Vendor: Microsoft
July 25, 2023 · View on GitHub
Product: Sysmon
Use-Case: Compromised Credentials
| Rules | Models | MITRE TTPs | Event Types | Parsers |
|---|---|---|---|---|
| 114 | 39 | 18 | 6 | 6 |
| Event Type | Rules | Models |
|---|---|---|
| app-activity | T1020 - Automated Exfiltration ↳ APP-AppED-F: New Email-domain found in application T1071 - Application Layer Protocol ↳ APP-AppED-F: New Email-domain found in application T1078 - Valid Accounts ↳ UA-UI-F: First activity from ISP ↳ UA-UC-Suspicious: Activity from suspicious country ↳ UA-UC-Two: Activity from two different countries ↳ UA-UC-Three: Activity from 3 different countries ↳ APP-AppU-F: First login to an application for a user with no history ↳ APP-F-SA-NC: New service account access to application ↳ APP-AppG-F: First login to an application for group ↳ APP-GApp-A: Abnormal login to an application for group ↳ APP-UAg-3: More than two new user agents used by the user in the same session ↳ APP-UOb-F: First access to application object for user ↳ APP-UOb-A: Abnormal access to application object for user ↳ APP-AA-F: First application activity in the organization ↳ APP-AA-A: Abnormal activity in application for the organization ↳ APP-UMime-F: First mime type for user ↳ APP-UMime-A: Abnormal mime type for user ↳ APP-GMime-F: First mime type for peer group ↳ APP-GMime-A: Abnormal mime type for peer group ↳ APP-OMime-F: First mime type for organization ↳ APP-OMime-A: Abnormal mime type for organization T1133 - External Remote Services ↳ UA-UI-F: First activity from ISP ↳ UA-UC-Suspicious: Activity from suspicious country ↳ UA-UC-Two: Activity from two different countries ↳ UA-UC-Three: Activity from 3 different countries | • APP-AppED: Email-domains per application • APP-OMime: Mime types for organization • APP-GMime: Mime types per peer group • APP-UMime: Mime types per user • APP-AA: Activity per application • APP-UOb: Application objects per user • APP-UAg: User Agent Strings • APP-GApp: Group Logons to Applications • APP-AppG: Groups per Application • APP-AppU: User Logons to Applications • UA-UI-new: ISP of users during application activity |
| file-delete | T1083 - File and Directory Discovery ↳ FA-UA-UI-F: First file activity from ISP ↳ FA-UA-UC-F: First file activity from country for user ↳ FA-UA-UC-A: Abnormal file activity from country for user ↳ FA-UA-GC-F: First file activity from country for group ↳ FA-UA-GC-A: Abnormal file activity from country for group ↳ FA-UA-OC-F: First file activity from country for organization ↳ FA-UA-OC-A: Abnormal file activity from country for organization ↳ FA-UH-F: First file access from asset for user ↳ FA-UH-A: Abnormal file access from asset for user ↳ FA-OZ-F: First file access from network zone for organization ↳ FA-OZ-A: Abnormal file access from network zone for organization ↳ FA-UZ-F: First file access from network zone for user ↳ FA-UZ-A: Abnormal file access from network zone for user ↳ FA-UA-F: First file access activity for user ↳ FA-UA-A: Abnormal file access activity for user ↳ FA-OU-F: First access to source code files for user in the organization ↳ FA-OU-A: Abnormal access to source code files for user in the organization ↳ FA-OG-F: First access to source code files for user in the peer group ↳ FA-OG-A: Abnormal access to source code files for user in the peer group ↳ FA-UD-F: First file server access for user ↳ FA-UD-A: Abnormal file server access for user ↳ FA-GD-F: First file server access for group ↳ FA-GD-A: Abnormal file server access for group | • FA-GD: File server access per group • FA-UD: File server access per user • FA-OG: Users accessing source code files in the peer group • FA-OU: Users accessing source code files in the organization • FA-UA: File access activities for user • FA-UZ: File accesses from network zone for user • FA-OZ: File accesses from network zone for organization • FA-UH: User file access source host • FA-UA-OC: Countries for organization file activities • FA-UA-GC: Countries for peer groups file activities • FA-UA-UC: Countries for user file activity • FA-UA-UI-new: ISP of users during file activity |
| process-created | T1040 - Network Sniffing ↳ A-EPA-SNIFF: Network sniffing tool has been found running on this asset ↳ A-EPA-OH-SNIFF-F: First time this asset has had an execution of a network sniffing tool ↳ A-EPA-OH-SNIFF-A: Abnormal asset running network sniffing tool ↳ A-EPA-OZ-SNIFF-F: First zone on which network sniffing tool was run ↳ A-EPA-OZ-SNIFF-A: Abnormal zone on which network sniffing tool was run ↳ EPA-OU-SNIFF-F: First time this user has run a network sniffing tool ↳ EPA-OU-SNIFF-A: Abnormal user has run a network sniffing tool ↳ EPA-OG-SNIFF-F: First time this peer group has run a network sniffing tool ↳ EPA-OG-SNIFF-A: Abnormal peer group running a network sniffing tool ↳ EPA-OH-SNIFF-F: First time this host has run a network sniffing tool ↳ EPA-OH-SNIFF-A: Abnormal host running a network sniffing tool ↳ EPA-OZ-SNIFF-F: First time this network zone on which a networking sniffing tool run. ↳ EPA-OZ-SNIFF-A: Abnormal network zone on which network sniffing tool was run ↳ DLL-AppData: DLL loaded from 'AppData(slash)Local' path T1003 - OS Credential Dumping ↳ A-SecX-Tool-Exec: SecurityXploded Tool execution detected on this asset ↳ A-CreateMiniDump-Hacktool: CreateMiniDump Hacktool detected on this asset. ↳ A-LSASS-Mem-Dump: LSASS Memory Dumping detected on this asset ↳ A-Proc-Dump-Comsvcs: Process Dump via Rundll32 and Comsvcs.dll detected on this asset ↳ A-AD-Diagnostic-Tool: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) on this asset ↳ A-GRAB-REG-HIVES: Grabbing Sensitive Hives via Reg Utility on this asset ↳ A-ShadowCP-SymLink: Shadow Copies Access via Symlink on this asset ↳ A-POSS-SPN-ENUMERATION: Possible SPN Enumeration on this asset ↳ A-Cmdkey-Cred-Recon: Cmdkey Cached Credentials Recon on this asset ↳ A-NSniff-Cred: Potential network sniffing was observed on this asset. ↳ EPA-UH-Pen-F: Known pentest tool used ↳ Mimikatz-process: A highly dangerous attacker tool, Mimikatz, has been used ↳ SecX-Tool-Exec: SecurityXploded Tool execution detected ↳ CreateMiniDump-Hacktool: CreateMiniDump Hacktool ↳ EPA-SNIFF: Network sniffing tool has been run by this user ↳ Proc-Dump-Comsvcs: Process Dump via Rundll32 and Comsvcs.dll ↳ AD-Diagnostic-Tool: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) ↳ Sus-Procdump: Suspicious Use of Procdump ↳ GRAB-REG-HIVES: Grabbing Sensitive Hives via Reg Utility ↳ ShadowCP-SymLink: Shadow Copies Access via Symlink ↳ POSS-SPN-ENUMERATION: Possible SPN Enumeration ↳ OG-SYSVOL-F: Suspicious SYSVOL Domain Group Policy Access for the first time for this peer group ↳ NSniff-Cred: Potential network sniffing was observed T1036 - Masquerading ↳ A-AD-Diagnostic-Tool: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) on this asset ↳ A-GRAB-REG-HIVES: Grabbing Sensitive Hives via Reg Utility on this asset ↳ AD-Diagnostic-Tool: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) ↳ GRAB-REG-HIVES: Grabbing Sensitive Hives via Reg Utility T1547.004 - T1547.004 ↳ A-NotPetya-Activity: NotPetya Ransomware Activity detected on this asset ↳ NotPetya-Activity: NotPetya Ransomware Activity detected T1016 - System Network Configuration Discovery ↳ WINCMD-Route: 'Route' program used ↳ WINCMD-Netsh: 'Netsh' program used ↳ WINCMD-Arp: 'Arp' program used T1003.003 - T1003.003 ↳ A-ServiceName-ServiceCmdline-F: First time binary command line for this service on this asset. | • EPA-OG-SYSVOL: SYSVOL domain group policy access by group in the organization • EPA-OZ-SNIFF: Network Zones on which network sniffing tools are run • EPA-OH-SNIFF: Hosts that have been found to be running network sniffing tools • EPA-OG-SNIFF: Peer groups that are running network sniffing tools • EPA-OU-SNIFF: Users that are running network sniffing tools • EPA-UH-Pen: Malicious tools used by user • A-ServiceName-ServiceCmdline: Service Executable Files on the asset |
| process-network | T1003 - OS Credential Dumping ↳ EPA-UH-Pen-F: Known pentest tool used | • EPA-UH-Pen: Malicious tools used by user |
| web-activity-denied | T1071.001 - Application Layer Protocol: Web Protocols ↳ A-WEB-HA-F: First web activity event on asset ↳ A-WEB-DC: Web activity event on a Domain Controller ↳ A-WEB-Reputation-Domain: Asset attempted access to a domain with bad reputation ↳ A-WEB-Reputation-IP: Asset attempted to connect to IP address with bad reputation ↳ A-WEBF-IP-Country-F: Asset failed to directly connect to an IP address in a country never before accessed ↳ A-WEBF-IP-Country-A: Abnormal direct access to an IP address by the asset belonging to an abnormal country for the asset to access has failed ↳ A-NETF-HCountry-Outbound-WEB-F: First failed web browsing connection to this country from asset ↳ A-NETF-HCountry-Outbound-WEB-A: Web browsing connection to abnormal country for asset has failed ↳ A-NETF-OCountry-Outbound-WEB-F: First failed web browsing connection to this country from organization ↳ A-NETF-OCountry-Outbound-WEB-A: Web browsing connection to abnormal country for the organization has failed ↳ WEB-UU-Reputation: User attempted access to a url with bad reputation ↳ WEB-UD-Reputation-F: First access to this web domain which has been identified as risky by a reputation feed. ↳ WEB-UD-Reputation-A: Abnormal access to this web domain which has been identified as risky by a reputation feed. ↳ WEB-UD-Reputation-N: Common access to this web domain which has been identified as risky by a reputation feed. ↳ WEB-UI-Reputation-F: First access to this internet IP address which has been identified as risky by a reputation feed. ↳ WEB-UI-Reputation-A: Abnormal access to this IP address which has been identified as risky by a reputation feed. ↳ WEB-UI-Reputation-N: Common access to this IP address which has been identified as risky by a reputation feed. ↳ WEB-UD-ALERT-F: First security alert accessing this malicious domain for user ↳ WEB-UD-ALERT-A: Abnormal security alert accessing this malicious domain for user ↳ WEB-UD-ALERT-N: Common security alert on this malicious domain for user ↳ WEB-OZ-F: First web activity from this zone for the organization ↳ WEB-ALERT-EXEC: Security violation by Executive in web activity ↳ WEB-URank-F: First web activity to this low ranked web domain ↳ WEB-URank-A: Abnormal web activity to this low ranked web domain ↳ WEB-Fail-10: Failed to access 10 websites. ↳ WEB-IPF-Country-F: User has failed trying to directly browse to an IP address belonging to a country never before accessed T1189 - Drive-by Compromise ↳ WEB-URank-Binary: Executable download from first low ranked web domain T1204.001 - T1204.001 ↳ WEB-URank-Binary: Executable download from first low ranked web domain T1566.002 - Phishing: Spearphishing Link ↳ WEB-URank-Binary: Executable download from first low ranked web domain T1568.002 - Dynamic Resolution: Domain Generation Algorithms ↳ WEB-UD-DGA-F: First access to this domain which has been identified as DGA T1102 - Web Service ↳ A-WEB-DC: Web activity event on a Domain Controller | • WEB-URank: Web activity to low ranked domains for the user • WEB-OZ: Network zones where users performs web activity in the organization • WEB-UD-ALERT: Top malicious web domain accessed by the user • WEB-UI-Reputation: Top ip addresses flagged by a reputation service that have been accessed by the user • WEB-UD-Reputation: Top web domain flagged by a reputation service that have been accessed by the user • WEB-UD-DGA: Top web domains per user that seem to be DGA generated during web activity • A-NET-OCountry-Outbound: Outbound country per organization • A-NET-HCountry-Outbound: Outbound country per asset • A-WEB-IP: IPs an asset has directly browsed to |