103 lines
3.5 KiB
JSON
103 lines
3.5 KiB
JSON
{
|
||
"id": "windows-authentication",
|
||
"name": "Windows Authentication",
|
||
"description": "Anmelde-, Lockout-, Spray- und Kerberos/NTLM-Erkennungen.",
|
||
"version": 1,
|
||
"enabled": true,
|
||
"rules": [
|
||
{
|
||
"id": "win-account-lockout",
|
||
"title": "Account Lockout",
|
||
"description": "Windows Security Event 4740.",
|
||
"severity": "medium",
|
||
"score": 5.5,
|
||
"enabled": true,
|
||
"kind": "event",
|
||
"channels": ["Security"],
|
||
"event_codes": [4740],
|
||
"group_by": ["host", "user", "workstation"],
|
||
"threshold": 1,
|
||
"window_seconds": 600,
|
||
"suppress_seconds": 900,
|
||
"summary": "Account-Lockout: {user}; Caller {workstation}; DC/Host {host} ({count}×)",
|
||
"tags": ["windows", "authentication", "lockout"],
|
||
"mitre": []
|
||
},
|
||
{
|
||
"id": "win-failed-logon-burst",
|
||
"title": "Viele fehlgeschlagene Anmeldungen",
|
||
"description": "Mindestens 20 Event-4625-Ereignisse für denselben Kontext in fünf Minuten.",
|
||
"severity": "high",
|
||
"score": 7.5,
|
||
"enabled": true,
|
||
"kind": "threshold",
|
||
"channels": ["Security"],
|
||
"event_codes": [4625],
|
||
"group_by": ["host", "user", "source_ip"],
|
||
"threshold": 20,
|
||
"window_seconds": 300,
|
||
"suppress_seconds": 900,
|
||
"summary": "{count} fehlgeschlagene Logons für {user} auf {host} von {source_ip}",
|
||
"tags": ["windows", "authentication", "brute-force"],
|
||
"mitre": ["T1110"]
|
||
},
|
||
{
|
||
"id": "win-password-spray",
|
||
"title": "Password Spray",
|
||
"description": "Eine Source-IP versucht viele unterschiedliche Konten anzumelden.",
|
||
"severity": "high",
|
||
"score": 8.5,
|
||
"enabled": true,
|
||
"kind": "distinct",
|
||
"channels": ["Security"],
|
||
"event_codes": [4625],
|
||
"conditions": [{"field": "source_ip", "operator": "exists"}, {"field": "target_user", "operator": "exists"}],
|
||
"group_by": ["source_ip"],
|
||
"threshold": 20,
|
||
"distinct_field": "target_user",
|
||
"distinct_threshold": 10,
|
||
"window_seconds": 600,
|
||
"suppress_seconds": 1800,
|
||
"summary": "Password-Spray von {source_ip}: {count} Versuche gegen {distinct} Benutzer",
|
||
"tags": ["windows", "authentication", "password-spray"],
|
||
"mitre": ["T1110.003"]
|
||
},
|
||
{
|
||
"id": "win-kerberos-preauth-burst",
|
||
"title": "Kerberos Pre-Auth Fehler-Burst",
|
||
"description": "Viele Event-4771-Ereignisse für denselben Benutzer oder Quellkontext.",
|
||
"severity": "high",
|
||
"score": 7.4,
|
||
"enabled": true,
|
||
"kind": "threshold",
|
||
"channels": ["Security"],
|
||
"event_codes": [4771],
|
||
"group_by": ["host", "user", "source_ip"],
|
||
"threshold": 15,
|
||
"window_seconds": 300,
|
||
"suppress_seconds": 900,
|
||
"summary": "{count} Kerberos Pre-Auth Fehler für {user} auf {host} von {source_ip}",
|
||
"tags": ["windows", "kerberos", "authentication"],
|
||
"mitre": ["T1110"]
|
||
},
|
||
{
|
||
"id": "win-ntlm-auth-failure-burst",
|
||
"title": "NTLM Authentifizierungsfehler-Burst",
|
||
"description": "Viele Event-4776-Ereignisse im kurzen Zeitraum.",
|
||
"severity": "high",
|
||
"score": 7.2,
|
||
"enabled": true,
|
||
"kind": "threshold",
|
||
"channels": ["Security"],
|
||
"event_codes": [4776],
|
||
"group_by": ["host", "user", "workstation"],
|
||
"threshold": 15,
|
||
"window_seconds": 300,
|
||
"suppress_seconds": 900,
|
||
"summary": "{count} NTLM-Authentifizierungsfehler für {user} über {workstation}",
|
||
"tags": ["windows", "ntlm", "authentication"],
|
||
"mitre": ["T1110"]
|
||
}
|
||
]
|
||
}
|