CSEC_PUBLIC/WELA
1
0
Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2025-12-08 10:12:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

Automated update

Browse Source
This commit is contained in:
github-actions[bot]
2025-03-11 15:19:56 +00:00
parent 7551c7974a
commit 766fe6d577
1 changed files with 155 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files

310
config/security_rules.json
View File

@@ -65,8 +65,8 @@
"id": "60d768ca-33e8-4f34-b967-14fd7aa18a22", "id": "60d768ca-33e8-4f34-b967-14fd7aa18a22",
"level": "informational", "level": "informational",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9227-69AE-11D9-BED3-505054503030", "0CCE9226-69AE-11D9-BED3-505054503030",
"0CCE9226-69AE-11D9-BED3-505054503030" "0CCE9227-69AE-11D9-BED3-505054503030"
], ],
"title": "Task Created" "title": "Task Created"
}, },
@@ -78,8 +78,8 @@
"id": "de5ed02e-e7b5-47a0-a35c-06a907c988e4", "id": "de5ed02e-e7b5-47a0-a35c-06a907c988e4",
"level": "informational", "level": "informational",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9226-69AE-11D9-BED3-505054503030", "0CCE9227-69AE-11D9-BED3-505054503030",
"0CCE9227-69AE-11D9-BED3-505054503030" "0CCE9226-69AE-11D9-BED3-505054503030"
], ],
"title": "Task Deleted" "title": "Task Deleted"
}, },
@@ -549,8 +549,8 @@
"id": "8afa97ce-a217-4f7c-aced-3e320a57756d", "id": "8afa97ce-a217-4f7c-aced-3e320a57756d",
"level": "low", "level": "low",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9217-69AE-11D9-BED3-505054503030", "0CCE9215-69AE-11D9-BED3-505054503030",
"0CCE9215-69AE-11D9-BED3-505054503030" "0CCE9217-69AE-11D9-BED3-505054503030"
], ],
"title": "Logon Failure (User Does Not Exist)" "title": "Logon Failure (User Does Not Exist)"
}, },
@@ -858,8 +858,8 @@
"id": "5b6e58ee-c231-4a54-9eee-af2577802e08", "id": "5b6e58ee-c231-4a54-9eee-af2577802e08",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9228-69AE-11D9-BED3-505054503030", "0CCE9229-69AE-11D9-BED3-505054503030",
"0CCE9229-69AE-11D9-BED3-505054503030" "0CCE9228-69AE-11D9-BED3-505054503030"
], ],
"title": "Process Ran With High Privilege" "title": "Process Ran With High Privilege"
}, },
@@ -883,8 +883,8 @@
"id": "e4c7a334-7ecb-ef93-85dd-49185891fb7a", "id": "e4c7a334-7ecb-ef93-85dd-49185891fb7a",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9227-69AE-11D9-BED3-505054503030", "0CCE9226-69AE-11D9-BED3-505054503030",
"0CCE9226-69AE-11D9-BED3-505054503030" "0CCE9227-69AE-11D9-BED3-505054503030"
], ],
"title": "Defrag Deactivation - Security" "title": "Defrag Deactivation - Security"
}, },
@@ -896,8 +896,8 @@
"id": "798c8f65-068a-0a31-009f-12739f547a2d", "id": "798c8f65-068a-0a31-009f-12739f547a2d",
"level": "critical", "level": "critical",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9226-69AE-11D9-BED3-505054503030", "0CCE9227-69AE-11D9-BED3-505054503030",
"0CCE9227-69AE-11D9-BED3-505054503030" "0CCE9226-69AE-11D9-BED3-505054503030"
], ],
"title": "OilRig APT Schedule Task Persistence - Security" "title": "OilRig APT Schedule Task Persistence - Security"
}, },
@@ -924,23 +924,23 @@
"id": "74d067bc-3f42-3855-c13d-771d589cf11c", "id": "74d067bc-3f42-3855-c13d-771d589cf11c",
"level": "critical", "level": "critical",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030" "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030"
], ],
"title": "CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security" "title": "CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security"
}, },
{ {
"description": "Detects any creation or modification to a windows domain group with the name \"ESX Admins\".\nThis could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor.\nVMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named \"ESX Admins\" to have full administrative access by default.\n", "description": "Detects any creation or modification to a windows domain group with the name \"ESX Admins\".\nThis could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor.\nVMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named \"ESX Admins\" to have full administrative access by default.\n",
"event_ids": [ "event_ids": [
"4728",
"4737",
"4727",
"4756",
"4731", "4731",
"4754", "4727",
"4755" "4755",
"4737",
"4756",
"4728",
"4754"
], ],
"id": "2a451b93-9890-5cfe-38aa-1dc4f8f0fe0a", "id": "2a451b93-9890-5cfe-38aa-1dc4f8f0fe0a",
"level": "high", "level": "high",
@@ -983,10 +983,10 @@
"id": "1aeb71a3-31b4-1a5e-85d8-1631c3a73d43", "id": "1aeb71a3-31b4-1a5e-85d8-1631c3a73d43",
"level": "critical", "level": "critical",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030" "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030"
], ],
"title": "CVE-2023-23397 Exploitation Attempt" "title": "CVE-2023-23397 Exploitation Attempt"
}, },
@@ -1010,23 +1010,23 @@
"id": "05731ce3-cfda-dbba-3792-c17794a22cf7", "id": "05731ce3-cfda-dbba-3792-c17794a22cf7",
"level": "critical", "level": "critical",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9227-69AE-11D9-BED3-505054503030", "0CCE9226-69AE-11D9-BED3-505054503030",
"0CCE9226-69AE-11D9-BED3-505054503030" "0CCE9227-69AE-11D9-BED3-505054503030"
], ],
"title": "Diamond Sleet APT Scheduled Task Creation" "title": "Diamond Sleet APT Scheduled Task Creation"
}, },
{ {
"description": "Hunts for known SVR-specific scheduled task names", "description": "Hunts for known SVR-specific scheduled task names",
"event_ids": [ "event_ids": [
"4698",
"4699", "4699",
"4702" "4702",
"4698"
], ],
"id": "ae16af08-e56e-414a-ceba-cb62e9f3a2ef", "id": "ae16af08-e56e-414a-ceba-cb62e9f3a2ef",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9226-69AE-11D9-BED3-505054503030", "0CCE9227-69AE-11D9-BED3-505054503030",
"0CCE9227-69AE-11D9-BED3-505054503030" "0CCE9226-69AE-11D9-BED3-505054503030"
], ],
"title": "Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor" "title": "Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor"
}, },
@@ -1058,17 +1058,17 @@
"description": "Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.", "description": "Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.",
"event_ids": [ "event_ids": [
"5145", "5145",
"4663", "4656",
"4656" "4663"
], ],
"id": "21ead34c-d2d4-2799-6318-2ff9e4aa9222", "id": "21ead34c-d2d4-2799-6318-2ff9e4aa9222",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921D-69AE-11D9-BED3-505054503030", "0CCE9244-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE9244-69AE-11D9-BED3-505054503030" "0CCE921D-69AE-11D9-BED3-505054503030"
], ],
"title": "BlueSky Ransomware Artefacts" "title": "BlueSky Ransomware Artefacts"
}, },
@@ -1099,8 +1099,8 @@
{ {
"description": "Detects the attack technique pass the hash which is used to move laterally inside the network", "description": "Detects the attack technique pass the hash which is used to move laterally inside the network",
"event_ids": [ "event_ids": [
"4625", "4624",
"4624" "4625"
], ],
"id": "35890fd4-9ed3-b244-0eff-91fe61e52f8b", "id": "35890fd4-9ed3-b244-0eff-91fe61e52f8b",
"level": "medium", "level": "medium",
@@ -1125,8 +1125,8 @@
{ {
"description": "Detects logon with \"Special groups\" and \"Special Privileges\" can be thought of as Administrator groups or privileges.", "description": "Detects logon with \"Special groups\" and \"Special Privileges\" can be thought of as Administrator groups or privileges.",
"event_ids": [ "event_ids": [
"4672", "4964",
"4964" "4672"
], ],
"id": "b3d10465-f171-0ef7-d28e-8ef2f9409cf1", "id": "b3d10465-f171-0ef7-d28e-8ef2f9409cf1",
"level": "low", "level": "low",
@@ -1138,9 +1138,9 @@
{ {
"description": "Detects interactive console logons to Server Systems", "description": "Detects interactive console logons to Server Systems",
"event_ids": [ "event_ids": [
"529",
"528", "528",
"4624", "4624",
"529",
"4625" "4625"
], ],
"id": "7298c707-7564-3229-7c76-ec514847d8c2", "id": "7298c707-7564-3229-7c76-ec514847d8c2",
@@ -1171,8 +1171,8 @@
"id": "68d6fb03-e325-2ed1-a429-abac7adf7ba3", "id": "68d6fb03-e325-2ed1-a429-abac7adf7ba3",
"level": "low", "level": "low",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9227-69AE-11D9-BED3-505054503030", "0CCE9226-69AE-11D9-BED3-505054503030",
"0CCE9226-69AE-11D9-BED3-505054503030" "0CCE9227-69AE-11D9-BED3-505054503030"
], ],
"title": "Scheduled Task Deletion" "title": "Scheduled Task Deletion"
}, },
@@ -1184,10 +1184,10 @@
"id": "7619b716-8052-6323-d9c7-87923ef591e6", "id": "7619b716-8052-6323-d9c7-87923ef591e6",
"level": "low", "level": "low",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030" "0CCE9245-69AE-11D9-BED3-505054503030"
], ],
"title": "Access To Browser Credential Files By Uncommon Applications - Security" "title": "Access To Browser Credential Files By Uncommon Applications - Security"
}, },
@@ -1247,10 +1247,10 @@
"id": "4faa08cb-e57e-bb07-cfc2-2153a97a99bf", "id": "4faa08cb-e57e-bb07-cfc2-2153a97a99bf",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030" "0CCE921E-69AE-11D9-BED3-505054503030"
], ],
"title": "ISO Image Mounted" "title": "ISO Image Mounted"
}, },
@@ -1262,8 +1262,8 @@
"id": "cd7d9f05-3bf6-21f6-6686-e602ab6d72ba", "id": "cd7d9f05-3bf6-21f6-6686-e602ab6d72ba",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9227-69AE-11D9-BED3-505054503030", "0CCE9226-69AE-11D9-BED3-505054503030",
"0CCE9226-69AE-11D9-BED3-505054503030" "0CCE9227-69AE-11D9-BED3-505054503030"
], ],
"title": "Suspicious Scheduled Task Creation" "title": "Suspicious Scheduled Task Creation"
}, },
@@ -1287,17 +1287,17 @@
"id": "1085e6d3-6691-5713-42ba-ba8933a6b2d0", "id": "1085e6d3-6691-5713-42ba-ba8933a6b2d0",
"level": "low", "level": "low",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9210-69AE-11D9-BED3-505054503030", "69979849-797A-11D9-BED3-505054503030",
"69979849-797A-11D9-BED3-505054503030" "0CCE9210-69AE-11D9-BED3-505054503030"
], ],
"title": "Unauthorized System Time Modification" "title": "Unauthorized System Time Modification"
}, },
{ {
"description": "An attacker can use the SID history attribute to gain additional privileges.", "description": "An attacker can use the SID history attribute to gain additional privileges.",
"event_ids": [ "event_ids": [
"4738", "4765",
"4766", "4766",
"4765" "4738"
], ],
"id": "5335aea0-f1b4-e120-08b6-c80fe4bf99ad", "id": "5335aea0-f1b4-e120-08b6-c80fe4bf99ad",
"level": "medium", "level": "medium",
@@ -1356,16 +1356,16 @@
{ {
"description": "Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.", "description": "Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.",
"event_ids": [ "event_ids": [
"4769", "4768",
"675", "675",
"4771", "4771",
"4768" "4769"
], ],
"id": "978525c2-97aa-f0e4-8c11-3cf81ea3379b", "id": "978525c2-97aa-f0e4-8c11-3cf81ea3379b",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9240-69AE-11D9-BED3-505054503030", "0CCE9242-69AE-11D9-BED3-505054503030",
"0CCE9242-69AE-11D9-BED3-505054503030" "0CCE9240-69AE-11D9-BED3-505054503030"
], ],
"title": "Kerberos Manipulation" "title": "Kerberos Manipulation"
}, },
@@ -1384,8 +1384,8 @@
{ {
"description": "Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.\n", "description": "Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.\n",
"event_ids": [ "event_ids": [
"5038", "6281",
"6281" "5038"
], ],
"id": "4f738466-2a14-5842-1eb3-481614770a49", "id": "4f738466-2a14-5842-1eb3-481614770a49",
"level": "informational", "level": "informational",
@@ -1488,8 +1488,8 @@
"id": "c800ccd5-5818-b0f5-1a12-f9c8bc24a433", "id": "c800ccd5-5818-b0f5-1a12-f9c8bc24a433",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9236-69AE-11D9-BED3-505054503030", "0CCE923C-69AE-11D9-BED3-505054503030",
"0CCE923C-69AE-11D9-BED3-505054503030" "0CCE9236-69AE-11D9-BED3-505054503030"
], ],
"title": "Possible DC Shadow Attack" "title": "Possible DC Shadow Attack"
}, },
@@ -1502,9 +1502,9 @@
"id": "c7f94c63-6fb7-9686-e2c2-2298c9f56ca9", "id": "c7f94c63-6fb7-9686-e2c2-2298c9f56ca9",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030" "0CCE9245-69AE-11D9-BED3-505054503030"
], ],
"title": "Potentially Suspicious AccessMask Requested From LSASS" "title": "Potentially Suspicious AccessMask Requested From LSASS"
@@ -1524,16 +1524,16 @@
{ {
"description": "This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent.\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\\SOFTWARE\\Microsoft\\Microsoft Online\\Reporting\\MonitoringAgent.\n", "description": "This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent.\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\\SOFTWARE\\Microsoft\\Microsoft Online\\Reporting\\MonitoringAgent.\n",
"event_ids": [ "event_ids": [
"4663", "4656",
"4656" "4663"
], ],
"id": "321196fe-fb10-6b13-c611-3dfe40baa1af", "id": "321196fe-fb10-6b13-c611-3dfe40baa1af",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030" "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030"
], ],
"title": "Azure AD Health Monitoring Agent Registry Keys Access" "title": "Azure AD Health Monitoring Agent Registry Keys Access"
}, },
@@ -1684,15 +1684,15 @@
{ {
"description": "This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.", "description": "This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.",
"event_ids": [ "event_ids": [
"4625", "4776",
"4776" "4625"
], ],
"id": "655eb351-553b-501f-186e-aa9af13ecf43", "id": "655eb351-553b-501f-186e-aa9af13ecf43",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9215-69AE-11D9-BED3-505054503030", "0CCE9217-69AE-11D9-BED3-505054503030",
"0CCE923F-69AE-11D9-BED3-505054503030", "0CCE923F-69AE-11D9-BED3-505054503030",
"0CCE9217-69AE-11D9-BED3-505054503030" "0CCE9215-69AE-11D9-BED3-505054503030"
], ],
"title": "Account Tampering - Suspicious Failed Logon Reasons" "title": "Account Tampering - Suspicious Failed Logon Reasons"
}, },
@@ -1707,25 +1707,25 @@
"subcategory_guids": [ "subcategory_guids": [
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030" "0CCE921F-69AE-11D9-BED3-505054503030"
], ],
"title": "Sysmon Channel Reference Deletion" "title": "Sysmon Channel Reference Deletion"
}, },
{ {
"description": "Potential adversaries accessing the microphone and webcam in an endpoint.", "description": "Potential adversaries accessing the microphone and webcam in an endpoint.",
"event_ids": [ "event_ids": [
"4663",
"4656", "4656",
"4657" "4657",
"4663"
], ],
"id": "32337bc9-8e75-bdaf-eaf4-d3b19ee08a67", "id": "32337bc9-8e75-bdaf-eaf4-d3b19ee08a67",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030" "0CCE921D-69AE-11D9-BED3-505054503030"
], ],
"title": "Processes Accessing the Microphone and Webcam" "title": "Processes Accessing the Microphone and Webcam"
}, },
@@ -1739,8 +1739,8 @@
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030" "0CCE9245-69AE-11D9-BED3-505054503030"
], ],
"title": "SysKey Registry Keys Access" "title": "SysKey Registry Keys Access"
@@ -1810,8 +1810,8 @@
{ {
"description": "Detects activity when a member is removed from a security-enabled global group", "description": "Detects activity when a member is removed from a security-enabled global group",
"event_ids": [ "event_ids": [
"633", "4729",
"4729" "633"
], ],
"id": "6e0f860b-3678-7396-a4a3-7cf55f7bb01c", "id": "6e0f860b-3678-7396-a4a3-7cf55f7bb01c",
"level": "low", "level": "low",
@@ -1963,10 +1963,10 @@
"id": "de10da38-ee60-f6a4-7d70-4d308558158b", "id": "de10da38-ee60-f6a4-7d70-4d308558158b",
"level": "critical", "level": "critical",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030" "0CCE9245-69AE-11D9-BED3-505054503030"
], ],
"title": "WCE wceaux.dll Access" "title": "WCE wceaux.dll Access"
}, },
@@ -1990,10 +1990,10 @@
"id": "04a055ea-ffa9-540b-e1d2-d5c1bfd5bc7b", "id": "04a055ea-ffa9-540b-e1d2-d5c1bfd5bc7b",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030" "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030"
], ],
"title": "Suspicious Teams Application Related ObjectAcess Event" "title": "Suspicious Teams Application Related ObjectAcess Event"
}, },
@@ -2017,8 +2017,8 @@
"id": "d74b03af-7e5f-bc5b-9e84-9d44af3d61b7", "id": "d74b03af-7e5f-bc5b-9e84-9d44af3d61b7",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9227-69AE-11D9-BED3-505054503030", "0CCE9226-69AE-11D9-BED3-505054503030",
"0CCE9226-69AE-11D9-BED3-505054503030" "0CCE9227-69AE-11D9-BED3-505054503030"
], ],
"title": "Suspicious Scheduled Task Update" "title": "Suspicious Scheduled Task Update"
}, },
@@ -2037,8 +2037,8 @@
{ {
"description": "Detects a user log-off activity. Could be used for example to correlate information during forensic investigations", "description": "Detects a user log-off activity. Could be used for example to correlate information during forensic investigations",
"event_ids": [ "event_ids": [
"4634", "4647",
"4647" "4634"
], ],
"id": "73f64ce7-a76d-0208-ea75-dd26a09d719b", "id": "73f64ce7-a76d-0208-ea75-dd26a09d719b",
"level": "informational", "level": "informational",
@@ -2181,16 +2181,16 @@
"description": "Detects files that have extensions commonly seen while SDelete is used to wipe files.", "description": "Detects files that have extensions commonly seen while SDelete is used to wipe files.",
"event_ids": [ "event_ids": [
"4656", "4656",
"4658", "4663",
"4663" "4658"
], ],
"id": "70c3269a-a7f2-49bd-1e28-a0921f353db7", "id": "70c3269a-a7f2-49bd-1e28-a0921f353db7",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE9223-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE9223-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030" "0CCE921E-69AE-11D9-BED3-505054503030"
], ],
"title": "Potential Secure Deletion with SDelete" "title": "Potential Secure Deletion with SDelete"
@@ -2229,8 +2229,8 @@
"subcategory_guids": [ "subcategory_guids": [
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030" "0CCE921F-69AE-11D9-BED3-505054503030"
], ],
"title": "SAM Registry Hive Handle Request" "title": "SAM Registry Hive Handle Request"
}, },
@@ -2269,8 +2269,8 @@
"id": "5ac4b7f8-9412-f919-220c-aa8a1867b1ef", "id": "5ac4b7f8-9412-f919-220c-aa8a1867b1ef",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9220-69AE-11D9-BED3-505054503030", "0CCE923B-69AE-11D9-BED3-505054503030",
"0CCE923B-69AE-11D9-BED3-505054503030" "0CCE9220-69AE-11D9-BED3-505054503030"
], ],
"title": "Reconnaissance Activity" "title": "Reconnaissance Activity"
}, },
@@ -2332,8 +2332,8 @@
"id": "9bcf333e-fc4c-5912-eeba-8a0cefe21be4", "id": "9bcf333e-fc4c-5912-eeba-8a0cefe21be4",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE923B-69AE-11D9-BED3-505054503030", "0CCE9220-69AE-11D9-BED3-505054503030",
"0CCE9220-69AE-11D9-BED3-505054503030" "0CCE923B-69AE-11D9-BED3-505054503030"
], ],
"title": "Password Policy Enumerated" "title": "Password Policy Enumerated"
}, },
@@ -2485,14 +2485,14 @@
"description": "Alerts on Metasploit host's authentications on the domain.", "description": "Alerts on Metasploit host's authentications on the domain.",
"event_ids": [ "event_ids": [
"4625", "4625",
"4624", "4776",
"4776" "4624"
], ],
"id": "827aa6c1-1507-3f0a-385a-ade5251bfd71", "id": "827aa6c1-1507-3f0a-385a-ade5251bfd71",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9217-69AE-11D9-BED3-505054503030",
"0CCE9215-69AE-11D9-BED3-505054503030", "0CCE9215-69AE-11D9-BED3-505054503030",
"0CCE9217-69AE-11D9-BED3-505054503030",
"0CCE923F-69AE-11D9-BED3-505054503030" "0CCE923F-69AE-11D9-BED3-505054503030"
], ],
"title": "Metasploit SMB Authentication" "title": "Metasploit SMB Authentication"
@@ -2572,15 +2572,15 @@
{ {
"description": "Detects potential mimikatz-like tools accessing LSASS from non system account", "description": "Detects potential mimikatz-like tools accessing LSASS from non system account",
"event_ids": [ "event_ids": [
"4663", "4656",
"4656" "4663"
], ],
"id": "06b8bcc0-326b-518a-3868-fe0721488fb8", "id": "06b8bcc0-326b-518a-3868-fe0721488fb8",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030" "0CCE9245-69AE-11D9-BED3-505054503030"
], ],
"title": "LSASS Access From Non System Account" "title": "LSASS Access From Non System Account"
@@ -2615,10 +2615,10 @@
"id": "474caaa9-3115-c838-1509-59ffb6caecfc", "id": "474caaa9-3115-c838-1509-59ffb6caecfc",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030"
"0CCE9245-69AE-11D9-BED3-505054503030"
], ],
"title": "SCM Database Handle Failure" "title": "SCM Database Handle Failure"
}, },
@@ -2679,25 +2679,25 @@
"level": "low", "level": "low",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030" "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030"
], ],
"title": "Service Registry Key Read Access Request" "title": "Service Registry Key Read Access Request"
}, },
{ {
"description": "Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.\n", "description": "Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.\n",
"event_ids": [ "event_ids": [
"4656", "4663",
"4663" "4656"
], ],
"id": "777523b0-14f8-1ca2-12c9-d668153661ff", "id": "777523b0-14f8-1ca2-12c9-d668153661ff",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030" "0CCE921E-69AE-11D9-BED3-505054503030"
], ],
"title": "Windows Defender Exclusion Registry Key - Write Access Requested" "title": "Windows Defender Exclusion Registry Key - Write Access Requested"
}, },
@@ -2728,14 +2728,14 @@
{ {
"description": "Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators\n", "description": "Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators\n",
"event_ids": [ "event_ids": [
"5449", "5447",
"5447" "5449"
], ],
"id": "22d4af9f-97d9-4827-7209-c451ff7f43c6", "id": "22d4af9f-97d9-4827-7209-c451ff7f43c6",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9234-69AE-11D9-BED3-505054503030", "0CCE9233-69AE-11D9-BED3-505054503030",
"0CCE9233-69AE-11D9-BED3-505054503030" "0CCE9234-69AE-11D9-BED3-505054503030"
], ],
"title": "HackTool - NoFilter Execution" "title": "HackTool - NoFilter Execution"
}, },
@@ -2759,24 +2759,24 @@
"id": "cd93b6ed-961d-ed36-92db-bd44bccda695", "id": "cd93b6ed-961d-ed36-92db-bd44bccda695",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9229-69AE-11D9-BED3-505054503030", "0CCE9228-69AE-11D9-BED3-505054503030",
"0CCE9228-69AE-11D9-BED3-505054503030" "0CCE9229-69AE-11D9-BED3-505054503030"
], ],
"title": "User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'" "title": "User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'"
}, },
{ {
"description": "This events that are generated when using the hacktool Ruler by Sensepost", "description": "This events that are generated when using the hacktool Ruler by Sensepost",
"event_ids": [ "event_ids": [
"4624",
"4776", "4776",
"4624",
"4625" "4625"
], ],
"id": "8b40829b-4556-9bec-a8ad-905688497639", "id": "8b40829b-4556-9bec-a8ad-905688497639",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9217-69AE-11D9-BED3-505054503030", "0CCE9217-69AE-11D9-BED3-505054503030",
"0CCE9215-69AE-11D9-BED3-505054503030", "0CCE923F-69AE-11D9-BED3-505054503030",
"0CCE923F-69AE-11D9-BED3-505054503030" "0CCE9215-69AE-11D9-BED3-505054503030"
], ],
"title": "Hacktool Ruler" "title": "Hacktool Ruler"
}, },
@@ -2807,8 +2807,8 @@
{ {
"description": "Detects the creation of a user with the \"$\" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.\n", "description": "Detects the creation of a user with the \"$\" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.\n",
"event_ids": [ "event_ids": [
"4720", "4781",
"4781" "4720"
], ],
"id": "ec77919c-1169-6640-23e7-91c6f27ddc91", "id": "ec77919c-1169-6640-23e7-91c6f27ddc91",
"level": "medium", "level": "medium",
@@ -2825,18 +2825,18 @@
"id": "d81faa44-ff28-8f61-097b-92727b8af44b", "id": "d81faa44-ff28-8f61-097b-92727b8af44b",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921D-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030" "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030"
], ],
"title": "Password Dumper Activity on LSASS" "title": "Password Dumper Activity on LSASS"
}, },
{ {
"description": "Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities", "description": "Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities",
"event_ids": [ "event_ids": [
"4701", "4699",
"4699" "4701"
], ],
"id": "9ce591d7-6b6d-444a-8c27-8ca626dddad3", "id": "9ce591d7-6b6d-444a-8c27-8ca626dddad3",
"level": "high", "level": "high",
@@ -2861,30 +2861,30 @@
{ {
"description": "Detects scenarios where one can control another users or computers account without having to use their credentials.", "description": "Detects scenarios where one can control another users or computers account without having to use their credentials.",
"event_ids": [ "event_ids": [
"5136", "4738",
"4738" "5136"
], ],
"id": "c9123898-04d5-2d3b-5e2b-7c0c92111480", "id": "c9123898-04d5-2d3b-5e2b-7c0c92111480",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9235-69AE-11D9-BED3-505054503030", "0CCE923C-69AE-11D9-BED3-505054503030",
"0CCE923C-69AE-11D9-BED3-505054503030" "0CCE9235-69AE-11D9-BED3-505054503030"
], ],
"title": "Active Directory User Backdoors" "title": "Active Directory User Backdoors"
}, },
{ {
"description": "This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS).\nInformation from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\\SOFTWARE\\Microsoft\\ADHealthAgent.\nMake sure you set the SACL to propagate to its sub-keys.\n", "description": "This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS).\nInformation from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\\SOFTWARE\\Microsoft\\ADHealthAgent.\nMake sure you set the SACL to propagate to its sub-keys.\n",
"event_ids": [ "event_ids": [
"4663", "4656",
"4656" "4663"
], ],
"id": "763d50d7-9452-0146-18a1-9ca65e3a2f73", "id": "763d50d7-9452-0146-18a1-9ca65e3a2f73",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030" "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030"
], ],
"title": "Azure AD Health Service Agents Registry Keys Access" "title": "Azure AD Health Service Agents Registry Keys Access"
}, },
@@ -2990,9 +2990,9 @@
"id": "7bd85790-c82a-56af-7127-f257e5ef6c6f", "id": "7bd85790-c82a-56af-7127-f257e5ef6c6f",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030", "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030" "0CCE921E-69AE-11D9-BED3-505054503030"
], ],
"title": "Windows Defender Exclusion Deleted" "title": "Windows Defender Exclusion Deleted"
}, },
@@ -3033,12 +3033,12 @@
{ {
"description": "Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges.\nSigma detects\nEvent ID 4728 indicates a \"Member is added to a Security Group\".\nEvent ID 4729 indicates a \"Member is removed from a Security enabled-group\".\nEvent ID 4730 indicates a \"Security Group is deleted\".\nThe case is not applicable for Unix OS.\nSupported OS - Windows 2008 R2 and 7, Windows 2012 R2 and 8.1, Windows 2016 and 10 Windows Server 2019, Windows Server 2000, Windows 2003 and XP.\n", "description": "Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges.\nSigma detects\nEvent ID 4728 indicates a \"Member is added to a Security Group\".\nEvent ID 4729 indicates a \"Member is removed from a Security enabled-group\".\nEvent ID 4730 indicates a \"Security Group is deleted\".\nThe case is not applicable for Unix OS.\nSupported OS - Windows 2008 R2 and 7, Windows 2012 R2 and 8.1, Windows 2016 and 10 Windows Server 2019, Windows Server 2000, Windows 2003 and XP.\n",
"event_ids": [ "event_ids": [
"4728",
"4730",
"634",
"633",
"632", "632",
"4729" "4730",
"4729",
"633",
"634",
"4728"
], ],
"id": "506379d9-8545-c010-e9a3-693119ab9261", "id": "506379d9-8545-c010-e9a3-693119ab9261",
"level": "low", "level": "low",
@@ -3074,9 +3074,9 @@
{ {
"description": "Detects remote execution via scheduled task creation or update on the destination host", "description": "Detects remote execution via scheduled task creation or update on the destination host",
"event_ids": [ "event_ids": [
"4624",
"4698", "4698",
"4702" "4702",
"4624"
], ],
"id": "bc42c437-1ea8-fd0f-d964-e37a58d861fc", "id": "bc42c437-1ea8-fd0f-d964-e37a58d861fc",
"level": "medium", "level": "medium",
@@ -3157,10 +3157,10 @@
"id": "888d3e17-a1ed-6b11-895c-e1f9b96b35be", "id": "888d3e17-a1ed-6b11-895c-e1f9b96b35be",
"level": "high", "level": "high",
"subcategory_guids": [ "subcategory_guids": [
"0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030", "0CCE921D-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030" "0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE9245-69AE-11D9-BED3-505054503030"
], ],
"title": "Stored Credentials in Fake Files" "title": "Stored Credentials in Fake Files"
}, },
@@ -3192,14 +3192,14 @@
{ {
"description": "Detects suspicious failed logins with different user accounts from a single source system", "description": "Detects suspicious failed logins with different user accounts from a single source system",
"event_ids": [ "event_ids": [
"529", "4625",
"4625" "529"
], ],
"id": "428d3964-3241-1ceb-8f93-b31d8490c822", "id": "428d3964-3241-1ceb-8f93-b31d8490c822",
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9215-69AE-11D9-BED3-505054503030", "0CCE9217-69AE-11D9-BED3-505054503030",
"0CCE9217-69AE-11D9-BED3-505054503030" "0CCE9215-69AE-11D9-BED3-505054503030"
], ],
"title": "Failed Logins with Different Accounts from Single Source System" "title": "Failed Logins with Different Accounts from Single Source System"
}, },
@@ -3212,8 +3212,8 @@
"level": "medium", "level": "medium",
"subcategory_guids": [ "subcategory_guids": [
"0CCE9245-69AE-11D9-BED3-505054503030", "0CCE9245-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921E-69AE-11D9-BED3-505054503030", "0CCE921E-69AE-11D9-BED3-505054503030",
"0CCE921F-69AE-11D9-BED3-505054503030",
"0CCE921D-69AE-11D9-BED3-505054503030" "0CCE921D-69AE-11D9-BED3-505054503030"
], ],
"title": "Suspicious Multiple File Rename Or Delete Occurred" "title": "Suspicious Multiple File Rename Or Delete Occurred"