Updated rules

rules/System/104_T1070.001_SystemLogCleared.yml

@@ -0,0 +1,19 @@
+title: System log file was cleared
+title_jp: システムログがクリアされた
+description: Somebody has cleared the System event log.
+description_jp: 誰かがシステムログをクリアした。
+author: Eric Conrad, Zach Mathis
+contributor: Akira Nishikawa, James Takai
+mitre_attack: T1070.001
+level: high
+detection:
+    selection:
+        Channel: System
+        EventID: 104
+    # condition: selection
+falsepositives:
+    - system administrator
+output: "User: %LogFileCleared%%SubjectUserName%"
+output_jp: "ユーザ名: %LogFileCleared%%SubjectUserName%"
+creation_date: 2020/11/08
+uodated_date:  2021/11/06

rules/System/7030.yml

@@ -0,0 +1,15 @@
+title: This service may not function properly
+description: hogehoge
+author: DeepblueCLI, Zach Mathis
+detection:
+    selection:
+        Channel: System
+        EventID: 7030
+        param1:
+            regexes: ./regexes.txt
+    # condition: selection
+falsepositives:
+    - unknown
+output: 'Interactive service warning¥nService name: %ServiceName%¥nMalware (and some third party software) trigger this warning'
+creation_date: 2020/11/8
+uodated_date: 2020/11/8

rules/System/7036.yml

@@ -0,0 +1,15 @@
+title: The ... service entered the stopped|running state
+description: hogehoge
+author: DeepblueCLI, Zach Mathis
+detection:
+    selection:
+        Channel: System
+        EventID: 7036
+        param1:
+            regexes: ./regexes.txt
+    condition: selection
+falsepositives:
+    - unknown
+output: 'Suspicious Service Name¥nService name: %ServiceName%'
+creation_date: 2020/11/8
+uodated_date: 2020/11/8

rules/System/7040.yml

@@ -0,0 +1,17 @@
+title: The start type of the Windows Event Log service was changed from auto start to disabled
+description: hogehoge
+author: DeepblueCLI, Zach Mathis
+detection:
+    selection:
+        Channel: System
+        EventID: 7040
+        param1: 'Windows Event Log'
+        param2: 
+          - "disabled"
+          - "auto start"
+    condition: selection
+falsepositives:
+    - unknown
+output: 'Service name : %param1%¥nMessage : Event Log Service Stopped¥nResults: Selective event log manipulation may follow this event.'
+creation_date: 2020/11/8
+uodated_date: 2020/11/8

rules/System/7045.yml

@@ -0,0 +1,18 @@
+title: A service was installed in the system
+description: hogehoge
+author: DeepblueCLI, Zach Mathis
+detection:
+    selection:
+        Channel: System
+        EventID: 7045
+        ServiceName:
+            regexes: ./regexes.txt
+        ImagePath:
+            min_length: 1000
+            whitelist: ./whitelist.txt
+    condition: selection
+falsepositives:
+    - unknown
+output: 'New Service Created¥n%ImagePath¥nService name: %ServiceName%'
+creation_date: 2020/11/8
+uodated_date: 2020/11/8