security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

fix: Rewrite another message rule

Browse Source 
Rewrites another message rule. This one is a bit more complex
since a bitmap is used and the string representation is not
available.
This commit is contained in:
Max Altgelt
2021-08-13 10:28:34 +02:00
parent 6f05e33feb
commit e1ef8f4055
1 changed files with 61 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/builtin/win_alert_enable_weak_encryption.yml
+61 -9
View File
@@ -17,15 +17,67 @@ logsource:
detection:
selection:
EventID: 4738
keywords:
Message|contains:
- 'DES'
- 'Preauth'
- 'Encrypted'
filters:
Message|contains:
- 'Enabled'
condition: selection and keywords and filters
olduac_des: # 0x8000
OldUacValue|endswith:
- 8???
- 9???
- A???
- B???
- C???
- D???
- E???
- F???
newuac_des:
NewUacValue|endswith:
- 8???
- 9???
- A???
- B???
- C???
- D???
- E???
- F???
olduac_preauth: # 0x10000
OldUacValue|endswith:
- 1????
- 3????
- 5????
- 7????
- 9????
- B????
- D????
- F????
newuac_preauth:
NewUacValue|endswith:
- 1????
- 3????
- 5????
- 7????
- 9????
- B????
- D????
- F????
olduac_encrypted: # 0x800
OldUacValue|endswith:
- 8??
- 9??
- A??
- B??
- C??
- D??
- E??
- F??
newuac_encrypted:
NewUacValue|endswith:
- 8??
- 9??
- A??
- B??
- C??
- D??
- E??
- F??
condition: selection and ((newuac_des and not olduac_des) or (newuac_preauth and not olduac_preauth) or (newuac_encrypted and not olduac_encrypted))
falsepositives:
- Unknown
level: high