Files

.github
.gitlab
.vscode
app_template
baselines
dashboards
data_sources
deployments
detections
dist
docs
lookups
- 3cx_ioc_domains.csv
- 3cx_ioc_domains.yml
- __mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.mlmodel
- __mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml
- __mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.mlmodel
- __mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml
- __mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel
- __mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
- __mlspl_pretrained_dga_model_dsdl.mlmodel
- __mlspl_pretrained_dga_model_dsdl.yml
- __mlspl_unusual_commandline_detection.mlmodel
- __mlspl_unusual_commandline_detection.yml
- ace_access_rights_lookup.csv
- ace_access_rights_lookup.yml
- ace_flag_lookup.csv
- ace_flag_lookup.yml
- ace_type_lookup.csv
- ace_type_lookup.yml
- advanced_audit_policy_guids.csv
- advanced_audit_policy_guids.yml
- api_call_by_user_baseline.yml
- applockereventcodes.csv
- applockereventcodes.yml
- asr_rules.csv
- asr_rules.yml
- attacker_tools.csv
- attacker_tools.yml
- aws_service_accounts.csv
- aws_service_accounts.yml
- baseline_blocked_outbound_connections.csv
- baseline_blocked_outbound_connections.yml
- brandmonitoring_lookup.csv
- brandmonitoring_lookup.yml
- browser_app_list.csv
- browser_app_list.yml
- builtin_groups_lookup.csv
- builtin_groups_lookup.yml
- char_conversion_matrix.csv
- char_conversion_matrix.yml
- cloud_instances_enough_data.yml
- decommissioned_buckets.yml
- deprecation_info.csv
- deprecation_info.yml
- discovered_dns_records.csv
- discovered_dns_records.yml
- domain_admins.csv
- domain_admins.yml
- domains.csv
- domains.yml
- dynamic_dns_providers_default.csv
- dynamic_dns_providers_default.yml
- dynamic_dns_providers_local.csv
- dynamic_dns_providers_local.yml
- hijacklibs.csv
- hijacklibs.yml
- hijacklibs_loaded.csv
- hijacklibs_loaded.yml
- images_to_repository.csv
- images_to_repository.yml
- is_net_windows_file.csv
- is_net_windows_file.yml
- is_nirsoft_software.csv
- is_nirsoft_software.yml
- is_suspicious_file_extension_lookup.csv
- is_suspicious_file_extension_lookup.yml
- is_windows_system_file.csv
- is_windows_system_file.yml
- k8s_container_network_io_baseline.yml
- k8s_container_network_io_ratio_baseline.yml
- k8s_process_resource_baseline.yml
- k8s_process_resource_ratio_baseline.yml
- legit_domains.csv
- legit_domains.yml
- linux_tool_discovery_process.csv
- linux_tool_discovery_process.yml
- local_file_inclusion_paths.csv
- local_file_inclusion_paths.yml
- lolbas_file_path.csv
- lolbas_file_path.yml
- loldrivers.csv
- loldrivers.yml
- lookup_rare_process_allow_list_default.csv
- lookup_rare_process_allow_list_default.yml
- lookup_rare_process_allow_list_local.csv
- lookup_rare_process_allow_list_local.yml
- lookup_uncommon_processes_default.csv
- lookup_uncommon_processes_default.yml
- lookup_uncommon_processes_local.csv
- lookup_uncommon_processes_local.yml
- malicious_powershell_strings.csv
- malicious_powershell_strings.yml
- mandatory_job_for_workflow.csv
- mandatory_job_for_workflow.yml
- mandatory_step_for_job.csv
- mandatory_step_for_job.yml
- msad_guid_lookup.csv
- msad_guid_lookup.yml
- network_acl_activity_baseline.csv
- network_acl_activity_baseline.yml
- previously_seen_api_calls_from_user_roles.yml
- previously_seen_aws_cross_account_activity.yml
- previously_seen_aws_regions.yml
- previously_seen_cloud_api_calls_per_user_role.yml
- previously_seen_cloud_compute_creations_by_user.yml
- previously_seen_cloud_compute_images.yml
- previously_seen_cloud_compute_instance_types.yml
- previously_seen_cloud_instance_modifications_by_user.yml
- previously_seen_cloud_provisioning_activity_sources.yml
- previously_seen_cloud_regions.yml
- previously_seen_cmd_line_arguments.csv
- previously_seen_cmd_line_arguments.yml
- previously_seen_ec2_amis_lookup.yml
- previously_seen_ec2_instance_types_lookup.yml
- previously_seen_ec2_launches_by_user_lookup.yml
- previously_seen_ec2_modifications_by_user.csv
- previously_seen_ec2_modifications_by_user.yml
- previously_seen_gcp_storage_access_from_remote_ip.yml
- previously_seen_provisioning_activity_src.yml
- previously_seen_running_windows_services.yml
- previously_seen_s3_access_from_remote_ip.yml
- previously_seen_users_console_logins.yml
- privileged_azure_ad_roles.csv
- privileged_azure_ad_roles.yml
- prohibited_apps_launching_cmd.csv
- prohibited_apps_launching_cmd.yml
- prohibited_processes.csv
- prohibited_processes.yml
- ransomware_extensions_lookup.csv
- ransomware_extensions_lookup.yml
- ransomware_notes_lookup.csv
- ransomware_notes_lookup.yml
- remote_access_software.csv
- remote_access_software.yml
- remote_access_software_exceptions.yml
- s3_deletion_baseline.yml
- security_group_activity_baseline.yml
- security_services_lookup.csv
- security_services_lookup.yml
- suspicious_writes_lookup.csv
- suspicious_writes_lookup.yml
- windows_protocol_handlers.csv
- windows_protocol_handlers.yml
- windows_suspicious_services.csv
- windows_suspicious_services.yml
- windows_suspicious_tasks.csv
- windows_suspicious_tasks.yml
- zoom_first_time_child_process.yml
macros
notebooks
playbooks
removed
stories
workbooks
.gitignore
.gitpod.yml
.pre-commit-config.yaml
CODE_OF_CONDUCT.md
LICENSE
README.md
SECURITY.md
contentctl.yml

asr_rules.csv

update: lookups with additional data

Jan 30, 2025

6d07ef8 · Jan 30, 2025

1	ID	ASR_Rule
2	56A863A9-875E-4185-98A7-B882C64B5CE5	Block abuse of exploited vulnerable signed drivers
3	7674BA52-37EB-4A4F-A9A1-F0F9A1619A2C	Block Adobe Reader from creating child processes
4	D4F940AB-401B-4EFC-AADC-AD5F3C50688A	Block all Office applications from creating child processes
5	9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2	Block credential stealing from the Windows local security authority subsystem (lsass.exe)
6	BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550	Block executable content from email client and webmail
7	01443614-CD74-433A-B99E-2ECDC07BFC25	Block executable files from running unless they meet a prevalence - age - or trusted list criterion
8	5BEB7EFE-FD9A-4556-801D-275E5FFC04CC	Block execution of potentially obfuscated scripts
9	D3E037E1-3EB8-44C8-A917-57927947596D	Block JavaScript or VBScript from launching downloaded executable content
10	3B576869-A4EC-4529-8536-B80A7769E899	Block Office applications from creating executable content
11	75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84	Block Office applications from injecting code into other processes
12	26190899-1602-49E8-8B27-EB1D0A1CE869	Block Office communication application from creating child processes
13	E6DB77E5-3DF2-4CF1-B95A-636979351E5B	Block persistence through WMI event subscription
14	D1E49AAC-8F56-4280-B9BA-993A6D77406C	Block process creations originating from PSExec and WMI commands
15	33DDEDF1-C6E0-47CB-833E-DE6133960387	Block rebooting machine in Safe Mode
16	B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4	Block untrusted and unsigned processes that run from USB
17	C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB	Block use of copied or impersonated system tools
18	92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B	Block Win32 API calls from Office macros
19	C1DB55AB-C21A-4637-BB3F-A12568109D35	Use advanced protection against ransomware
20	A8F5898E-1DC8-49A9-9878-85004B8A61E6	Block Webshell creation for Servers