99 lines
3.0 KiB
JSON
99 lines
3.0 KiB
JSON
{
|
|
"id": "windows-core",
|
|
"name": "Windows Core Security",
|
|
"description": "Hochwertige Windows-System- und Audit-Ereignisse mit geringer Grundlautstärke.",
|
|
"version": 1,
|
|
"enabled": true,
|
|
"rules": [
|
|
{
|
|
"id": "win-audit-log-cleared",
|
|
"title": "Security Audit Log gelöscht",
|
|
"description": "Windows Security Event 1102.",
|
|
"severity": "critical",
|
|
"score": 9.8,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"channels": ["Security"],
|
|
"event_codes": [1102],
|
|
"group_by": ["host"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "Security Audit Log auf {host} wurde gelöscht",
|
|
"tags": ["windows", "audit", "defense-evasion"],
|
|
"mitre": ["T1070.001"]
|
|
},
|
|
{
|
|
"id": "win-service-installed",
|
|
"title": "Neuer Windows-Dienst installiert",
|
|
"description": "Service Control Manager Event 7045.",
|
|
"severity": "high",
|
|
"score": 8.0,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"event_codes": [7045],
|
|
"group_by": ["host", "process_path"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "Neuer Dienst auf {host} installiert: {process}",
|
|
"tags": ["windows", "persistence", "service"],
|
|
"mitre": ["T1543.003"]
|
|
},
|
|
{
|
|
"id": "win-scheduled-task-created",
|
|
"title": "Scheduled Task erstellt",
|
|
"description": "Windows Security Event 4698.",
|
|
"severity": "high",
|
|
"score": 7.8,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"channels": ["Security"],
|
|
"event_codes": [4698],
|
|
"group_by": ["host", "user"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "Scheduled Task auf {host} durch {user} erstellt",
|
|
"tags": ["windows", "persistence", "scheduled-task"],
|
|
"mitre": ["T1053.005"]
|
|
},
|
|
{
|
|
"id": "win-audit-policy-changed",
|
|
"title": "Audit Policy geändert",
|
|
"description": "Windows Security Event 4719.",
|
|
"severity": "high",
|
|
"score": 8.2,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"channels": ["Security"],
|
|
"event_codes": [4719],
|
|
"group_by": ["host", "user"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "Audit Policy auf {host} durch {user} geändert",
|
|
"tags": ["windows", "audit", "policy"],
|
|
"mitre": ["T1562.002"]
|
|
},
|
|
{
|
|
"id": "win-firewall-rule-change",
|
|
"title": "Windows Firewall-Regel geändert",
|
|
"description": "Firewall-Regeln hinzugefügt, geändert oder gelöscht.",
|
|
"severity": "medium",
|
|
"score": 5.5,
|
|
"enabled": true,
|
|
"kind": "threshold",
|
|
"channels": ["Security"],
|
|
"event_codes": [4946, 4947, 4948],
|
|
"group_by": ["host", "user"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "Windows Firewall-Regel auf {host} geändert ({count} Ereignisse)",
|
|
"tags": ["windows", "firewall", "configuration"],
|
|
"mitre": ["T1562.004"]
|
|
}
|
|
]
|
|
}
|