-
Notifications
You must be signed in to change notification settings - Fork 428
XML Windows Event Log Cleanup #3578
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Experimenting with the detection in #3566, as its a known case of using multiline Windows Event Logs... and it appears that in the XML format, the manipulation of the "Don't Require Preauth" setting on an account does not produce an event with a field specific to that, but you'd have to determine that was the change from the difference in the OldUacValue and the NewUacValue. Which seems... less than ideal, as a single event gets created no matter how many changes are made at once, further complicating any math that would need to be done.
List of codes: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec
I seem to recall Splunk adding some bitwise functions and operators in the last few versions, evaluating if these could make this less painful.
Okay, re: #3566
Looks like the UserAccountControl field contains a space-delimited list of configurations that were changed (well, sorta) and for no longer requiring preauth, we're looking for %%2096 to be in the list.
Non-removed detections with WinEventLog as a sourcetype for at least one attack_data file:
- detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
- detections/endpoint/detect_new_local_admin_account.yml
- detections/endpoint/disable_show_hidden_files.yml
- detections/endpoint/disabling_systemrestore_in_registry.yml
- detections/endpoint/print_spooler_adding_a_printer_driver.yml
- detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
- detections/endpoint/schedule_task_with_http_command_arguments.yml
- detections/endpoint/schedule_task_with_rundll32_command_trigger.yml
- detections/endpoint/short_lived_scheduled_task.yml
- detections/endpoint/short_lived_windows_accounts.yml
- detections/endpoint/unknown_process_using_the_kerberos_protocol.yml
- detections/endpoint/windows_rdpclient_connection_sequence_events.yml
Details
We've "declared victory" on using
XmlWinEventLoginstead of the classic multilineWinEventLogseveral times in the past, and we're still finding gaps. This PR will include all of the remaining cleanup, including altering the source macros to no longer reference the WinEventLog source or sourcetypes.Checklist
<platform>_<mitre att&ck technique>_<short description>nomenclatureNotes For Submitters and Reviewers
buildCI job when it fails will likely show an error about what is failing. You may have a very descriptive error of the specific field(s) in the specific file(s) that is causing an issue. In some cases, its also possible there is an issue with the YAML. Many of these can be caught with the pre-commit hooks if you set them up. These errors will be less descriptive as to what exactly is wrong, but will give you a column and row position in a specific file where the YAML processing breaks. If you're having trouble with this, feel free to add a comment to your PR tagging one of the maintainers and we'll be happy to help troubleshoot it.