valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

convert eventID to category

Browse Source
This commit is contained in:
frack113 2021-06-10 16:36:14 +02:00
parent cd2792f82c
commit 7cb10b5475
1 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
rules/windows/sysmon/sysmon_config_modification.yml
View File

@ -1,32 +1,38 @@
action: global
title: Sysmon Configuration Modification title: Sysmon Configuration Modification
id: 1f2b5353-573f-4880-8e33-7d04dcf97744 id: 1f2b5353-573f-4880-8e33-7d04dcf97744
description: Someone try to hide from Sysmon description: Someone try to hide from Sysmon
status: experimental status: experimental
author: frack113 author: frack113
date: 2021/06/04 date: 2021/06/04
modified: 2021/06/10
references: references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
- https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
tags: tags:
- attack.defense_evasion - attack.defense_evasion
- attack.t1564 - attack.t1564
falsepositives:
- legitimate administrative action
level: high
---
logsource: logsource:
product: windows product: windows
service: sysmon category: sysmon_status
detection: detection:
selection_stop: selection_stop:
EventID: 4
State: Stopped State: Stopped
selection_conf: selection_conf:
EventID: 16
message|startswith: message|startswith:
- 'Sysmon config state changed' - 'Sysmon config state changed'
condition: selection_stop or selection_conf
---
logsource:
product: windows
category: sysmon_error
detection:
selection_error: selection_error:
EventID: 255
Description|contains: Description|contains:
- 'Failed to open service configuration with error' - 'Failed to open service configuration with error'
- 'Failed to connect to the driver to update configuration' - 'Failed to connect to the driver to update configuration'
condition: 1 of them condition: selection_error
falsepositives:
- legitimate administrative action
level: high