mirror of
https://github.com/Yamato-Security/WELA.git
synced 2025-12-14 05:03:17 +01:00
Automated update
This commit is contained in:
github-actions[bot]
@@ -61,8 +61,8 @@
|
|||||||
"id": "60d768ca-33e8-4f34-b967-14fd7aa18a22",
|
"id": "60d768ca-33e8-4f34-b967-14fd7aa18a22",
|
||||||
"level": "informational",
|
"level": "informational",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
"0CCE9227-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030"
|
"0CCE9226-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Task Created"
|
"title": "Task Created"
|
||||||
},
|
},
|
||||||
@@ -74,8 +74,8 @@
|
|||||||
"id": "de5ed02e-e7b5-47a0-a35c-06a907c988e4",
|
"id": "de5ed02e-e7b5-47a0-a35c-06a907c988e4",
|
||||||
"level": "informational",
|
"level": "informational",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
"0CCE9227-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030"
|
"0CCE9226-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Task Deleted"
|
"title": "Task Deleted"
|
||||||
},
|
},
|
||||||
@@ -516,8 +516,8 @@
|
|||||||
"id": "5b0b75dc-9190-4047-b9a8-14164cee8a31",
|
"id": "5b0b75dc-9190-4047-b9a8-14164cee8a31",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
"0CCE9217-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9217-69AE-11D9-BED3-505054503030"
|
"0CCE9215-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Failed Logon - Incorrect Password"
|
"title": "Failed Logon - Incorrect Password"
|
||||||
},
|
},
|
||||||
@@ -590,8 +590,8 @@
|
|||||||
"id": "e87bd730-df45-4ae9-85de-6c75369c5d29",
|
"id": "e87bd730-df45-4ae9-85de-6c75369c5d29",
|
||||||
"level": "low",
|
"level": "low",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
"0CCE9217-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9217-69AE-11D9-BED3-505054503030"
|
"0CCE9215-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Logon Failure (Wrong Password)"
|
"title": "Logon Failure (Wrong Password)"
|
||||||
},
|
},
|
||||||
@@ -888,8 +888,8 @@
|
|||||||
"id": "798c8f65-068a-0a31-009f-12739f547a2d",
|
"id": "798c8f65-068a-0a31-009f-12739f547a2d",
|
||||||
"level": "critical",
|
"level": "critical",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
"0CCE9227-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030"
|
"0CCE9226-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "OilRig APT Schedule Task Persistence - Security"
|
"title": "OilRig APT Schedule Task Persistence - Security"
|
||||||
},
|
},
|
||||||
@@ -901,10 +901,10 @@
|
|||||||
"id": "82b185f4-cdcb-ba23-9fdb-dbc1a732e1a7",
|
"id": "82b185f4-cdcb-ba23-9fdb-dbc1a732e1a7",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
|
"0CCE921D-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "ScreenConnect User Database Modification - Security"
|
"title": "ScreenConnect User Database Modification - Security"
|
||||||
},
|
},
|
||||||
@@ -916,33 +916,27 @@
|
|||||||
"id": "74d067bc-3f42-3855-c13d-771d589cf11c",
|
"id": "74d067bc-3f42-3855-c13d-771d589cf11c",
|
||||||
"level": "critical",
|
"level": "critical",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
|
"0CCE921F-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security"
|
"title": "CVE-2024-1708 - ScreenConnect Path Traversal Exploitation - Security"
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"description": "Detects any creation or modification to a windows domain group with the name \"ESX Admins\".\nThis could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor.\nVMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named \"ESX Admins\" to have full administrative access by default.\n",
|
"description": "Detects any creation or modification to a windows domain group with the name \"ESX Admins\".\nThis could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor.\nVMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named \"ESX Admins\" to have full administrative access by default.\n",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4727",
|
|
||||||
"4728",
|
"4728",
|
||||||
|
"4755",
|
||||||
"4731",
|
"4731",
|
||||||
|
"4727",
|
||||||
"4737",
|
"4737",
|
||||||
"4754",
|
"4754",
|
||||||
"4755",
|
|
||||||
"4756"
|
"4756"
|
||||||
],
|
],
|
||||||
"id": "2a451b93-9890-5cfe-38aa-1dc4f8f0fe0a",
|
"id": "2a451b93-9890-5cfe-38aa-1dc4f8f0fe0a",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9237-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9237-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9237-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9237-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9237-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9237-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9237-69AE-11D9-BED3-505054503030"
|
"0CCE9237-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity"
|
"title": "Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity"
|
||||||
@@ -955,8 +949,8 @@
|
|||||||
"id": "fa0084fc-2105-cdc9-c7c1-1752bbb2e4d2",
|
"id": "fa0084fc-2105-cdc9-c7c1-1752bbb2e4d2",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
"0CCE9227-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030"
|
"0CCE9226-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Kapeka Backdoor Scheduled Task Creation"
|
"title": "Kapeka Backdoor Scheduled Task Creation"
|
||||||
},
|
},
|
||||||
@@ -981,12 +975,8 @@
|
|||||||
"id": "1aeb71a3-31b4-1a5e-85d8-1631c3a73d43",
|
"id": "1aeb71a3-31b4-1a5e-85d8-1631c3a73d43",
|
||||||
"level": "critical",
|
"level": "critical",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE9245-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
@@ -1027,12 +1017,8 @@
|
|||||||
"id": "ae16af08-e56e-414a-ceba-cb62e9f3a2ef",
|
"id": "ae16af08-e56e-414a-ceba-cb62e9f3a2ef",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030",
|
"0CCE9227-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
"0CCE9226-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor"
|
"title": "Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor"
|
||||||
},
|
},
|
||||||
@@ -1063,22 +1049,18 @@
|
|||||||
{
|
{
|
||||||
"description": "Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.",
|
"description": "Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4663",
|
|
||||||
"4656",
|
"4656",
|
||||||
"5145"
|
"5145",
|
||||||
|
"4663"
|
||||||
],
|
],
|
||||||
"id": "21ead34c-d2d4-2799-6318-2ff9e4aa9222",
|
"id": "21ead34c-d2d4-2799-6318-2ff9e4aa9222",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE9244-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9244-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "BlueSky Ransomware Artefacts"
|
"title": "BlueSky Ransomware Artefacts"
|
||||||
},
|
},
|
||||||
@@ -1115,9 +1097,8 @@
|
|||||||
"id": "35890fd4-9ed3-b244-0eff-91fe61e52f8b",
|
"id": "35890fd4-9ed3-b244-0eff-91fe61e52f8b",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
"0CCE9217-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
"0CCE9215-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE9217-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "Potential Pass the Hash Activity"
|
"title": "Potential Pass the Hash Activity"
|
||||||
},
|
},
|
||||||
@@ -1142,7 +1123,6 @@
|
|||||||
"id": "b3d10465-f171-0ef7-d28e-8ef2f9409cf1",
|
"id": "b3d10465-f171-0ef7-d28e-8ef2f9409cf1",
|
||||||
"level": "low",
|
"level": "low",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921B-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921B-69AE-11D9-BED3-505054503030"
|
"0CCE921B-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "User with Privileges Logon"
|
"title": "User with Privileges Logon"
|
||||||
@@ -1151,16 +1131,15 @@
|
|||||||
"description": "Detects interactive console logons to Server Systems",
|
"description": "Detects interactive console logons to Server Systems",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"528",
|
"528",
|
||||||
"529",
|
|
||||||
"4624",
|
"4624",
|
||||||
"4625"
|
"4625",
|
||||||
|
"529"
|
||||||
],
|
],
|
||||||
"id": "7298c707-7564-3229-7c76-ec514847d8c2",
|
"id": "7298c707-7564-3229-7c76-ec514847d8c2",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
"0CCE9217-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
"0CCE9215-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE9217-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "Interactive Logon to Server Systems"
|
"title": "Interactive Logon to Server Systems"
|
||||||
},
|
},
|
||||||
@@ -1197,10 +1176,10 @@
|
|||||||
"id": "7619b716-8052-6323-d9c7-87923ef591e6",
|
"id": "7619b716-8052-6323-d9c7-87923ef591e6",
|
||||||
"level": "low",
|
"level": "low",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE921D-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Access To Browser Credential Files By Uncommon Applications - Security"
|
"title": "Access To Browser Credential Files By Uncommon Applications - Security"
|
||||||
},
|
},
|
||||||
@@ -1258,10 +1237,10 @@
|
|||||||
"id": "4faa08cb-e57e-bb07-cfc2-2153a97a99bf",
|
"id": "4faa08cb-e57e-bb07-cfc2-2153a97a99bf",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
|
"0CCE921E-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "ISO Image Mounted"
|
"title": "ISO Image Mounted"
|
||||||
},
|
},
|
||||||
@@ -1298,8 +1277,8 @@
|
|||||||
"id": "1085e6d3-6691-5713-42ba-ba8933a6b2d0",
|
"id": "1085e6d3-6691-5713-42ba-ba8933a6b2d0",
|
||||||
"level": "low",
|
"level": "low",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9210-69AE-11D9-BED3-505054503030",
|
"69979849-797A-11D9-BED3-505054503030",
|
||||||
"69979849-797A-11D9-BED3-505054503030"
|
"0CCE9210-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Unauthorized System Time Modification"
|
"title": "Unauthorized System Time Modification"
|
||||||
},
|
},
|
||||||
@@ -1307,14 +1286,12 @@
|
|||||||
"description": "An attacker can use the SID history attribute to gain additional privileges.",
|
"description": "An attacker can use the SID history attribute to gain additional privileges.",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4765",
|
"4765",
|
||||||
"4766",
|
"4738",
|
||||||
"4738"
|
"4766"
|
||||||
],
|
],
|
||||||
"id": "5335aea0-f1b4-e120-08b6-c80fe4bf99ad",
|
"id": "5335aea0-f1b4-e120-08b6-c80fe4bf99ad",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9235-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9235-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9235-69AE-11D9-BED3-505054503030"
|
"0CCE9235-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Addition of SID History to Active Directory Object"
|
"title": "Addition of SID History to Active Directory Object"
|
||||||
@@ -1371,15 +1348,14 @@
|
|||||||
"event_ids": [
|
"event_ids": [
|
||||||
"675",
|
"675",
|
||||||
"4768",
|
"4768",
|
||||||
"4769",
|
"4771",
|
||||||
"4771"
|
"4769"
|
||||||
],
|
],
|
||||||
"id": "978525c2-97aa-f0e4-8c11-3cf81ea3379b",
|
"id": "978525c2-97aa-f0e4-8c11-3cf81ea3379b",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9242-69AE-11D9-BED3-505054503030",
|
"0CCE9242-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9240-69AE-11D9-BED3-505054503030",
|
"0CCE9240-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE9242-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "Kerberos Manipulation"
|
"title": "Kerberos Manipulation"
|
||||||
},
|
},
|
||||||
@@ -1404,7 +1380,6 @@
|
|||||||
"id": "4f738466-2a14-5842-1eb3-481614770a49",
|
"id": "4f738466-2a14-5842-1eb3-481614770a49",
|
||||||
"level": "informational",
|
"level": "informational",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9212-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9212-69AE-11D9-BED3-505054503030"
|
"0CCE9212-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Failed Code Integrity Checks"
|
"title": "Failed Code Integrity Checks"
|
||||||
@@ -1461,13 +1436,11 @@
|
|||||||
{
|
{
|
||||||
"description": "Detects scenarios where system auditing for important events such as \"Process Creation\" or \"Logon\" events is disabled.",
|
"description": "Detects scenarios where system auditing for important events such as \"Process Creation\" or \"Logon\" events is disabled.",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4719",
|
|
||||||
"4719"
|
"4719"
|
||||||
],
|
],
|
||||||
"id": "5fa54162-0bc4-710e-5dec-7ccc99ee4d52",
|
"id": "5fa54162-0bc4-710e-5dec-7ccc99ee4d52",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE922F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE922F-69AE-11D9-BED3-505054503030"
|
"0CCE922F-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Important Windows Event Auditing Disabled"
|
"title": "Important Windows Event Auditing Disabled"
|
||||||
@@ -1518,14 +1491,10 @@
|
|||||||
"id": "c7f94c63-6fb7-9686-e2c2-2298c9f56ca9",
|
"id": "c7f94c63-6fb7-9686-e2c2-2298c9f56ca9",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE921F-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Potentially Suspicious AccessMask Requested From LSASS"
|
"title": "Potentially Suspicious AccessMask Requested From LSASS"
|
||||||
},
|
},
|
||||||
@@ -1550,14 +1519,10 @@
|
|||||||
"id": "321196fe-fb10-6b13-c611-3dfe40baa1af",
|
"id": "321196fe-fb10-6b13-c611-3dfe40baa1af",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "Azure AD Health Monitoring Agent Registry Keys Access"
|
"title": "Azure AD Health Monitoring Agent Registry Keys Access"
|
||||||
},
|
},
|
||||||
@@ -1598,8 +1563,8 @@
|
|||||||
{
|
{
|
||||||
"description": "Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale",
|
"description": "Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"5136",
|
"5145",
|
||||||
"5145"
|
"5136"
|
||||||
],
|
],
|
||||||
"id": "01628b51-85e1-4088-9432-a11cba9f3ebd",
|
"id": "01628b51-85e1-4088-9432-a11cba9f3ebd",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
@@ -1711,8 +1676,8 @@
|
|||||||
"id": "655eb351-553b-501f-186e-aa9af13ecf43",
|
"id": "655eb351-553b-501f-186e-aa9af13ecf43",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
"0CCE9217-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9217-69AE-11D9-BED3-505054503030"
|
"0CCE9215-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Account Tampering - Suspicious Failed Logon Reasons"
|
"title": "Account Tampering - Suspicious Failed Logon Reasons"
|
||||||
},
|
},
|
||||||
@@ -1725,53 +1690,43 @@
|
|||||||
"id": "249d836c-8857-1b98-5d7b-050c2d34e275",
|
"id": "249d836c-8857-1b98-5d7b-050c2d34e275",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
|
"0CCE921D-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Sysmon Channel Reference Deletion"
|
"title": "Sysmon Channel Reference Deletion"
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"description": "Potential adversaries accessing the microphone and webcam in an endpoint.",
|
"description": "Potential adversaries accessing the microphone and webcam in an endpoint.",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4657",
|
|
||||||
"4656",
|
"4656",
|
||||||
"4663"
|
"4663",
|
||||||
|
"4657"
|
||||||
],
|
],
|
||||||
"id": "32337bc9-8e75-bdaf-eaf4-d3b19ee08a67",
|
"id": "32337bc9-8e75-bdaf-eaf4-d3b19ee08a67",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "Processes Accessing the Microphone and Webcam"
|
"title": "Processes Accessing the Microphone and Webcam"
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"description": "Detects handle requests and access operations to specific registry keys to calculate the SysKey",
|
"description": "Detects handle requests and access operations to specific registry keys to calculate the SysKey",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4656",
|
"4663",
|
||||||
"4663"
|
"4656"
|
||||||
],
|
],
|
||||||
"id": "63308dbe-54a4-9c70-cc90-6d15e10f3505",
|
"id": "63308dbe-54a4-9c70-cc90-6d15e10f3505",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "SysKey Registry Keys Access"
|
"title": "SysKey Registry Keys Access"
|
||||||
},
|
},
|
||||||
@@ -1840,8 +1795,8 @@
|
|||||||
{
|
{
|
||||||
"description": "Detects activity when a member is removed from a security-enabled global group",
|
"description": "Detects activity when a member is removed from a security-enabled global group",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"633",
|
"4729",
|
||||||
"4729"
|
"633"
|
||||||
],
|
],
|
||||||
"id": "6e0f860b-3678-7396-a4a3-7cf55f7bb01c",
|
"id": "6e0f860b-3678-7396-a4a3-7cf55f7bb01c",
|
||||||
"level": "low",
|
"level": "low",
|
||||||
@@ -1889,13 +1844,11 @@
|
|||||||
{
|
{
|
||||||
"description": "Detects the attack technique pass the hash which is used to move laterally inside the network",
|
"description": "Detects the attack technique pass the hash which is used to move laterally inside the network",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4624",
|
|
||||||
"4624"
|
"4624"
|
||||||
],
|
],
|
||||||
"id": "059e7255-411c-1666-a2e5-2e99e294e614",
|
"id": "059e7255-411c-1666-a2e5-2e99e294e614",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030"
|
"0CCE9215-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Pass the Hash Activity 2"
|
"title": "Pass the Hash Activity 2"
|
||||||
@@ -1964,8 +1917,8 @@
|
|||||||
{
|
{
|
||||||
"description": "Detects activity when a member is added to a security-enabled global group",
|
"description": "Detects activity when a member is added to a security-enabled global group",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4728",
|
"632",
|
||||||
"632"
|
"4728"
|
||||||
],
|
],
|
||||||
"id": "26767093-828c-2f39-bdd8-d0439e87307c",
|
"id": "26767093-828c-2f39-bdd8-d0439e87307c",
|
||||||
"level": "low",
|
"level": "low",
|
||||||
@@ -1996,12 +1949,8 @@
|
|||||||
"level": "critical",
|
"level": "critical",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE9245-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "WCE wceaux.dll Access"
|
"title": "WCE wceaux.dll Access"
|
||||||
@@ -2026,9 +1975,9 @@
|
|||||||
"id": "04a055ea-ffa9-540b-e1d2-d5c1bfd5bc7b",
|
"id": "04a055ea-ffa9-540b-e1d2-d5c1bfd5bc7b",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE9245-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Suspicious Teams Application Related ObjectAcess Event"
|
"title": "Suspicious Teams Application Related ObjectAcess Event"
|
||||||
@@ -2053,8 +2002,8 @@
|
|||||||
"id": "d74b03af-7e5f-bc5b-9e84-9d44af3d61b7",
|
"id": "d74b03af-7e5f-bc5b-9e84-9d44af3d61b7",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
"0CCE9227-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030"
|
"0CCE9226-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Suspicious Scheduled Task Update"
|
"title": "Suspicious Scheduled Task Update"
|
||||||
},
|
},
|
||||||
@@ -2079,7 +2028,6 @@
|
|||||||
"id": "73f64ce7-a76d-0208-ea75-dd26a09d719b",
|
"id": "73f64ce7-a76d-0208-ea75-dd26a09d719b",
|
||||||
"level": "informational",
|
"level": "informational",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9216-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9216-69AE-11D9-BED3-505054503030"
|
"0CCE9216-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "User Logoff Event"
|
"title": "User Logoff Event"
|
||||||
@@ -2217,27 +2165,18 @@
|
|||||||
{
|
{
|
||||||
"description": "Detects files that have extensions commonly seen while SDelete is used to wipe files.",
|
"description": "Detects files that have extensions commonly seen while SDelete is used to wipe files.",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
|
"4658",
|
||||||
"4656",
|
"4656",
|
||||||
"4663",
|
"4663"
|
||||||
"4658"
|
|
||||||
],
|
],
|
||||||
"id": "70c3269a-a7f2-49bd-1e28-a0921f353db7",
|
"id": "70c3269a-a7f2-49bd-1e28-a0921f353db7",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
"0CCE9223-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9223-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9223-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "Potential Secure Deletion with SDelete"
|
"title": "Potential Secure Deletion with SDelete"
|
||||||
},
|
},
|
||||||
@@ -2273,18 +2212,18 @@
|
|||||||
"id": "d7742b08-730d-3624-df95-cc3c6eaa3a39",
|
"id": "d7742b08-730d-3624-df95-cc3c6eaa3a39",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "SAM Registry Hive Handle Request"
|
"title": "SAM Registry Hive Handle Request"
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"description": "Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.\n",
|
"description": "Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.\n",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"5136",
|
"5145",
|
||||||
"5145"
|
"5136"
|
||||||
],
|
],
|
||||||
"id": "bc613d09-5a80-cad3-6f65-c5020f960511",
|
"id": "bc613d09-5a80-cad3-6f65-c5020f960511",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
@@ -2296,8 +2235,8 @@
|
|||||||
{
|
{
|
||||||
"description": "Detects certificate creation with template allowing risk permission subject",
|
"description": "Detects certificate creation with template allowing risk permission subject",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4898",
|
"4899",
|
||||||
"4899"
|
"4898"
|
||||||
],
|
],
|
||||||
"id": "3a655a7c-a830-77ad-fc8b-f054fb713304",
|
"id": "3a655a7c-a830-77ad-fc8b-f054fb713304",
|
||||||
"level": "low",
|
"level": "low",
|
||||||
@@ -2352,8 +2291,8 @@
|
|||||||
"id": "4d56e133-40b5-5b28-07b5-bab0913fc338",
|
"id": "4d56e133-40b5-5b28-07b5-bab0913fc338",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9233-69AE-11D9-BED3-505054503030",
|
"0CCE9234-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9234-69AE-11D9-BED3-505054503030"
|
"0CCE9233-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "HackTool - EDRSilencer Execution - Filter Added"
|
"title": "HackTool - EDRSilencer Execution - Filter Added"
|
||||||
},
|
},
|
||||||
@@ -2429,13 +2368,11 @@
|
|||||||
{
|
{
|
||||||
"description": "Potential adversaries stopping ETW providers recording loaded .NET assemblies.",
|
"description": "Potential adversaries stopping ETW providers recording loaded .NET assemblies.",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4657",
|
|
||||||
"4657"
|
"4657"
|
||||||
],
|
],
|
||||||
"id": "107a403c-5a05-2568-95a7-a7329d714440",
|
"id": "107a403c-5a05-2568-95a7-a7329d714440",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030"
|
"0CCE921E-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "ETW Logging Disabled In .NET Processes - Registry"
|
"title": "ETW Logging Disabled In .NET Processes - Registry"
|
||||||
@@ -2527,16 +2464,15 @@
|
|||||||
{
|
{
|
||||||
"description": "Alerts on Metasploit host's authentications on the domain.",
|
"description": "Alerts on Metasploit host's authentications on the domain.",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4625",
|
|
||||||
"4624",
|
"4624",
|
||||||
|
"4625",
|
||||||
"4776"
|
"4776"
|
||||||
],
|
],
|
||||||
"id": "827aa6c1-1507-3f0a-385a-ade5251bfd71",
|
"id": "827aa6c1-1507-3f0a-385a-ade5251bfd71",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
"0CCE9215-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9217-69AE-11D9-BED3-505054503030",
|
"0CCE9217-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "Metasploit SMB Authentication"
|
"title": "Metasploit SMB Authentication"
|
||||||
},
|
},
|
||||||
@@ -2615,20 +2551,16 @@
|
|||||||
{
|
{
|
||||||
"description": "Detects potential mimikatz-like tools accessing LSASS from non system account",
|
"description": "Detects potential mimikatz-like tools accessing LSASS from non system account",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4663",
|
"4656",
|
||||||
"4656"
|
"4663"
|
||||||
],
|
],
|
||||||
"id": "06b8bcc0-326b-518a-3868-fe0721488fb8",
|
"id": "06b8bcc0-326b-518a-3868-fe0721488fb8",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "LSASS Access From Non System Account"
|
"title": "LSASS Access From Non System Account"
|
||||||
},
|
},
|
||||||
@@ -2664,8 +2596,8 @@
|
|||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE921F-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "SCM Database Handle Failure"
|
"title": "SCM Database Handle Failure"
|
||||||
},
|
},
|
||||||
@@ -2724,8 +2656,8 @@
|
|||||||
"level": "low",
|
"level": "low",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE9245-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Service Registry Key Read Access Request"
|
"title": "Service Registry Key Read Access Request"
|
||||||
@@ -2733,28 +2665,24 @@
|
|||||||
{
|
{
|
||||||
"description": "Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.\n",
|
"description": "Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.\n",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4656",
|
"4663",
|
||||||
"4663"
|
"4656"
|
||||||
],
|
],
|
||||||
"id": "777523b0-14f8-1ca2-12c9-d668153661ff",
|
"id": "777523b0-14f8-1ca2-12c9-d668153661ff",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "Windows Defender Exclusion Registry Key - Write Access Requested"
|
"title": "Windows Defender Exclusion Registry Key - Write Access Requested"
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"description": "Detects certificate creation with template allowing risk permission subject and risky EKU",
|
"description": "Detects certificate creation with template allowing risk permission subject and risky EKU",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4898",
|
"4899",
|
||||||
"4899"
|
"4898"
|
||||||
],
|
],
|
||||||
"id": "aa2d5bf7-bc73-068e-a4df-a887cc3aba2b",
|
"id": "aa2d5bf7-bc73-068e-a4df-a887cc3aba2b",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
@@ -2783,8 +2711,8 @@
|
|||||||
"id": "22d4af9f-97d9-4827-7209-c451ff7f43c6",
|
"id": "22d4af9f-97d9-4827-7209-c451ff7f43c6",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9234-69AE-11D9-BED3-505054503030",
|
"0CCE9233-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9233-69AE-11D9-BED3-505054503030"
|
"0CCE9234-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "HackTool - NoFilter Execution"
|
"title": "HackTool - NoFilter Execution"
|
||||||
},
|
},
|
||||||
@@ -2806,22 +2734,21 @@
|
|||||||
"id": "cd93b6ed-961d-ed36-92db-bd44bccda695",
|
"id": "cd93b6ed-961d-ed36-92db-bd44bccda695",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9228-69AE-11D9-BED3-505054503030",
|
"0CCE9229-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9229-69AE-11D9-BED3-505054503030"
|
"0CCE9228-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'"
|
"title": "User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'"
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"description": "This events that are generated when using the hacktool Ruler by Sensepost",
|
"description": "This events that are generated when using the hacktool Ruler by Sensepost",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4776",
|
"4625",
|
||||||
"4624",
|
"4624",
|
||||||
"4625"
|
"4776"
|
||||||
],
|
],
|
||||||
"id": "8b40829b-4556-9bec-a8ad-905688497639",
|
"id": "8b40829b-4556-9bec-a8ad-905688497639",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
"0CCE9215-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9217-69AE-11D9-BED3-505054503030"
|
"0CCE9217-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
@@ -2855,14 +2782,11 @@
|
|||||||
"description": "Detects the creation of a user with the \"$\" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.\n",
|
"description": "Detects the creation of a user with the \"$\" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.\n",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4720",
|
"4720",
|
||||||
"4781",
|
"4781"
|
||||||
"4720"
|
|
||||||
],
|
],
|
||||||
"id": "ec77919c-1169-6640-23e7-91c6f27ddc91",
|
"id": "ec77919c-1169-6640-23e7-91c6f27ddc91",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9235-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9235-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9235-69AE-11D9-BED3-505054503030"
|
"0CCE9235-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "New or Renamed User Account with '$' Character"
|
"title": "New or Renamed User Account with '$' Character"
|
||||||
@@ -2875,10 +2799,10 @@
|
|||||||
"id": "d81faa44-ff28-8f61-097b-92727b8af44b",
|
"id": "d81faa44-ff28-8f61-097b-92727b8af44b",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
|
"0CCE921E-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Password Dumper Activity on LSASS"
|
"title": "Password Dumper Activity on LSASS"
|
||||||
},
|
},
|
||||||
@@ -2886,18 +2810,13 @@
|
|||||||
"description": "Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities",
|
"description": "Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4699",
|
"4699",
|
||||||
"4701",
|
"4701"
|
||||||
"4699"
|
|
||||||
],
|
],
|
||||||
"id": "9ce591d7-6b6d-444a-8c27-8ca626dddad3",
|
"id": "9ce591d7-6b6d-444a-8c27-8ca626dddad3",
|
||||||
"level": "high",
|
"level": "high",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030",
|
"0CCE9227-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
"0CCE9226-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "Important Scheduled Task Deleted/Disabled"
|
"title": "Important Scheduled Task Deleted/Disabled"
|
||||||
},
|
},
|
||||||
@@ -2915,8 +2834,6 @@
|
|||||||
"description": "Detects scenarios where one can control another users or computers account without having to use their credentials.",
|
"description": "Detects scenarios where one can control another users or computers account without having to use their credentials.",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4738",
|
"4738",
|
||||||
"5136",
|
|
||||||
"5136",
|
|
||||||
"5136"
|
"5136"
|
||||||
],
|
],
|
||||||
"id": "c9123898-04d5-2d3b-5e2b-7c0c92111480",
|
"id": "c9123898-04d5-2d3b-5e2b-7c0c92111480",
|
||||||
@@ -2929,20 +2846,16 @@
|
|||||||
{
|
{
|
||||||
"description": "This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS).\nInformation from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\\SOFTWARE\\Microsoft\\ADHealthAgent.\nMake sure you set the SACL to propagate to its sub-keys.\n",
|
"description": "This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS).\nInformation from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\\SOFTWARE\\Microsoft\\ADHealthAgent.\nMake sure you set the SACL to propagate to its sub-keys.\n",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4656",
|
"4663",
|
||||||
"4663"
|
"4656"
|
||||||
],
|
],
|
||||||
"id": "763d50d7-9452-0146-18a1-9ca65e3a2f73",
|
"id": "763d50d7-9452-0146-18a1-9ca65e3a2f73",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921F-69AE-11D9-BED3-505054503030"
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
|
||||||
],
|
],
|
||||||
"title": "Azure AD Health Service Agents Registry Keys Access"
|
"title": "Azure AD Health Service Agents Registry Keys Access"
|
||||||
},
|
},
|
||||||
@@ -3021,7 +2934,6 @@
|
|||||||
"id": "b607775d-e3fe-3fb8-c40e-4e52b3fbe44d",
|
"id": "b607775d-e3fe-3fb8-c40e-4e52b3fbe44d",
|
||||||
"level": "low",
|
"level": "low",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9236-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9236-69AE-11D9-BED3-505054503030"
|
"0CCE9236-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Add or Remove Computer from DC"
|
"title": "Add or Remove Computer from DC"
|
||||||
@@ -3035,9 +2947,6 @@
|
|||||||
"id": "00f253a0-1035-e450-7f6e-e2291dee27ec",
|
"id": "00f253a0-1035-e450-7f6e-e2291dee27ec",
|
||||||
"level": "informational",
|
"level": "informational",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE922F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE922F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE922F-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE922F-69AE-11D9-BED3-505054503030"
|
"0CCE922F-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "VSSAudit Security Event Source Registration"
|
"title": "VSSAudit Security Event Source Registration"
|
||||||
@@ -3050,9 +2959,9 @@
|
|||||||
"id": "7bd85790-c82a-56af-7127-f257e5ef6c6f",
|
"id": "7bd85790-c82a-56af-7127-f257e5ef6c6f",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030"
|
"0CCE921F-69AE-11D9-BED3-505054503030",
|
||||||
|
"0CCE921D-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Windows Defender Exclusion Deleted"
|
"title": "Windows Defender Exclusion Deleted"
|
||||||
},
|
},
|
||||||
@@ -3095,16 +3004,14 @@
|
|||||||
"event_ids": [
|
"event_ids": [
|
||||||
"4728",
|
"4728",
|
||||||
"4729",
|
"4729",
|
||||||
"4730",
|
|
||||||
"633",
|
"633",
|
||||||
"632",
|
"632",
|
||||||
"634"
|
"634",
|
||||||
|
"4730"
|
||||||
],
|
],
|
||||||
"id": "506379d9-8545-c010-e9a3-693119ab9261",
|
"id": "506379d9-8545-c010-e9a3-693119ab9261",
|
||||||
"level": "low",
|
"level": "low",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9237-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9237-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9237-69AE-11D9-BED3-505054503030"
|
"0CCE9237-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Group Modification Logging"
|
"title": "Group Modification Logging"
|
||||||
@@ -3136,18 +3043,16 @@
|
|||||||
{
|
{
|
||||||
"description": "Detects remote execution via scheduled task creation or update on the destination host",
|
"description": "Detects remote execution via scheduled task creation or update on the destination host",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
|
"4702",
|
||||||
"4624",
|
"4624",
|
||||||
"4698",
|
"4698"
|
||||||
"4702"
|
|
||||||
],
|
],
|
||||||
"id": "bc42c437-1ea8-fd0f-d964-e37a58d861fc",
|
"id": "bc42c437-1ea8-fd0f-d964-e37a58d861fc",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030",
|
"0CCE9227-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9226-69AE-11D9-BED3-505054503030",
|
"0CCE9226-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9227-69AE-11D9-BED3-505054503030"
|
"0CCE9215-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Remote Schtasks Creation"
|
"title": "Remote Schtasks Creation"
|
||||||
},
|
},
|
||||||
@@ -3219,8 +3124,8 @@
|
|||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE921F-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Stored Credentials in Fake Files"
|
"title": "Stored Credentials in Fake Files"
|
||||||
},
|
},
|
||||||
@@ -3232,8 +3137,8 @@
|
|||||||
"id": "30e70d43-6368-123c-a3c8-d23309a3ff97",
|
"id": "30e70d43-6368-123c-a3c8-d23309a3ff97",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE9215-69AE-11D9-BED3-505054503030",
|
"0CCE9217-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9217-69AE-11D9-BED3-505054503030"
|
"0CCE9215-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Multiple Users Remotely Failing To Authenticate From Single Source"
|
"title": "Multiple Users Remotely Failing To Authenticate From Single Source"
|
||||||
},
|
},
|
||||||
@@ -3250,8 +3155,8 @@
|
|||||||
{
|
{
|
||||||
"description": "Detects suspicious failed logins with different user accounts from a single source system",
|
"description": "Detects suspicious failed logins with different user accounts from a single source system",
|
||||||
"event_ids": [
|
"event_ids": [
|
||||||
"529",
|
"4625",
|
||||||
"4625"
|
"529"
|
||||||
],
|
],
|
||||||
"id": "428d3964-3241-1ceb-8f93-b31d8490c822",
|
"id": "428d3964-3241-1ceb-8f93-b31d8490c822",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
@@ -3269,10 +3174,10 @@
|
|||||||
"id": "a4504cb2-23f6-6d94-5ae6-d6013cf1d995",
|
"id": "a4504cb2-23f6-6d94-5ae6-d6013cf1d995",
|
||||||
"level": "medium",
|
"level": "medium",
|
||||||
"subcategory_guids": [
|
"subcategory_guids": [
|
||||||
"0CCE921D-69AE-11D9-BED3-505054503030",
|
|
||||||
"0CCE921E-69AE-11D9-BED3-505054503030",
|
"0CCE921E-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE921F-69AE-11D9-BED3-505054503030",
|
"0CCE921D-69AE-11D9-BED3-505054503030",
|
||||||
"0CCE9245-69AE-11D9-BED3-505054503030"
|
"0CCE9245-69AE-11D9-BED3-505054503030",
|
||||||
|
"0CCE921F-69AE-11D9-BED3-505054503030"
|
||||||
],
|
],
|
||||||
"title": "Suspicious Multiple File Rename Or Delete Occurred"
|
"title": "Suspicious Multiple File Rename Or Delete Occurred"
|
||||||
},
|
},
|
||||||
|
|||||||
Reference in New Issue
Block a user