security_content/data_sources/endpoint/Powershell_Script_Block_Logging_4104.yml at develop · samson4649/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
name: Powershell Script Block Logging 4104
id: 5cfd0c72-d989-47a0-92f9-6edc6f8d3564
author: Patrick Bareiss, Splunk
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
supported_TA:
  name: Splunk Add-on for Microsoft Windows
  version: 8.8.0
  url: https://splunkbase.splunk.com/app/742
event_names: []
fields:
- _time
- ActivityID
- Channel
- Computer
- EventCode
- EventData_Xml
- EventID
- EventRecordID
- Guid
- Keywords
- Level
- MessageNumber
- MessageTotal
- Name
- Opcode
- Path
- ProcessID
- RecordNumber
- ScriptBlockId
- ScriptBlockText
- SystemTime
- System_Props_Xml
- Task
- ThreadID
- UserID
- Version
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- dvc
- dvc_nt_host
- event_id
- eventtype
- host
- id
- index
- linecount
- punct
- signature_id
- source
- sourcetype
- splunk_server
- tag
- tag::eventtype
- timeendpos
- timestartpos
- user_id
- vendor_product
field_mappings:
  - data_model: cim
    data_set: Endpoint.Processes
    mapping:
      Computer: Processes.dest
      Path: Processes.process_path
      ScriptBlockId: Processes.process_id
      ScriptBlockText: Processes.process
      UserID: Processes.user_id
  - data_model: ocsf
    mapping:
      Computer: device.hostname
      Path: process.file.path
      ScriptBlockId: process.uid
      ScriptBlockText: process.cmd_line
      UserID: actor.user.uid
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
  Name='Microsoft-Windows-PowerShell' Guid='{A0C1853B-5C40-4B15-8766-3CF1C58F985A}'/><EventID>4104</EventID><Version>1</Version><Level>5</Level><Task>2</Task><Opcode>15</Opcode><Keywords>0x0</Keywords><TimeCreated
  SystemTime='2022-05-02T12:39:41.710158900Z'/><EventRecordID>112748</EventRecordID><Correlation
  ActivityID='{547232D9-5B2B-0007-6CA6-72542B5BD801}'/><Execution ProcessID='5336'
  ThreadID='2228'/><Channel>Microsoft-Windows-PowerShell/Operational</Channel><Computer>win-dc-mhaag-attack-range-270.attackrange.local</Computer><Security
  UserID='S-1-5-21-2059343465-2300599999-2417073716-500'/></System><EventData><Data
  Name='MessageNumber'>1</Data><Data Name='MessageTotal'>1</Data><Data Name='ScriptBlockText'>function
  New-Mutex($MutexName) {