security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update discovery_privileged_localgroup_membership.toml (#2046)

Browse Source
This commit is contained in:
Jonhnathan
2022-06-30 14:26:17 -03:00
committed by GitHub
parent 1bb2273c0c
commit 853f8db8d0
1 changed files with 23 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/discovery_privileged_localgroup_membership.toml
+23 -21
View File
@@ -1,7 +1,7 @@
[metadata]
creation_date = "2020/10/15"
maturity = "production"
updated_date = "2022/04/21"
updated_date = "2022/06/20"
[rule]
author = ["Elastic"]
@@ -93,27 +93,29 @@ type = "eql"
query = '''
iam where event.action == "user-member-enumerated" and
/* noisy and usual legit processes excluded */
not winlog.event_data.CallerProcessName:
("?:\\Windows\\System32\\VSSVC.exe",
"?:\\Windows\\System32\\SearchIndexer.exe",
"?:\\Windows\\System32\\CompatTelRunner.exe",
"?:\\Windows\\System32\\oobe\\msoobe.exe",
"?:\\Windows\\System32\\net1.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\Netplwiz.exe",
"?:\\Windows\\System32\\msiexec.exe",
"?:\\Windows\\System32\\CloudExperienceHostBroker.exe",
"?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"?:\\Windows\\System32\\SrTasks.exe",
"?:\\Windows\\System32\\lsass.exe",
"?:\\Windows\\System32\\diskshadow.exe",
"?:\\Windows\\System32\\dfsrs.exe",
"?:\\Program Files\\*.exe",
"?:\\Program Files (x86)\\*.exe") and
/* noisy and usual legit processes excluded */
not winlog.event_data.CallerProcessName:
("?:\\Windows\\System32\\VSSVC.exe",
"?:\\Windows\\System32\\SearchIndexer.exe",
"?:\\Windows\\System32\\CompatTelRunner.exe",
"?:\\Windows\\System32\\oobe\\msoobe.exe",
"?:\\Windows\\System32\\net1.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\Netplwiz.exe",
"?:\\Windows\\System32\\msiexec.exe",
"?:\\Windows\\System32\\CloudExperienceHostBroker.exe",
"?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
"?:\\Windows\\System32\\SrTasks.exe",
"?:\\Windows\\System32\\lsass.exe",
"?:\\Windows\\System32\\diskshadow.exe",
"?:\\Windows\\System32\\dfsrs.exe",
"?:\\Program Files\\*.exe",
"?:\\Program Files (x86)\\*.exe",
"?:\\WindowsAzure\\*\\WaAppAgent.exe") and
/* privileged local groups */
(group.name:("admin*","RemoteDesktopUsers") or
winlog.event_data.TargetSid:("S-1-5-32-544","S-1-5-32-555"))
(group.name:("admin*","RemoteDesktopUsers") or
winlog.event_data.TargetSid:("S-1-5-32-544","S-1-5-32-555"))
'''