61600 ^1$ Sysmon - Event 1: Process creation $(win.eventdata.description) no_full_log sysmon_event1, 61600 ^2$ Sysmon - Event 2: $(win.eventdata.image) changed file $(win.eventdata.targetFilename) creation time no_full_log sysmon_event2, 61600 ^3$ Sysmon - Event 3: Network connection to $(win.eventdata.destinationIp):$(win.eventdata.destinationPort) by $(win.eventdata.image) no_full_log sysmon_event3, 61600 ^4$ Sysmon - Event 4: Sysmon service state changed to "$(win.eventdata.state)" no_full_log sysmon_event4, 61600 ^5$ Sysmon - Event 5: Process terminated $(win.eventdata.image) no_full_log sysmon_event5, 61600 ^6$ Sysmon - Event 6: Driver loaded $(win.eventdata.imageLoaded) no_full_log sysmon_event6, 61600 ^7$ Sysmon - Event 7: Image $(win.eventdata.imageLoaded) loaded by $(win.eventdata.image) no_full_log sysmon_event7, 61600 ^8$ Sysmon - Event 8: CreateRemoteThread by $(win.eventdata.sourceImage) on $(win.eventdata.targetImage), possible process injection no_full_log sysmon_event8, 61600 ^9$ Sysmon - Event 9: RawAccessRead by $(win.eventdata.image) no_full_log sysmon_event9, 61600 ^10$ Sysmon - Event 10: $(win.eventdata.targetImage) process accessed by $(win.eventdata.sourceImage) no_full_log sysmon_event_10, 61600 ^11$ Sysmon - Event 11: FileCreate by $(win.eventdata.image) no_full_log sysmon_event_11, 61600 ^12$ Sysmon - Event 12: RegistryEvent $(win.eventdata.eventType) on $(win.eventdata.targetObject) by $(win.eventdata.image) no_full_log sysmon_event_12, 61600 ^13$ Sysmon - Event 13: RegistryEvent $(win.eventdata.eventType) on $(win.eventdata.targetObject) by $(win.eventdata.image) no_full_log sysmon_event_13, 61600 ^14$ Sysmon - Event 14: RegistryEvent (Key and Value Rename) by $(win.eventdata.image) no_full_log sysmon_event_14, 61600 ^15$ Sysmon - Event 15: $(win.eventdata.targetFilename) FileCreateStreamHash by process $(win.eventdata.image) no_full_log sysmon_event_15, 61600 ^16$ Sysmon - Event 16: Sysmon configuration changed using file $(win.eventdata.configuration) sysmon_event_16, 61600 ^17$ Sysmon - Event 17: Pipe created no_full_log sysmon_event_17, 61600 ^18$ Sysmon - Event 18: Pipe connected no_full_log sysmon_event_18, 61600 ^19$ Sysmon - Event 19: WmiEventFilter activity no_full_log sysmon_event_19, 61600 ^20$ Sysmon - Event 20: WmiEventConsumer activity no_full_log sysmon_event_20, 61600 ^21$ Sysmon - Event 21: WmiEventConsumerToFilter activity no_full_log sysmon_event_21, 61600 ^22$ Sysmon - Event 22: DNS Query event no_full_log sysmon_event_22, 61600 ^23$ Sysmon - Event 23: File deleted and archived no_full_log sysmon_event_23, 61600 ^24$ Sysmon - Event 24: Clipboard change no_full_log sysmon_event_24, 61600 ^25$ Sysmon - Event 25: Process tampering - Image change no_full_log sysmon_event_25, 61600 ^26$ Sysmon - Event 26: File deleted no_full_log sysmon_event_26, 61600 ^255$ Sysmon - Event 255: Sysmon error no_full_log sysmon_event_255, json misp Default rule for MISP Events 100620 MISP error MISP error 100620 \.+ MISP - IoC found in Threat Intel - Attribute: domain $(ioc.domain) - Event: $(misp_response.domain.event_info) 100620 \.+ MISP - IoC found in Threat Intel - Attribute: hash $(ioc.sha256) - Event: $(misp_response.sha256.event_info) 100620 \.+ MISP - IoC found in Threat Intel - Attribute: hash $(ioc.sha1) - Event: $(misp_response.sha1.event_info)