--- name: Chainsaw's groupless Sigma mappings for Event Logs kind: evtx rules: sigma exclusions: - Defense evasion via process reimaging - Exports Registry Key To an Alternate Data Stream - NetNTLM Downgrade Attack - Non Interactive PowerShell - Wuauclt Network Connection - Raw Disk Access Using Illegitimate Tools - Executable in ADS - Space After Filename - macOS - Execution Of Non-Existing File - Execution of Suspicious File Type Extension - Execution from Suspicious Folder - Process Start From Suspicious Folder - Setting Change in Windows Firewall with Advanced Security - Group Modification Logging - WMI Event Subscription - USB Device Plugged extensions: preconditions: - for: logsource.category: process_creation filter: - Provider: Microsoft-Windows-Sysmon int(EventID): 1 - Provider: Microsoft-Windows-Security-Auditing int(EventID): 4688 - for: logsource.category: network_connection filter: Provider: Microsoft-Windows-Sysmon int(EventID): 3 - for: logsource.category: sysmon_status filter: Provider: Microsoft-Windows-Sysmon int(EventID): - 4 - 16 - for: logsource.category: process_termination filter: Provider: Microsoft-Windows-Sysmon int(EventID): 5 - for: logsource.category: driver_load filter: Provider: Microsoft-Windows-Sysmon int(EventID): 6 - for: logsource.category: image_load filter: Provider: Microsoft-Windows-Sysmon int(EventID): 7 - for: logsource.category: create_remote_thread filter: Provider: Microsoft-Windows-Sysmon int(EventID): 8 - for: logsource.category: raw_access_thread filter: Provider: Microsoft-Windows-Sysmon int(EventID): 9 - for: logsource.category: process_access filter: Provider: Microsoft-Windows-Sysmon int(EventID): 10 - for: logsource.category: file_event filter: Provider: Microsoft-Windows-Sysmon int(EventID): 11 - for: logsource.category: registry_event filter: Provider: Microsoft-Windows-Sysmon int(EventID): - 12 - 13 - 14 - for: logsource.category: registry_add filter: Provider: Microsoft-Windows-Sysmon int(EventID): 12 - for: logsource.category: registry_delete filter: Provider: Microsoft-Windows-Sysmon int(EventID): 12 - for: logsource.category: registry_set filter: Provider: Microsoft-Windows-Sysmon int(EventID): 13 - for: logsource.category: registry_rename filter: Provider: Microsoft-Windows-Sysmon int(EventID): 14 - for: logsource.category: create_stream_hash filter: Provider: Microsoft-Windows-Sysmon int(EventID): 15 - for: logsource.category: pipe_created filter: Provider: Microsoft-Windows-Sysmon int(EventID): - 17 - 18 - for: logsource.category: wmi_event filter: Provider: Microsoft-Windows-Sysmon int(EventID): - 19 - 20 - 21 - for: logsource.category: dns_query filter: Provider: Microsoft-Windows-Sysmon int(EventID): 22 - for: logsource.category: file_delete filter: Provider: Microsoft-Windows-Sysmon int(EventID): 23 - for: logsource.category: clipboard_change filter: Provider: Microsoft-Windows-Sysmon int(EventID): 24 - for: logsource.category: process_tampering filter: Provider: Microsoft-Windows-Sysmon int(EventID): 25 - for: logsource.category: file_delete_detected filter: Provider: Microsoft-Windows-Sysmon int(EventID): 26 - for: logsource.category: file_block filter: Provider: Microsoft-Windows-Sysmon int(EventID): 27 - for: logsource.category: file_block_executable filter: Provider: Microsoft-Windows-Sysmon int(EventID): 27 - for: logsource.category: file_block_shredding filter: Provider: Microsoft-Windows-Sysmon int(EventID): 28 - for: logsource.category: file_executable_detected filter: Provider: Microsoft-Windows-Sysmon int(EventID): 29 - for: logsource.category: sysmon_error filter: Provider: Microsoft-Windows-Sysmon int(EventID): 255 - for: logsource.service: windefend filter: Provider: Microsoft-Windows-Windows Defender - for: logsource.service: sysmon filter: Provider: Microsoft-Windows-Sysmon - for: logsource.service: capi2 filter: Provider: Microsoft-Windows-CAPI2 - for: logsource.service: applocker filter: Provider: Microsoft-Windows-AppLocker - for: logsource.service: codeintegrity-operational filter: Provider: Microsoft-Windows-CodeIntegrity - for: logsource.service: firewall-as filter: Provider: Microsoft-Windows-Windows Firewall With Advanced Security - for: logsource.service: security filter: Provider: Microsoft-Windows-Security-Auditing - for: logsource.service: appxdeployment-server filter: Provider: Microsoft-Windows-AppXDeployment-Server - for: logsource.service: bits-client filter: Provider: Microsoft-Windows-Bits-Client - for: logsource.service: certificateservicesclient-lifecycle-system filter: Provider: Microsoft-Windows-CertificateServicesClient-Lifecycle-System - for: logsource.service: ntlm filter: Provider: Microsoft-Windows-NTLM - for: logsource.service: smbclient-security filter: Provider: Microsoft-Windows-SMBClient - for: logsource.service: smbclient-connectivity filter: Provider: Microsoft-Windows-SMBClient - for: logsource.service: appmodel-runtime filter: Provider: Microsoft-Windows-AppModel-Runtime - for: logsource.service: security-mitigations filter: Provider: Microsoft-Windows-Security-Mitigations - for: logsource.service: taskscheduler filter: Provider: Microsoft-Windows-TaskScheduler - for: logsource.service: wmi filter: Provider: Microsoft-Windows-WMI-Activity - for: logsource.service: dhcp filter: Provider: Microsoft-Windows-DHCP-Server - for: logsource.service: printservice-admin filter: Provider: Microsoft-Windows-PrintService - for: logsource.service: printservice-operational filter: Provider: Microsoft-Windows-PrintService - for: logsource.service: terminalservices-localsessionmanager filter: Provider: Microsoft-Windows-TerminalServices-LocalSessionManager - for: logsource.service: diagnosis-scripted filter: Provider: Microsoft-Windows-Diagnosis-Scripted - for: logsource.service: shell-core filter: Provider: Microsoft-Windows-Shell-Core - for: logsource.service: openssh filter: Provider: OpenSSH - for: logsource.service: ldap filter: Provider: Microsoft-Windows-LDAP-Client - for: logsource.service: ldap_debug filter: Provider: Microsoft-Windows-LDAP-Client - for: logsource.service: dns-client filter: Provider: Microsoft-Windows-DNS-Client - for: logsource.service: dns-server filter: Provider: Microsoft-Windows-DNS-Server-Service - for: logsource.service: appxpackaging-om filter: Provider: Microsoft-Windows-AppxPackagingOM - for: logsource.service: lsa-server filter: Provider: LsaSrv - for: logsource.service: kernel-shimengine filter: Provider: Microsoft-Windows-Kernel-ShimEngine - for: logsource.service: application-experience filter: Provider: Microsoft-Windows-Application-Experience - for: logsource.service: ntfs filter: Provider: Microsoft-Windows-Ntfs - for: logsource.service: hyper-v-worker filter: Provider: Microsoft-Windows-Hyper-V-Worker - for: logsource.service: driver-framework filter: Provider: Microsoft-Windows-DriverFrameworks-UserMode - for: logsource.service: msexchange-management filter: Provider: MSExchange CmdletLogs - for: id: 4a3a2b96-d7fc-4cb9-80e4-4a545fe95f46 #Remote Service Creation Rule filter: - Provider: Microsoft-Windows-Security-Auditing - Provider: System groups: - name: Sigma timestamp: Event.System.TimeCreated filter: Provider: "*" fields: - from: Provider to: Event.System.Provider - name: Event ID from: EventID to: Event.System.EventID - name: Record ID from: EventRecordID to: Event.System.EventRecordID - name: Computer from: Computer to: Event.System.Computer - name: Event Data from: EventData to: Event.EventData - from: AccessList to: Event.EventData.AccessList visible: false - from: AccessMask to: Event.EventData.AccessMask visible: false - from: Accesses to: Event.EventData.Accesses visible: false - from: AccountName to: Event.EventData.AccountName visible: false - from: Action to: Event.EventData.Action visible: false - from: Address to: Event.EventData.Address visible: false - from: AllowedToDelegateTo to: Event.EventData.AllowedToDelegateTo visible: false - from: Application to: Event.EventData.Application visible: false - from: ApplicationPath to: Event.EventData.ApplicationPath visible: false - from: AttributeLDAPDisplayName to: Event.EventData.AttributeLDAPDisplayName visible: false - from: AttributeValue to: Event.EventData.AttributeValue visible: false - from: AuditPolicyChanges to: Event.EventData.AuditPolicyChanges visible: false - from: AuditSourceName to: Event.EventData.AuditSourceName visible: false - from: AuthenticationPackageName to: Event.EventData.AuthenticationPackageName visible: false - from: CallTrace to: Event.EventData.CallTrace visible: false - from: CallerProcessName to: Event.EventData.CallerProcessName visible: false - from: Caption to: Event.EventData.Caption visible: false - from: CertThumbprint to: Event.EventData.CertThumbprint visible: false - from: Channel to: Event.System.Channel visible: false - from: ClassName to: Event.EventData.ClassName visible: false - from: CommandLine to: Event.EventData.CommandLine visible: false - from: Commandline to: Event.EventData.Commandline visible: false - from: Company to: Event.EventData.Company visible: false - from: ContextInfo to: Event.EventData.ContextInfo visible: false - from: CurrentDirectory to: Event.EventData.CurrentDirectory visible: false - from: Description to: Event.EventData.Description visible: false - from: DestAddress to: Event.EventData.DestAddress visible: false - from: DestPort to: Event.EventData.DestPort visible: false - from: Destination to: Event.EventData.Destination visible: false - from: DestinationHostname to: Event.EventData.DestinationHostname visible: false - from: DestinationIp to: Event.EventData.DestinationIp visible: false - from: DestinationIsIpv6 to: Event.EventData.DestinationIsIpv6 visible: false - from: DestinationPort to: Event.EventData.DestinationPort visible: false - from: Details to: Event.EventData.Details visible: false - from: Device to: Event.EventData.Device visible: false - from: DeviceDescription to: Event.EventData.DeviceDescription visible: false - from: DeviceName to: Event.EventData.DeviceName visible: false - from: EngineVersion to: Event.EventData.EngineVersion visible: false - from: ErrorCode to: Event.EventData.ErrorCode visible: false - from: EventType to: Event.EventData.EventType visible: false - from: FailureCode to: Event.EventData.FailureCode visible: false - from: FileName to: Event.EventData.FileName visible: false - from: FileVersion to: Event.EventData.FileVersion visible: false - from: GrantedAccess to: Event.EventData.GrantedAccess visible: false - from: Hashes to: Event.EventData.Hashes visible: false - from: HiveName to: Event.EventData.HiveName visible: false - from: HostApplication to: Event.EventData.HostApplication visible: false - from: HostName to: Event.EventData.HostName visible: false - from: HostVersion to: Event.EventData.HostVersion visible: false - from: Image to: Event.EventData.Image visible: false - from: ImageFileName to: Event.EventData.ImageFileName visible: false - from: ImageLoaded to: Event.EventData.ImageLoaded visible: false - from: ImagePath to: Event.EventData.ImagePath visible: false - from: Imphash to: Event.EventData.Imphash visible: false - from: Initiated to: Event.EventData.Initiated visible: false - from: IntegrityLevel to: Event.EventData.IntegrityLevel visible: false - from: IpAddress to: Event.EventData.IpAddress visible: false - from: KeyLength to: Event.EventData.KeyLength visible: false - from: Keywords to: Event.System.Keywords visible: false - from: LayerRTID to: Event.EventData.LayerRTID visible: false - from: Level to: Event.System.Level visible: false - from: LocalName to: Event.EventData.LocalName visible: false - from: LogonId to: Event.EventData.LogonId visible: false - from: LogonProcessName to: Event.EventData.LogonProcessName visible: false - from: LogonType to: Event.EventData.LogonType visible: false - from: Message to: Event.EventData.Message visible: false - from: ModifyingApplication to: Event.EventData.ModifyingApplication visible: false - from: NewName to: Event.EventData.NewName visible: false - from: NewTargetUserName to: Event.EventData.NewTargetUserName visible: false - from: NewTemplateContent to: Event.EventData.NewTemplateContent visible: false - from: NewUacValue to: Event.EventData.NewUacValue visible: false - from: NewValue to: Event.EventData.NewValue visible: false - from: ObjectClass to: Event.EventData.ObjectClass visible: false - from: ObjectName to: Event.EventData.ObjectName visible: false - from: ObjectServer to: Event.EventData.ObjectServer visible: false - from: ObjectType to: Event.EventData.ObjectType visible: false - from: ObjectValueName to: Event.EventData.ObjectValueName visible: false - from: OldTargetUserName to: Event.EventData.OldTargetUserName visible: false - from: OldUacValue to: Event.EventData.OldUacValue visible: false - from: Origin to: Event.EventData.Origin visible: false - from: OriginalFileName to: Event.EventData.OriginalFileName visible: false - from: OriginalFilename to: Event.EventData.OriginalFilename visible: false - from: OriginalName to: Event.EventData.OriginalName visible: false - from: ParentCommandLine to: Event.EventData.ParentCommandLine visible: false - from: ParentImage to: Event.EventData.ParentImage visible: false - from: ParentUser to: Event.EventData.ParentUser visible: false - from: PasswordLastSet to: Event.EventData.PasswordLastSet visible: false - from: Path to: Event.EventData.Path visible: false - from: Payload to: Event.EventData.Payload visible: false - from: PipeName to: Event.EventData.PipeName visible: false - from: PossibleCause to: Event.EventData.PossibleCause visible: false - from: PrivilegeList to: Event.EventData.PrivilegeList visible: false - from: ProcessId to: Event.EventData.ProcessId visible: false - from: ProcessName to: Event.EventData.ProcessName visible: false - from: Product to: Event.EventData.Product visible: false - from: Properties to: Event.EventData.Properties visible: false - from: ProviderName to: Event.System.Provider visible: false - from: Provider_Name to: Event.System.Provider visible: false - from: QNAME to: Event.EventData.QNAME visible: false - from: Query to: Event.EventData.Query visible: false - from: QueryName to: Event.EventData.QueryName visible: false - from: QueryResults to: Event.EventData.QueryResults visible: false - from: QueryStatus to: Event.EventData.QueryStatus visible: false - from: RelativeTargetName to: Event.EventData.RelativeTargetName visible: false - from: RemoteAddress to: Event.EventData.RemoteAddress visible: false - from: RemoteName to: Event.EventData.RemoteName visible: false - from: SamAccountName to: Event.EventData.SamAccountName visible: false - from: ScriptBlockText to: Event.EventData.ScriptBlockText visible: false - from: SearchFilter to: Event.EventData.SearchFilter visible: false - from: ServerName to: Event.EventData.ServerName visible: false - from: Service to: Event.EventData.Service visible: false - from: ServiceFileName to: Event.EventData.ServiceFileName visible: false - from: ServiceName to: Event.EventData.ServiceName visible: false - from: ServicePrincipalNames to: Event.EventData.ServicePrincipalNames visible: false - from: ServiceStartType to: Event.EventData.ServiceStartType visible: false - from: ServiceType to: Event.EventData.ServiceType visible: false - from: ShareName to: Event.EventData.ShareName visible: false - from: SidHistory to: Event.EventData.SidHistory visible: false - from: Signed to: Event.EventData.Signed visible: false - from: SourceAddress to: Event.EventData.SourceAddress visible: false - from: SourceImage to: Event.EventData.SourceImage visible: false - from: SourceIp to: Event.EventData.SourceIp visible: false - from: SourcePort to: Event.EventData.SourcePort visible: false - from: Source_Name to: Event.EventData.Source_Name visible: false - from: StartAddress to: Event.EventData.StartAddress visible: false - from: StartFunction to: Event.EventData.StartFunction visible: false - from: StartModule to: Event.EventData.StartModule visible: false - from: State to: Event.EventData.State visible: false - from: Status to: Event.EventData.Status visible: false - from: SubjectDomainName to: Event.EventData.SubjectDomainName visible: false - from: SubjectLogonId to: Event.EventData.SubjectLogonId visible: false - from: SubjectUserName to: Event.EventData.SubjectUserName visible: false - from: SubjectUserSid to: Event.EventData.SubjectUserSid visible: false - from: TargetFilename to: Event.EventData.TargetFilename visible: false - from: TargetImage to: Event.EventData.TargetImage visible: false - from: TargetLogonId to: Event.EventData.TargetLogonId visible: false - from: TargetName to: Event.EventData.TargetName visible: false - from: TargetObject to: Event.EventData.TargetObject visible: false - from: TargetParentProcessId to: Event.EventData.TargetParentProcessId visible: false - from: TargetPort to: Event.EventData.TargetPort visible: false - from: TargetServerName to: Event.EventData.TargetServerName visible: false - from: TargetSid to: Event.EventData.TargetSid visible: false - from: TargetUserName to: Event.EventData.TargetUserName visible: false - from: TargetUserSid to: Event.EventData.TargetUserSid visible: false - from: TaskName to: Event.EventData.TaskName visible: false - from: TemplateContent to: Event.EventData.TemplateContent visible: false - from: TicketEncryptionType to: Event.EventData.TicketEncryptionType visible: false - from: TicketOptions to: Event.EventData.TicketOptions visible: false - from: Type to: Event.EventData.Type visible: false - from: User to: Event.EventData.User visible: false - from: UserName to: Event.EventData.UserName visible: false - from: Value to: Event.EventData.Value visible: false - from: Workstation to: Event.EventData.Workstation visible: false - from: WorkstationName to: Event.EventData.WorkstationName visible: false - from: param1 to: Event.EventData.param1 visible: false - from: param2 to: Event.EventData.param2 visible: false - from: processPath to: Event.EventData.processPath visible: false - from: sha1 to: Event.EventData.sha1 visible: false - from: PreAuthType to: int(Event.EventData.PreAuthType) visible: false