security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1459 from JohnConnorRF/winlogbeat_scriptblock_logging

Browse Source 
Add ScriptBlockText to Winlogbeat Configs
This commit is contained in:
Florian Roth
2021-05-11 14:59:08 +02:00
committed by GitHub
parent 0fcbce9932 1574d263cc
commit b655c25f7a
3 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/config/winlogbeat-modules-enabled.yml
+1
View File
@@ -135,6 +135,7 @@ fieldmappings:
Product: winlog.event_data.Product
Properties: winlog.event_data.Properties
RuleName: winlog.event_data.RuleName
ScriptBlockText: powershell.file.script_block_text
SecurityID: winlog.event_data.SecurityID
ServiceFileName: winlog.event_data.ServiceFileName
ServiceName: winlog.event_data.ServiceName
tools/config/winlogbeat-old.yml
+1
View File
@@ -119,6 +119,7 @@ fieldmappings:
ProcessName: event_data.ProcessName
Product: event_data.Product
Properties: event_data.Properties
ScriptBlockText: winlog.event_data.ScriptBlockText
SecurityID: event_data.SecurityID
ServiceFileName: event_data.ServiceFileName
ServiceName: event_data.ServiceName
tools/config/winlogbeat.yml
+1
View File
@@ -125,6 +125,7 @@ fieldmappings:
Properties: winlog.event_data.Properties
RuleName: winlog.event_data.RuleName
SAMAccountName: winlog.event_data.SamAccountName
ScriptBlockText: winlog.event_data.ScriptBlockText
SecurityID: winlog.event_data.SecurityID
ServiceFileName: winlog.event_data.ServiceFileName
ServiceName: winlog.event_data.ServiceName