kkkk

Author: v-amolpatil

Parsers/ASimRegistryEvent/Parsers/ASimRegistryEventMicrosoftSecurityEvent.yaml

@@ -1,7 +1,7 @@
 Parser:
     Title: Registry Event ASIM parser for Microsoft Windows Events (registry creation event)
     Version: "0.3.1"
-    LastUpdated: Jun 20, 2024
+    LastUpdated: Jun 21, 2024
 Product:
     Name: Security Events
 Normalization:

Parsers/ASimRegistryEvent/Parsers/vimRegistryEventMicrosoftSecurityEvent.yaml

@@ -1,7 +1,7 @@
 Parser:
     Title: Registry Event ASIM filtering parser for Microsoft Windows Events and Security Events (registry creation event)
     Version: "0.3.1"
-    LastUpdated: Jun 20, 2024
+    LastUpdated: Jun 21, 2024
 Product:
     Name: Security Events
 Normalization:

Sample Data/ASIM/Microsoft_Security Events_RegistryEvent_IngestedLogs.csv

@@ -13,7 +13,7 @@ TenantId,TimeGenerated,SourceSystem,Account,AccountType,Computer,EventSourceName
   <Data Name=""ProcessId"">0xef8</Data>
   <Data Name=""ProcessName"">C:\Program Files\Windows Defender Advanced Threat Protection\test.exe</Data>
   <Data Name=""ResourceAttributes"">-</Data>
-</EventData>",4657,4657 - An attempt was made to access an object.,,,,,,%%1537 ,0x10000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0x830,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,REG_NONE,%%1872,HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection\test\HeartBeats\EndpointErrors\0,Security,Key,REG_NONE,,,,,,REG_DWORD,%%1876,%%1906,,,,,,,,,,,MsTest.exe,0xef8,C:\Program Files\Windows Defender Advanced Threat Protection\MsTest.exe,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,test\abc005$,,,,test,,0x3e7,,,abc005$,S-1-5-18,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,LogAlways,ab4cf18f-60a7-4a88-8631-1cd2cb123456,ab4cf18f-60a7-4a88-8631-1cd2cb123456,00000000-0000-0000-0000-000000000001,6/24/2025 4:45,AOI-12345aea-6210-464b-a6dd-49f0fd95cef1,N/A,1,0,0x8020000000000000,,4,6952,693044958,SecurityEvent,/subscriptions/1abcd518-a6b8-4766-b099-d5c77b664f1d/resourcegroups/iam-test/providers/microsoft.compute/virtualmachines/abc005,cc
+</EventData>",4657,4657 - An attempt was made to access an object,,,,,,%%1537 ,0x10000,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0x830,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,REG_NONE,%%1872,HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Advanced Threat Protection\test\HeartBeats\EndpointErrors\0,Security,Key,REG_NONE,,,,,,REG_DWORD,%%1876,%%1906,,,,,,,,,,,MsTest.exe,0xef8,C:\Program Files\Windows Defender Advanced Threat Protection\MsTest.exe,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,test\abc005$,,,,test,,0x3e7,,,abc005$,S-1-5-18,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,LogAlways,ab4cf18f-60a7-4a88-8631-1cd2cb123456,ab4cf18f-60a7-4a88-8631-1cd2cb123456,00000000-0000-0000-0000-000000000001,6/24/2025 4:45,AOI-12345aea-6210-464b-a6dd-49f0fd95cef1,N/A,1,0,0x8020000000000000,,4,6952,693044958,SecurityEvent,/subscriptions/1abcd518-a6b8-4766-b099-d5c77b664f1d/resourcegroups/iam-test/providers/microsoft.compute/virtualmachines/abc005,cc
 12345aea-6210-464b-a6dd-49f0fd95cef1,6/24/2025 4:48,OpsManager,test\abc005$,Machine,abc005$.test.net,Microsoft-Windows-Security-Auditing,Security,12801,0,"<EventData xmlns=""http://schemas.microsoft.com/win/2004/08/events/event"">
   <Data Name=""SubjectUserSid"">S-1-5-18</Data>
    <Data Name=""SubjectUserName"">abc005$</Data>