Query: Sigma rule for Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.
Matching passage: Sigma rule: Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.. Logsource: windows / security. Rule: title: Important Windows Event Auditing Disabled id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1 related: - id: 69aeb277-f15f-4d2d-b32a-55e883609563 type: derived status: test description: Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled. references: - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit - https://github.com/SigmaHQ/sigma/blob/ad1bfd3d28aa0ccc9656240f845022518ef65a2e/documentation/logsource-guides/windows/service/security.md author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-20 modified: 2023-11-17 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows service: security definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64 detection: selection_state_success_and_failure: EventID: 4719 SubcategoryGuid: - '{0CCE9210-69AE-11D9-BED3-505054503030}' - '{0CCE9211-69AE-11D9-BED3-505054503030}' - '{0CCE9212-69AE-11D9-BED3-505054503030}' - '{0CCE9215-69AE-11D9-BED3-505054503030}' - '{0CCE921B-69AE-11D9-BED3-505054503030}' - '{0CCE922B-69AE-11D9-BED3-505054503030}' - '{0CCE922F-69AE-11D9-BED3-505054503030}' - '{0CCE9230-69AE-11D9-BED3-505054503030}' - '{0CCE9235-69AE-11D9-BED3-505054503030}' - '{0CCE9236-69AE-11D9-BED3-505054503030}' - '{0CCE9237-69AE-11D9-BED3-505054503030}' - '{0CCE923F-69AE-11D9-BED3-505054503030}' - '{0CCE9240-69AE-11D9-BED3-505054503030}' - '{0CCE9242-69AE-11D9-BED3-505054503030}' AuditPolicyChanges|contains: - '%%8448' - '%%8450' selection_state_success_only: EventID: 4719 SubcategoryGuid: '{0CCE9217-69AE-11D9-BED3-505054503030}' AuditPolicyChanges|contains: '%%8448' condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID. Logsource: windows / process_creation. Rule: title: Potential COM Objects Download Cradles Usage - Process Creation id: 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf related: - id: 3c7d1587-3b13-439f-9941-7d14313dbdfe type: similar status: test description: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID references: - https://learn.microsoft.com/en-us/dotnet/api/system.type.gettypefromclsid?view=net-7.0 - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=57 author: frack113 date: 2022-12-25 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: process_creation detection: selection_1: CommandLine|contains: '[Type]::GetTypeFromCLSID(' selection_2: CommandLine|contains: - 0002DF01-0000-0000-C000-000000000046 - F6D90F16-9C73-11D3-B32E-00C04F990BB4 - F5078F35-C551-11D3-89B9-0000F81FE221 - 88d96a0a-f192-11d4-a65f-0040963251e5 - AFBA6B42-5692-48EA-8141-DC517DCF0EF1 - AFB40FFD-B609-40A3-9828-F88BBE11E4E3 - 88d96a0b-f192-11d4-a65f-0040963251e5 - 2087c2f4-2cef-4953-a8ab-66779b670495 - 000209FF-0000-0000-C000-000000000046 - 00024500-0000-0000-C000-000000000046 condition: all of selection_* falsepositives: - Legitimate use of the library level: medium