mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 17:58:52 +00:00
151 lines
4.5 KiB
YAML
151 lines
4.5 KiB
YAML
logsources:
|
|
windows-application:
|
|
product: windows
|
|
service: application
|
|
index: logs-endpoint-winevent-application-*
|
|
windows-security:
|
|
product: windows
|
|
service: security
|
|
index: logs-endpoint-winevent-security-*
|
|
windows-sysmon:
|
|
product: windows
|
|
service: sysmon
|
|
index: logs-endpoint-winevent-sysmon-*
|
|
windows-system:
|
|
product: windows
|
|
service: system
|
|
index: logs-endpoint-winevent-system-*
|
|
windows-wmi:
|
|
product: windows
|
|
service: wmi
|
|
index: logs-endpoint-winevent-wmiactivity-*
|
|
windows-powershell:
|
|
product: windows
|
|
service: powershell
|
|
index: logs-endpoint-winevent-powershell-*
|
|
windows-powershell-classic:
|
|
product: windows
|
|
service: powershell-classic
|
|
index: logs-endpoint-winevent-powershell-*
|
|
|
|
defaultindex: logs-*
|
|
fieldmappings:
|
|
AccessMask: object_access_mask_requested
|
|
AccountName: user_name
|
|
AllowedToDelegateTo: user_attribute_allowed_todelegate
|
|
AttributeLDAPDisplayName: dsobject_attribute_name
|
|
AuditPolicyChanges: policy_changes
|
|
AuthenticationPackageName: logon_authentication_package
|
|
CallingProcessName: process_path
|
|
CallTrace: process_call_trace
|
|
CommandLine: process_command_line
|
|
Company: file_company
|
|
ComputerName: host_name
|
|
Configuration:
|
|
EventID=16: sysmon_configuration
|
|
CurrentDirectory: process_current_directory
|
|
Description: file_description
|
|
Destination:
|
|
EventID=20: wmi_consumer_destination
|
|
DestinationHostname: dst_host_name
|
|
DestinationIp: dst_ip_addr
|
|
DestinationIsIpv6: dst_is_ipv6
|
|
DestinationPort: dst_port
|
|
DestinationPortName: dst_port_name
|
|
Details:
|
|
EventID=13: registry_key_value
|
|
Device: device_name
|
|
EngineVersion: powershell.engine.version
|
|
EventID: event_id
|
|
EventType: event_type
|
|
EventNamespace:
|
|
EventID=19: wmi_namespace
|
|
Filter:
|
|
EventID=21: wmi_filter_path
|
|
FailureCode: ticket_failure_code
|
|
FileName: file_name
|
|
FileVersion: file_version
|
|
GrantedAccess: process_granted_access
|
|
GroupName: group_name
|
|
HiveName: hive_name
|
|
HostVersion: powershell.host.version
|
|
Image: process_path
|
|
ImageLoaded:
|
|
EventID=6: driver_loaded
|
|
EventID=7: module_loaded
|
|
Imphash: hash_imphash
|
|
Initiated:
|
|
EventID=3: network_initiated"
|
|
IntegrityLevel:
|
|
EventID=1: process_integrity_level
|
|
LogonProcessName: logon_process_name
|
|
LogonType: logon_type
|
|
MachineName: host_name
|
|
Name:
|
|
EventID=19: wmi_name
|
|
EventID=20: wmi_name
|
|
NewProcessName: process_path
|
|
NewName:
|
|
EventID=14: registry_key_new_name
|
|
ObjectClass: dsobject_class
|
|
ObjectName: object_name
|
|
ObjectType: object_type
|
|
ObjectValueName: object_value_name
|
|
Operation:
|
|
EventID=19: wmi_operation
|
|
EventID=20: wmi_operation
|
|
EventID=21: wmi_operation
|
|
OperationType: object_operation_type
|
|
ParentImage: process_parent_path
|
|
PasswordLastSet: user_attribute_password_lastset
|
|
Path: process_path
|
|
ParentCommandLine: process_parent_command_line
|
|
PipeName: pipe_name
|
|
ProcessName: process_path
|
|
ProcesssCommandLine: process_command_line
|
|
Product: file_product
|
|
Properties: object_properties
|
|
Protocol:
|
|
EventID=3: network_protocol
|
|
Query:
|
|
EventID=19: wmi_query
|
|
RelativeTargetName: share_relative_target_name
|
|
SchemaVersion:
|
|
EventID=4: sysmon_schema_version
|
|
ServiceFileName: service_image_path
|
|
ServiceName: service_name
|
|
ShareName: share_name
|
|
Signature: signature
|
|
SignatureStatus: signature_status
|
|
Signed: signed
|
|
Source: source_name
|
|
SourceHostname: src_host_name
|
|
SourceImage: process_path
|
|
SourcePort: src_port
|
|
SourcePortName: src_port_name
|
|
StartAddress: thread_start_address
|
|
StartFunction: thread_start_function
|
|
StartModule: thread_start_module
|
|
Status: event_status
|
|
State:
|
|
EventID=4: service_state
|
|
EventID=16: sysmon_configuration_state
|
|
SubjectUserName:
|
|
EventID=4624: user_reporter_name
|
|
EventId=4648: user_name
|
|
EventID=5140: user_name
|
|
TargetFilename: file_name
|
|
TargetImage: target_process_path
|
|
TargetProcessAddress: thread_start_address
|
|
TargetObject: registry_key_path
|
|
TaskName: task_name
|
|
TicketEncryptionType: ticket_encryption_type
|
|
TicketOptions: ticket_options
|
|
Type:
|
|
EventID=20: wmi_consumer_type
|
|
User: user_account
|
|
UserName: user_name
|
|
Version:
|
|
EventID=4: sysmon_version
|
|
Workstation: src_host_name
|
|
WorkstationName: src_host_name |