82 lines
2.9 KiB
JSON
82 lines
2.9 KiB
JSON
{
|
|
"id": "windows-defender-powershell",
|
|
"name": "Windows Defender & PowerShell",
|
|
"description": "Malware-, Defender- und auffällige PowerShell-Signale.",
|
|
"version": 1,
|
|
"enabled": true,
|
|
"rules": [
|
|
{
|
|
"id": "defender-malware-detected",
|
|
"title": "Microsoft Defender Malware erkannt",
|
|
"description": "Defender Operational Event 1116.",
|
|
"severity": "high",
|
|
"score": 8.8,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"event_codes": [1116],
|
|
"conditions": [{"field": "provider", "operator": "contains", "value": "Defender"}],
|
|
"group_by": ["host"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 1800,
|
|
"summary": "Microsoft Defender meldet Malware auf {host}",
|
|
"tags": ["windows", "defender", "malware"],
|
|
"mitre": []
|
|
},
|
|
{
|
|
"id": "defender-realtime-protection-disabled",
|
|
"title": "Defender Echtzeitschutz deaktiviert",
|
|
"description": "Defender Operational Event 5001.",
|
|
"severity": "critical",
|
|
"score": 9.0,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"event_codes": [5001],
|
|
"conditions": [{"field": "provider", "operator": "contains", "value": "Defender"}],
|
|
"group_by": ["host"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 1800,
|
|
"summary": "Microsoft Defender Echtzeitschutz auf {host} deaktiviert",
|
|
"tags": ["windows", "defender", "defense-evasion"],
|
|
"mitre": ["T1562.001"]
|
|
},
|
|
{
|
|
"id": "powershell-encoded-command",
|
|
"title": "PowerShell EncodedCommand",
|
|
"description": "PowerShell-Nachricht oder Kommandozeile enthält EncodedCommand.",
|
|
"severity": "high",
|
|
"score": 8.0,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"event_codes": [4104, 4688],
|
|
"conditions": [{"field": "message", "operator": "contains", "value": "EncodedCommand"}],
|
|
"group_by": ["host", "user"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "PowerShell EncodedCommand auf {host} durch {user}",
|
|
"tags": ["windows", "powershell", "execution"],
|
|
"mitre": ["T1059.001", "T1027"]
|
|
},
|
|
{
|
|
"id": "powershell-download-cradle",
|
|
"title": "PowerShell Download-/Execution-Muster",
|
|
"description": "PowerShell ScriptBlock enthält typische Download- oder In-Memory-Execution-Muster.",
|
|
"severity": "high",
|
|
"score": 8.4,
|
|
"enabled": true,
|
|
"kind": "event",
|
|
"event_codes": [4104],
|
|
"conditions": [{"field": "message", "operator": "regex", "value": "(?i)(DownloadString|DownloadFile|Invoke-WebRequest|FromBase64String|IEX\\s*\\()"}],
|
|
"group_by": ["host", "user"],
|
|
"threshold": 1,
|
|
"window_seconds": 300,
|
|
"suppress_seconds": 900,
|
|
"summary": "Auffälliges PowerShell Download-/Execution-Muster auf {host} durch {user}",
|
|
"tags": ["windows", "powershell", "execution"],
|
|
"mitre": ["T1059.001", "T1105"]
|
|
}
|
|
]
|
|
}
|