100 lines
3.1 KiB
JSON
100 lines
3.1 KiB
JSON
{
|
|
"id": "windows-account-admin",
|
|
"name": "Windows Account & Privilege Management",
|
|
"description": "Konten, Gruppen und privilegierte Änderungen.",
|
|
"version": 1,
|
|
"enabled": true,
|
|
"rules": [
|
|
{
|
|
"id": "win-privileged-group-change",
|
|
"title": "Privilegierte Gruppenmitgliedschaft geändert",
|
|
"description": "Mitglied zu privilegierter lokaler, globaler oder universeller Gruppe hinzugefügt.",
|
|
"severity": "critical",
|
|
"score": 9.2,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"channels": ["Security"],
|
|
"event_codes": [4728, 4732, 4756],
|
|
"group_by": ["host", "user", "workstation"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "Privilegierte Gruppenmitgliedschaft geändert: {user} auf {host}",
|
|
"tags": ["windows", "privilege", "account-management"],
|
|
"mitre": ["T1098"]
|
|
},
|
|
{
|
|
"id": "win-user-created",
|
|
"title": "Benutzerkonto erstellt",
|
|
"description": "Windows Security Event 4720.",
|
|
"severity": "medium",
|
|
"score": 6.0,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"channels": ["Security"],
|
|
"event_codes": [4720],
|
|
"group_by": ["host", "user"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "Benutzerkonto {user} auf {host} erstellt",
|
|
"tags": ["windows", "account-management"],
|
|
"mitre": ["T1136.001"]
|
|
},
|
|
{
|
|
"id": "win-user-enabled",
|
|
"title": "Benutzerkonto aktiviert",
|
|
"description": "Windows Security Event 4722.",
|
|
"severity": "medium",
|
|
"score": 5.5,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"channels": ["Security"],
|
|
"event_codes": [4722],
|
|
"group_by": ["host", "user"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "Benutzerkonto {user} auf {host} aktiviert",
|
|
"tags": ["windows", "account-management"],
|
|
"mitre": []
|
|
},
|
|
{
|
|
"id": "win-password-reset",
|
|
"title": "Passwort eines Kontos zurückgesetzt",
|
|
"description": "Windows Security Event 4724.",
|
|
"severity": "medium",
|
|
"score": 6.2,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"channels": ["Security"],
|
|
"event_codes": [4724],
|
|
"group_by": ["host", "user"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "Passwort für {user} auf {host} zurückgesetzt",
|
|
"tags": ["windows", "account-management", "credential"],
|
|
"mitre": ["T1098"]
|
|
},
|
|
{
|
|
"id": "win-user-deleted",
|
|
"title": "Benutzerkonto gelöscht",
|
|
"description": "Windows Security Event 4726.",
|
|
"severity": "medium",
|
|
"score": 5.8,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"channels": ["Security"],
|
|
"event_codes": [4726],
|
|
"group_by": ["host", "user"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "Benutzerkonto {user} auf {host} gelöscht",
|
|
"tags": ["windows", "account-management"],
|
|
"mitre": []
|
|
}
|
|
]
|
|
}
|