rules/windows/builtin/application/win_builtin_remove_application.yml

title: Application Uninstalled
id: 570ae5ec-33dc-427c-b815-db86228ad43e
status: experimental
description: An application has been removed. Check if it is critical.
author: frack113
date: 2022/01/28
modified: 2022/09/17
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name: 'MsiInstaller'
        EventID:
            - 11724
            - 1034
    condition: selection
falsepositives:
    - Unknown
#Level is low as it can be very verbose, you can use the top or less 10 "Product Name" to have a quick overview
level: low
tags:
    - attack.impact
    - attack.t1489
update application uninstalled rule 2022-09-17 07:46:31 +09:00			`title: Application Uninstalled`
$frack113$ Add windows redcannary rules 2022-01-28 16:12:38 +01:00			`id: 570ae5ec-33dc-427c-b815-db86228ad43e`
			`status: experimental`
update application uninstalled rule 2022-09-17 07:46:31 +09:00			`description: An application has been removed. Check if it is critical.`
$frack113$ Add windows redcannary rules 2022-01-28 16:12:38 +01:00			`author: frack113`
			`date: 2022/01/28`
update application uninstalled rule 2022-09-17 07:46:31 +09:00			`modified: 2022/09/17`
$frack113$ Add windows redcannary rules 2022-01-28 16:12:38 +01:00			`logsource:`
			`product: windows`
			`service: application`
			`detection:`
			`selection:`
			`Provider_Name: 'MsiInstaller'`
			`EventID:`
			`- 11724`
			`- 1034`
			`condition: selection`
			`falsepositives:`
			`- Unknown`
$frack113$ Update win_builtin_remove_application.yml 2022-09-23 07:14:31 +02:00			`#Level is low as it can be very verbose, you can use the top or less 10 "Product Name" to have a quick overview`
Keep at level: low 2022-09-23 03:37:00 +09:00			`level: low`
$frack113$ Add windows redcannary rules 2022-01-28 16:12:38 +01:00			`tags:`
			`- attack.impact`
			`- attack.t1489`