Mika Ayenson
aab23636e8
* Add new event_data fields (ObjectName, ProcessName)
* Add detection for LSASS Memory Dump Handle Access
* Reference an example of 120089 AccessMask presence
* modify query to increase performance and update the description to remove ("This rule").
* expand path to Elastic Agent ensure syntax consistency
* Optimize rule based on AccessMaskDescription and additional False Positives.
* add AccessMaskDescription keyword and rule tune to make sure AccessMask is used
* filter dllhost.exe and or the condition between AccessMask and AccessMaskDescription
* cleanup
(cherry picked from commit aa7d79cc53)
58 lines
1.7 KiB
JSON
58 lines
1.7 KiB
JSON
{
|
|
"endgame-*": {
|
|
"endgame": {
|
|
"metadata": {
|
|
"type": "keyword"
|
|
},
|
|
"event_subtype_full": "keyword"
|
|
}
|
|
},
|
|
"winlogbeat-*": {
|
|
"winlog": {
|
|
"event_data": {
|
|
"AccessList": "keyword",
|
|
"AccessMask": "keyword",
|
|
"AccessMaskDescription": "keyword",
|
|
"AllowedToDelegateTo": "keyword",
|
|
"AttributeLDAPDisplayName": "keyword",
|
|
"AttributeValue": "keyword",
|
|
"CallerProcessName": "keyword",
|
|
"CallTrace": "keyword",
|
|
"ClientProcessId": "keyword",
|
|
"GrantedAccess": "keyword",
|
|
"NewTargetUserName": "keyword",
|
|
"ObjectDN": "keyword",
|
|
"ObjectName": "keyword",
|
|
"OldTargetUserName": "keyword",
|
|
"OriginalFileName": "keyword",
|
|
"ParentProcessId": "keyword",
|
|
"ProcessName": "keyword",
|
|
"Properties": "keyword",
|
|
"RelativeTargetName": "keyword",
|
|
"ShareName": "keyword",
|
|
"SubjectLogonId": "keyword",
|
|
"SubjectUserName": "keyword",
|
|
"TargetImage": "keyword",
|
|
"TargetLogonId": "keyword",
|
|
"TargetProcessGUID": "keyword",
|
|
"TargetSid": "keyword"
|
|
}
|
|
},
|
|
"winlog.logon.type": "keyword",
|
|
"powershell.file.script_block_text": "text"
|
|
},
|
|
"filebeat-*": {
|
|
"o365.audit.NewValue": "keyword",
|
|
"o365audit.Parameters.ForwardTo": "keyword",
|
|
"o365audit.Parameters.ForwardAsAttachmentTo": "keyword",
|
|
"o365audit.Parameters.RedirectTo": "keyword"
|
|
},
|
|
"logs-endpoint.events.*": {
|
|
"process.Ext.token.integrity_level_name": "keyword",
|
|
"process.parent.Ext.real.pid": "long"
|
|
},
|
|
"logs-windows.*": {
|
|
"powershell.file.script_block_text": "text"
|
|
}
|
|
}
|