deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Important Scheduled Task Deleted or Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2023-01-13
ATT&CK techniques: T1489
Log source: windows/

Description:
Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities


Detection logic:
{
  "selection": {
    "EventID": [
      141,
      142
    ],
    "TaskName|contains": [
      "\\Windows\\SystemRestore\\SR",
      "\\Windows\\Windows Defender\\",
      "\\Windows\\BitLocker",
      "\\Windows\\WindowsBackup\\",
      "\\Windows\\WindowsUpdate\\",
      "\\Windows\\UpdateOrchestrator\\",
      "\\Windows\\ExploitGuard"
    ]
  },
  "filter_main_user": {
    "UserName|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/
Sigma Detection Rule: Scheduled Task Executed Uncommon LOLBIN
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-05
ATT&CK techniques: T1053.005
Log source: windows/

Description:
Detects the execution of Scheduled Tasks where the program being run is located in a suspicious location or where it is an unusual program to be run from a Scheduled Task

Detection logic:
{
  "selection": {
    "EventID": 129,
    "Path|endswith": [
      "\\calc.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\mspaint.exe",
      "\\notepad.exe",
      "\\regsvr32.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Scheduled Task Executed From A Suspicious Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-05
ATT&CK techniques: T1053.005
Log source: windows/

Description:
Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task

Detection logic:
{
  "selection": {
    "EventID": 129,
    "Path|contains": [
      "C:\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Users\\Public\\",
      "C:\\Temp\\"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Suspicious Application Installed
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-14
Log source: windows/

Description:
Detects suspicious application installed by looking at the added shortcut to the app resolver cache

Detection logic:
{
  "selection_name": {
    "EventID": 28115,
    "Name|contains": [
      "Zenmap",
      "AnyDesk",
      "wireshark",
      "openvpn"
    ]
  },
  "selection_packageid": {
    "EventID": 28115,
    "AppID|contains": [
      "zenmap.exe",
      "prokzult ad",
      "wireshark",
      "openvpn"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://nasbench.medium.com/finding-forensic-goodness-in-obscure-windows-event-logs-60e978ea45a3
Sigma Detection Rule: BITS Transfer Job Downloading File Potential Suspicious Extension
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-03-01
ATT&CK techniques: T1197
Log source: windows/

Description:
Detects new BITS transfer job saving local files with potential suspicious extensions

Detection logic:
{
  "selection": {
    "EventID": 16403,
    "LocalName|endswith": [
      ".bat",
      ".dll",
      ".exe",
      ".hta",
      ".ps1",
      ".psd1",
      ".sh",
      ".vbe",
      ".vbs"
    ]
  },
  "filter_optional_generic": {
    "LocalName|contains": "\\AppData\\",
    "RemoteName|contains": ".com"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
Sigma Detection Rule: BITS Transfer Job Download To Potential Suspicious Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-28
ATT&CK techniques: T1197
Log source: windows/

Description:
Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location

Detection logic:
{
  "selection": {
    "EventID": 16403,
    "LocalName|contains": [
      "\\Desktop\\",
      "C:\\Users\\Public\\",
      "C:\\PerfLogs\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
Sigma Detection Rule: New BITS Job Created Via Bitsadmin
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-03-01
ATT&CK techniques: T1197
Log source: windows/

Description:
Detects the creation of a new bits job by Bitsadmin

Detection logic:
{
  "selection": {
    "EventID": 3,
    "processPath|endswith": "\\bitsadmin.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
Sigma Detection Rule: BITS Transfer Job Download From Direct IP
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-11
ATT&CK techniques: T1197
Log source: windows/

Description:
Detects a BITS transfer job downloading file(s) from a direct IP address.

Detection logic:
{
  "selection": {
    "EventID": 16403,
    "RemoteName|contains": [
      "http://1",
      "http://2",
      "http://3",
      "http://4",
      "http://5",
      "http://6",
      "http://7",
      "http://8",
      "http://9",
      "https://1",
      "https://2",
      "https://3",
      "https://4",
      "https://5",
      "https://6",
      "https://7",
      "https://8",
      "https://9"
    ]
  },
  "filter_optional_local_networks": {
    "RemoteName|contains": [
      "://10.",
      "://192.168.",
      "://172.16.",
      "://172.17.",
      "://172.18.",
      "://172.19.",
      "://172.20.",
      "://172.21.",
      "://172.22.",
      "://172.23.",
      "://172.24.",
      "://172.25.",
      "://172.26.",
      "://172.27.",
      "://172.28.",
      "://172.29.",
      "://172.30.",
      "://172.31.",
      "://127.",
      "://169.254."
    ]
  },
  "filter_optional_seven_zip": {
    "RemoteName|contains": [
      "https://7-",
      "http://7-"
    ]
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  - https://isc.sans.edu/diary/22264
  - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
Sigma Detection Rule: BITS Transfer Job Download From File Sharing Domains
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-28
ATT&CK techniques: T1197
Log source: windows/

Description:
Detects BITS transfer job downloading files from a file sharing domain.

Detection logic:
{
  "selection": {
    "EventID": 16403,
    "RemoteName|contains": [
      ".githubusercontent.com",
      "anonfiles.com",
      "cdn.discordapp.com",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "pixeldrain.com",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://twitter.com/malmoeb/status/[PII_REDACTED]75960832
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker
  - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
Sigma Detection Rule: New BITS Job Created Via PowerShell
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-03-01
ATT&CK techniques: T1197
Log source: windows/

Description:
Detects the creation of a new bits job by PowerShell

Detection logic:
{
  "selection": {
    "EventID": 3,
    "processPath|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
Sigma Detection Rule: BITS Transfer Job With Uncommon Or Suspicious Remote TLD
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-10
ATT&CK techniques: T1197
Log source: windows/

Description:
Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Detection logic:
{
  "selection": {
    "EventID": 16403
  },
  "filter_main_generic": {
    "RemoteName|contains": [
      ".azureedge.net/",
      ".com/",
      ".sfx.ms/",
      "download.mozilla.org/",
      "cdn.onenote.net/",
      "cdn.office.net/",
      "tscdn.m365.static.microsoft/"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md
  - https://twitter.com/malmoeb/status/[PII_REDACTED]75960832
Sigma Detection Rule: New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2023-02-26
ATT&CK techniques: T1686.003
Log source: windows/

Description:
Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.

Detection logic:
{
  "selection": {
    "EventID": [
      2004,
      2071,
      2097
    ],
    "ApplicationPath|contains": [
      ":\\PerfLogs\\",
      ":\\Temp\\",
      ":\\Tmp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Tasks\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\"
    ]
  },
  "filter_main_block": {
    "Action": 2
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
  - https://app.any.run/tasks/7123e948-c91e-49e0-a813-00e8d72ab393/#
Sigma Detection Rule: Windows Defender Firewall Has Been Reset To Its Default Configuration
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-02-19
ATT&CK techniques: T1686.003
Log source: windows/

Description:
Detects activity when Windows Defender Firewall has been reset to its default configuration

Detection logic:
{
  "selection": {
    "EventID": [
      2032,
      2060
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
Sigma Detection Rule: A Rule Has Been Deleted From The Windows Firewall Exception List
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-19
ATT&CK techniques: T1686.003
Log source: windows/

Description:
Detects when a single rules or all of the rules have been deleted from the Windows Defender Firewall

Detection logic:
{
  "selection": {
    "EventID": [
      2006,
      2052
    ]
  },
  "filter_main_generic": {
    "ModifyingApplication|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "filter_main_svchost": {
    "ModifyingApplication": "C:\\Windows\\System32\\svchost.exe"
  },
  "filter_optional_msmpeng": {
    "ModifyingApplication|startswith": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
    "ModifyingApplication|endswith": "\\MsMpEng.exe"
  },
  "filter_main_null": {
    "ModifyingApplication": null
  },
  "filter_main_empty": {
    "ModifyingApplication": ""
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
Sigma Detection Rule: Uncommon New Firewall Rule Added In Windows Firewall Exception List
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-19
ATT&CK techniques: T1686.003
Log source: windows/

Description:
Detects when a rule has been added to the Windows Firewall exception list

Detection logic:
{
  "selection": {
    "EventID": [
      2004,
      2071,
      2097
    ]
  },
  "filter_main_block": {
    "Action": 2
  },
  "filter_main_generic": {
    "ApplicationPath|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "filter_main_covered_paths": {
    "ApplicationPath|contains": [
      "C:\\PerfLogs\\",
      "C:\\Temp\\",
      "C:\\Tmp\\",
      "C:\\Users\\Public\\",
      "C:\\Windows\\Tasks\\",
      "C:\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\"
    ]
  },
  "filter_main_system_dllhost": {
    "ApplicationPath": "System",
    "ModifyingApplication": "C:\\Windows\\System32\\dllhost.exe"
  },
  "filter_main_tiworker": {
    "ModifyingApplication|startswith": "C:\\Windows\\WinSxS\\",
    "ModifyingApplication|endswith": "\\TiWorker.exe"
  },
  "filter_main_null": {
    "ApplicationPath": null
  },
  "filter_optional_no_path": {
    "ModifyingApplication": [
      "C:\\Windows\\System32\\svchost.exe",
      "C:\\Windows\\System32\\dllhost.exe"
    ],
    "ApplicationPath": ""
  },
  "filter_optional_msmpeng": [
    {
      "ModifyingApplication|startswith": [
        "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
        "C:\\Program Files\\Windows Defender\\"
      ],
      "ModifyingApplication|endswith": "\\MsMpEng.exe"
    },
    {
      "ApplicationPath|startswith": [
        "C:\\ProgramData\\Microsof

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
Sigma Detection Rule: Windows Firewall Settings Have Been Changed
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-02-19
ATT&CK techniques: T1686.003
Log source: windows/

Description:
Detects activity when the settings of the Windows firewall have been changed

Detection logic:
{
  "selection": {
    "EventID": [
      2002,
      2083,
      2003,
      2082,
      2008
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
Sigma Detection Rule: New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2024-05-10
ATT&CK techniques: T1686.003
Log source: windows/

Description:
Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE).
This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule".


Detection logic:
{
  "selection": {
    "EventID": [
      2004,
      2071,
      2097
    ],
    "Action": 3,
    "ModifyingApplication|endswith": ":\\Windows\\System32\\wbem\\WmiPrvSE.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
  - https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
  - https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
Sigma Detection Rule: All Rules Have Been Deleted From The Windows Firewall Configuration
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-17
ATT&CK techniques: T1686.003
Log source: windows/

Description:
Detects when a all the rules have been deleted from the Windows Defender Firewall configuration

Detection logic:
{
  "selection": {
    "EventID": [
      2033,
      2059
    ]
  },
  "filter_main_svchost": {
    "ModifyingApplication|endswith": ":\\Windows\\System32\\svchost.exe"
  },
  "filter_optional_msmpeng": {
    "ModifyingApplication|contains|all": [
      ":\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
      "\\MsMpEng.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
Sigma Detection Rule: The Windows Defender Firewall Service Failed To Load Group Policy
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-02-19
ATT&CK techniques: T1686.003
Log source: windows/

Description:
Detects activity when The Windows Defender Firewall service failed to load Group Policy

Detection logic:
{
  "selection": {
    "EventID": 2009
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
Sigma Detection Rule: Weak Encryption Enabled and Kerberoast
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @neu5ron
Date: 2017-07-30
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.

Detection logic:
{
  "selection": {
    "EventID": 4738
  },
  "olduac_des": {
    "OldUacValue|endswith": [
      "8???",
      "9???",
      "A???",
      "B???",
      "C???",
      "D???",
      "E???",
      "F???"
    ]
  },
  "newuac_des": {
    "NewUacValue|endswith": [
      "8???",
      "9???",
      "A???",
      "B???",
      "C???",
      "D???",
      "E???",
      "F???"
    ]
  },
  "olduac_preauth": {
    "OldUacValue|endswith": [
      "1????",
      "3????",
      "5????",
      "7????",
      "9????",
      "B????",
      "D????",
      "F????"
    ]
  },
  "newuac_preauth": {
    "NewUacValue|endswith": [
      "1????",
      "3????",
      "5????",
      "7????",
      "9????",
      "B????",
      "D????",
      "F????"
    ]
  },
  "olduac_encrypted": {
    "OldUacValue|endswith": [
      "8??",
      "9??",
      "A??",
      "B??",
      "C??",
      "D??",
      "E??",
      "F??"
    ]
  },
  "newuac_encrypted": {
    "NewUacValue|endswith": [
      "8??",
      "9??",
      "A??",
      "B??",
      "C??",
      "D??",
      "E??",
      "F??"
    ]
  },
  "condition": "selection and ((newuac_des and not olduac_des) or (newuac_preauth and not olduac_preauth) or (newuac_encrypted and not olduac_encrypted))"
}

References:
  - https://adsecurity.org/?p=2053
  - https://blog.harmj0y.net/redteaming/another-word-on-delegation/
Sigma Detection Rule: New or Renamed User Account with '$' Character
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ilyas Ochkov, oscd.community
Date: 2019-10-25
ATT&CK techniques: T1036
Log source: windows/

Description:
Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.


Detection logic:
{
  "selection_create": {
    "EventID": 4720,
    "SamAccountName|contains": "$"
  },
  "selection_rename": {
    "EventID": 4781,
    "NewTargetUserName|contains": "$"
  },
  "filter_main_homegroup": {
    "EventID": 4720,
    "TargetUserName": "HomeGroupUser$"
  },
  "condition": "1 of selection_* and not 1 of filter_main_*"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]63958021
Sigma Detection Rule: Persistence and Execution at Scale via GPO Scheduled Task
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden
Date: 2019-04-03
ATT&CK techniques: T1053.005
Log source: windows/

Description:
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Detection logic:
{
  "selection_5136": {
    "EventID": 5136,
    "AttributeLDAPDisplayName": [
      "gPCMachineExtensionNames",
      "gPCUserExtensionNames"
    ],
    "AttributeValue|contains": [
      "CAB54552-DEEA-4691-817E-ED4A4D1AFC72",
      "AADCED64-746C-4633-A97C-D[PII_REDACTED]7"
    ]
  },
  "selection_5145": {
    "EventID": 5145,
    "ShareName|endswith": "\\SYSVOL",
    "RelativeTargetName|endswith": "ScheduledTasks.xml",
    "AccessList|contains": [
      "WriteData",
      "%%4417"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://twitter.com/menasec1/status/[PII_REDACTED]77052160
  - https://www.secureworks.com/blog/ransomware-as-a-distraction
  - https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html
Sigma Detection Rule: Locked Workstation
Repository: SigmaHQ/sigma
Severity: informational
Status: stable
Author: Alexandr Yampolskyi, SOC Prime
Date: 2019-03-26
Log source: windows/

Description:
Detects locked workstation session events that occur automatically after a standard period of inactivity.

Detection logic:
{
  "selection": {
    "EventID": 4800
  },
  "condition": "selection"
}

References:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800