Query: rule covering Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario w
Matching passage: Sigma rule: Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario w. Logsource: windows / security. Rule: title: Windows Event Auditing Disabled id: 69aeb277-f15f-4d2d-b32a-55e883609563 related: - id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1 type: derived status: test description: 'Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. Also, it is recommended to turn off "Local Group Policy Object Processing" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as "gpedit.msc". Please note, that disabling "Local Group Policy Object Processing" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways. ' references: - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit author: '@neu5ron, Nasreddine Bencherchali (Nextron Systems)' date: 2017-11-19 modified: 2023-11-15 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows service: security definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64 detection: selection: EventID: 4719 AuditPolicyChanges|contains: - '%%8448' - '%%8450' filter_main_guid: SubcategoryGuid: - '{0CCE9210-69AE-11D9-BED3-505054503030}' - '{0CCE9211-69AE-11D9-BED3-505054503030}' - '{0CCE9212-69AE-11D9-BED3-505054503030}' - '{0CCE9215-69AE-11D9-BED3-505054503030}' - '{0CCE9217-69AE-11D9-BED3-505054503030}' - '{0CCE921B-69AE-11D9-BED3-505054503030}' - '{0CCE922B-69AE-11D9-BED3-505054503030}' - '{0CCE922F-69AE-11D9-BED3-505054503030}' - '{0CCE9230-69AE-11D9-BED3-505054503030}' - '{0CCE9235-69AE-11D9-BED3-505054503030}' - '{0CCE9236-69AE-11D9-BED3-505054503030}' - '{0CCE9237-69AE-11D9-BED3-505054503030}' - '{0CCE923F-69AE-11D9-BED3-505054503030}' - '{0CCE9240-69AE-11D9-BED3-505054503030}' - '{0CCE9242-69AE-11D9-BED3-505054503030}' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new fil. Logsource: macos / process_creation. Rule: title: Potential Base64 Decoded From Images id: 09a910bf-f71f-4737-9c40-88880ba5913d status: test description: 'Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner. ' references: - https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior - https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-12-20 tags: - attack.stealth - attack.t1140 logsource: product: macos category: process_creation detection: selection_image: Image|endswith: /bash selection_view: CommandLine|contains|all: - tail - -c selection_b64: CommandLine|contains|all: - base64 - -d - '>' selection_files: CommandLine|contains: - .avif - .gif - .jfif - .jpeg - .jpg - .pjp - .pjpeg - .png - .svg - .webp condition: all of selection_* falsepositives: - Unknown level: high