^new-object$"), mvcount(mvfilter(match(process, "^new-object$"))), 0), unusual_cmdline_feature_if=if(match(process, "^if$"), mvcount(mvfilter(match(process, "^if$"))), 0), unusual_cmdline_feature_threading=if(match(process, "^threading$"), mvcount(mvfilter(match(process, "^threading$"))), 0), unusual_cmdline_feature_mutex=if(match(process, "^mutex$"), mvcount(mvfilter(match(process, "^mutex$"))), 0), unusual_cmdline_feature_cryptography=if(match(process, "^cryptography$"), mvcount(mvfilter(match(process, "^cryptography$"))), 0), unusual_cmdline_feature_computehash=if(match(process, "^computehash$"), mvcount(mvfilter(match(process, "^computehash$"))), 0)
description = Performs the tokenization and application of the malicious commandline classifier

[powershell]
definition = (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational")
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[previously_seen_cloud_api_calls_per_user_role_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud api calls per user role

[previously_seen_cloud_compute_creations_by_user_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the user is new or not

[previously_seen_cloud_compute_image_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the image is new or not

[previously_seen_cloud_compute_images_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud instance images

[previously_seen_cloud_compute_instance_type_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud instance types

[previously_seen_cloud_compute_instance_types_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the instance type is new or not

[previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the user is new or not

[previously_seen_cloud_provisioning_activity_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud provisioning locations

[previously_seen_cloud_region_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud regions

[previously_seen_cloud_regions_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the region is new or not

[previously_seen_windows_services_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of Windows services

[previously_seen_windows_services_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new Windows services

[previously_seen_zoom_child_processes_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of zoom child processes

[previously_seen_zoom_child_processes_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new zoom child processes

[previously_unseen_cloud_provisioning_activity_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new provisioning activities

[printservice]
definition = source="wineventlog:microsoft-windows-printservice/operational" OR source="WinEventLog:Microsoft-Windows-PrintService/Admin"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[process_bitsadmin]
definition = (Processes.process_name=bitsadmin.exe OR Processes.original_file_name=bitsadmin.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_certutil]
definition = (Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_cmd]
definition = (Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_copy]
definition = (Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_csc]
definition = (Processes.process_name=csc.exe OR Processes.original_file_name=csc.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_curl]
definition = (Processes.process_name=curl.exe OR Processes.original_file_name=Curl.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_diskshadow]
definition = (Processes.process_name=diskshadow.exe OR Processes.original_file_name=diskshadow.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_dllhost]
definition = (Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_dsquery]
definition = (Processes.process_name=dsquery.exe OR Processes.original_file_name=dsquery.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_dxdiag]
definition = (Processes.process_name=dxdiag.exe OR Processes.original_file_name=dxdiag.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_esentutl]
definition = (Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_fodhelper]
definition = (Processes.process_name=fodhelper.exe OR Processes.original_file_name=FodHelper.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_gpupdate]
definition = (Processes.process_name=gpupdate.exe OR Processes.original_file_name=GPUpdate.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_hh]
definition = (Processes.process_name=hh.exe OR Processes.original_file_name=HH.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_installutil]
definition = (Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_microsoftworkflowcompiler]
definition = (Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_msbuild]
definition = (Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_mshta]
definition = (Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_msiexec]
definition = (Processes.process_name=msiexec.exe OR Processes.original_file_name=msiexec.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_net]
definition = (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.original_file_name="net1.exe")
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_netsh]
definition = (Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_nltest]
definition = (Processes.process_name=nltest.exe OR Processes.original_file_name=nltestrk.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_ntdsutil]
definition = (Processes.process_name=ntdsutil.exe OR Processes.original_file_name=ntdsutil.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_ping]
definition = (Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_powershell]
definition = (Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_procdump]
definition = (Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe OR Processes.original_file_name=procdump)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_psexec]
definition = (Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_rclone]
definition = (Processes.original_file_name=rclone.exe OR Processes.process_name=rclone.exe)
description = Matches the process with its original file name.

[process_reg]
definition = (Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_regasm]
definition = (Processes.process_name=regasm.exe OR Processes.original_file_name=RegAsm.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_regsvcs]
definition = (Processes.process_name=regsvcs.exe OR Processes.original_file_name=RegSvcs.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_regsvr32]
definition = (Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_route]
definition = (Processes.process_name=route.exe OR Processes.original_file_name=route.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_runas]
definition = (Processes.process_name=runas.exe OR Processes.original_file_name=runas.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_rundll32]
definition = (Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_schtasks]
definition = (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_sdelete]
definition = (Processes.process_name=sdelete.exe OR Processes.original_file_name=sdelete.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_setspn]
definition = (Processes.process_name=setspn.exe OR Processes.original_file_name=setspn.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_verclsid]
definition = (Processes.process_name=verclsid.exe OR Processes.original_file_name=verclsid.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_vssadmin]
definition = (Processes.process_name=vssadmin.exe OR Processes.original_file_name=VSSADMIN.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_wbadmin]
definition = (Processes.process_name=wbadmin.exe OR Processes.original_file_name=WBADMIN.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_wermgr]
definition = (Processes.process_name=wermgr.exe OR Processes.original_file_name=wermgr.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[process_wmic]
definition = (Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/

[prohibited_apps_launching_cmd]
definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
description = This macro outputs a list of process that should not be the parent process of cmd.exe

[prohibited_softwares]
definition = lookup prohibited_softwares app as process_name OUTPUT is_prohibited | search is_prohibited=True
description = This macro limits the output to process_names that have been marked as prohibited

[ransomware_extensions]
definition = lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False
description = This macro limits the output to files that have extensions associated with ransomware

[ransomware_notes]
definition = lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as "Known Ransomware Notes" | search "Known Ransomware Notes"=True
description = This macro limits the output to files that have been identified as a ransomware note

[remoteconnectionmanager]
definition = source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[remove_valid_domains]
definition = eval domain=trim(domain,"*") | search NOT[| inputlookup domains]  NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain="*"+domain+"*"
description = This macro removes valid domains from the output

[risk_index]
definition = index=risk
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[s3_accesslogs]
definition = sourcetype=aws:s3:accesslogs
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.

[security_content_ctime(1)]
args = field
definition = convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
description = convert epoch time to string

[security_content_summariesonly]
definition = summariesonly=false allow_old_summaries=true fillnull_value=null
description = search data model's summaries only

[security_group_api_calls]
definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)
description = This macro is a list of AWS event names associated with security groups

[splunk_crash_log]
definition = (index=_internal AND sourcetype=splunkd_crash_log)
description = Searches through the Splunk Crash Log for low-level errors and crashes

[splunk_python]
definition = index=_internal sourcetype=splunk_python
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[splunkd]
definition = index=_internal sourcetype=splunkd
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[splunkd_failed_auths]
definition = index=_audit "action=login attempt" "info=failed"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[splunkd_investigation_rest_handler]
definition = index=_internal sourcetype=investigation_rest_handler
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[splunkd_ui]
definition = index=_internal sourcetype=splunkd_ui_access
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[splunkd_web]
definition = index=_internal sourcetype=splunk_web_access
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[splunkd_webx]
definition = index=_internal sourcetype=splunk_web_access
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[splunkda]
definition = index=_internal sourcetype=splunkd_access
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[stream_dns]
definition = sourcetype=stream:dns
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[stream_http]
definition = sourcetype=stream:http
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[stream_tcp]
definition = sourcetype=stream:tcp
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[subjectinterfacepackage]
definition = sourcetype="PwSh:SubjectInterfacePackage"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[suspicious_email_attachments]
definition = lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true
description = This macro limits the output to email attachments that have suspicious extensions

[suspicious_writes]
definition = lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False
description = This macro limites the output to file names that have been marked as suspicious

[sysmon]
definition = sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[system_network_configuration_discovery_tools]
definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
description = This macro is a list of process that can be used to discover the network configuration

[uacbypass_process_name]
definition = BitlockerWizardElev.exe,cliconfg.exe,clipup.exe,cmstp.exe,CompMgmtLauncher.exe,consent.exe,control.exe,credwiz.exe,dccw.exe,dismhost.exe,EventVwr.exe,fodhelper.exe,GWXUXWorker.exe,inetmgr.exe,iscsicli.exe,mcx2prov.exe,migwiz.exe,mmc.exe,msconfig.exe,oobe.exe,osk.exe,pkgmgr.exe,recdisc.exe,rstrui.exe,sdclt.exe,setupsqm.exe,slui.exe,sysprep.exe,SystemPropertiesAdvanced.exe,taskhost.exe,TpmInit.exe,tzsync.exe,w32tm.exe,WerFault.exe,WSReset.exe,wusa.exe
description = A listing of processes known to be abused for User Account Control bypass exploitation.

[uncommon_processes]
definition = lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true  lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true
description = This macro limits the output to processes that have been marked as uncommon

[windows_shells]
definition = (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=sh.exe OR Processes.process_name=bash.exe OR Processes.process_name=wscript.exe OR Processes.process_name=cscript.exe)
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[wineventlog_application]
definition = eventtype=wineventlog_application OR source="XmlWinEventLog:Application"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[wineventlog_security]
definition = eventtype=wineventlog_security OR Channel=security OR source=XmlWinEventLog:Security
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[wineventlog_system]
definition = eventtype=wineventlog_system
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[wineventlog_task_scheduler]
definition = source="WinEventLog:Microsoft-Windows-TaskScheduler/Operational"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[wmi]
definition = sourcetype="wineventlog:microsoft-windows-wmi-activity/operational"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[zeek_rpc]
definition = index=zeek sourcetype="zeek:rpc:json"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[zeek_ssl]
definition = index=zeek sourcetype="zeek:ssl:json"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

[zeek_x509]
definition = sourcetype="zeek:x509:json"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.