Funktionsrollback

2026-07-24 07:17:38 +02:00
parent a4ff984914
commit e9d9583f28
38 changed files with 3243 additions and 364 deletions
--- a/deploy/rules/windows-authentication.json
+++ b/deploy/rules/windows-authentication.json
@@ -0,0 +1,102 @@
+{
+  "id": "windows-authentication",
+  "name": "Windows Authentication",
+  "description": "Anmelde-, Lockout-, Spray- und Kerberos/NTLM-Erkennungen.",
+  "version": 1,
+  "enabled": true,
+  "rules": [
+    {
+      "id": "win-account-lockout",
+      "title": "Account Lockout",
+      "description": "Windows Security Event 4740.",
+      "severity": "medium",
+      "score": 5.5,
+      "enabled": true,
+      "kind": "event",
+      "channels": ["Security"],
+      "event_codes": [4740],
+      "group_by": ["host", "user", "workstation"],
+      "threshold": 1,
+      "window_seconds": 600,
+      "suppress_seconds": 900,
+      "summary": "Account-Lockout: {user}; Caller {workstation}; DC/Host {host} ({count}×)",
+      "tags": ["windows", "authentication", "lockout"],
+      "mitre": []
+    },
+    {
+      "id": "win-failed-logon-burst",
+      "title": "Viele fehlgeschlagene Anmeldungen",
+      "description": "Mindestens 20 Event-4625-Ereignisse für denselben Kontext in fünf Minuten.",
+      "severity": "high",
+      "score": 7.5,
+      "enabled": true,
+      "kind": "threshold",
+      "channels": ["Security"],
+      "event_codes": [4625],
+      "group_by": ["host", "user", "source_ip"],
+      "threshold": 20,
+      "window_seconds": 300,
+      "suppress_seconds": 900,
+      "summary": "{count} fehlgeschlagene Logons für {user} auf {host} von {source_ip}",
+      "tags": ["windows", "authentication", "brute-force"],
+      "mitre": ["T1110"]
+    },
+    {
+      "id": "win-password-spray",
+      "title": "Password Spray",
+      "description": "Eine Source-IP versucht viele unterschiedliche Konten anzumelden.",
+      "severity": "high",
+      "score": 8.5,
+      "enabled": true,
+      "kind": "distinct",
+      "channels": ["Security"],
+      "event_codes": [4625],
+      "conditions": [{"field": "source_ip", "operator": "exists"}, {"field": "target_user", "operator": "exists"}],
+      "group_by": ["source_ip"],
+      "threshold": 20,
+      "distinct_field": "target_user",
+      "distinct_threshold": 10,
+      "window_seconds": 600,
+      "suppress_seconds": 1800,
+      "summary": "Password-Spray von {source_ip}: {count} Versuche gegen {distinct} Benutzer",
+      "tags": ["windows", "authentication", "password-spray"],
+      "mitre": ["T1110.003"]
+    },
+    {
+      "id": "win-kerberos-preauth-burst",
+      "title": "Kerberos Pre-Auth Fehler-Burst",
+      "description": "Viele Event-4771-Ereignisse für denselben Benutzer oder Quellkontext.",
+      "severity": "high",
+      "score": 7.4,
+      "enabled": true,
+      "kind": "threshold",
+      "channels": ["Security"],
+      "event_codes": [4771],
+      "group_by": ["host", "user", "source_ip"],
+      "threshold": 15,
+      "window_seconds": 300,
+      "suppress_seconds": 900,
+      "summary": "{count} Kerberos Pre-Auth Fehler für {user} auf {host} von {source_ip}",
+      "tags": ["windows", "kerberos", "authentication"],
+      "mitre": ["T1110"]
+    },
+    {
+      "id": "win-ntlm-auth-failure-burst",
+      "title": "NTLM Authentifizierungsfehler-Burst",
+      "description": "Viele Event-4776-Ereignisse im kurzen Zeitraum.",
+      "severity": "high",
+      "score": 7.2,
+      "enabled": true,
+      "kind": "threshold",
+      "channels": ["Security"],
+      "event_codes": [4776],
+      "group_by": ["host", "user", "workstation"],
+      "threshold": 15,
+      "window_seconds": 300,
+      "suppress_seconds": 900,
+      "summary": "{count} NTLM-Authentifizierungsfehler für {user} über {workstation}",
+      "tags": ["windows", "ntlm", "authentication"],
+      "mitre": ["T1110"]
+    }
+  ]
+}