Samirbous
d43e3d8e4e
* [New Rule] Suspicious Process Creation CallTrace * Update non-ecs-schema.json * added min stack vers * min_stack_vers not needed * Update rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> * Update rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
36 lines
1.0 KiB
JSON
36 lines
1.0 KiB
JSON
{
|
|
"endgame-*": {
|
|
"endgame": {
|
|
"metadata": {
|
|
"type": "keyword"
|
|
},
|
|
"event_subtype_full": "keyword"
|
|
}
|
|
},
|
|
"winlogbeat-*": {
|
|
"winlog.event_data.OriginalFileName": "keyword",
|
|
"winlog.event_data.GrantedAccess": "keyword",
|
|
"winlog.event_data.CallTrace": "keyword",
|
|
"powershell.file.script_block_text": "text",
|
|
"winlog.event_data.TargetProcessGUID": "keyword",
|
|
"powershell.file.script_block_text": "text",
|
|
"winlog.event_data.CallerProcessName": "keyword",
|
|
"winlog.event_data.TargetSid": "keyword",
|
|
"winlog.logon.type": "keyword",
|
|
"winlog.event_data.TargetLogonId": "keyword",
|
|
"winlog.event_data.SubjectLogonId": "keyword",
|
|
"winlog.event_data.TargetImage": "keyword",
|
|
"powershell.file.script_block_text": "text"
|
|
},
|
|
"filebeat-*": {
|
|
"o365.audit.NewValue": "keyword"
|
|
},
|
|
"logs-endpoint.events.*": {
|
|
"process.Ext.token.integrity_level_name": "keyword",
|
|
"process.parent.Ext.real.pid": "long"
|
|
},
|
|
"logs-windows.*": {
|
|
"powershell.file.script_block_text": "text"
|
|
}
|
|
}
|