Skip to content

Commit 00185b9

Browse files
author
ionstorm
committed
Fix some inactive/broken rules and filtering
1 parent baaf02d commit 00185b9

File tree

1 file changed

+17
-18
lines changed

1 file changed

+17
-18
lines changed

‎sysmonconfig-export.xml

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -304,10 +304,7 @@
304304
</Rule>
305305
<Rule name="Attack=T1059,Technique=Scripting,Tactic=Execution,DS=Process: Process Creation,Level=2,Alert=Suspicious wscript commands,Risk=60" groupRelation="and">
306306
<Image condition="image">wscript.exe</Image>
307-
<CommandLine condition="contains">.jse</CommandLine>
308-
<CommandLine condition="contains">.js</CommandLine>
309-
<CommandLine condition="contains">.vba</CommandLine>
310-
<CommandLine condition="contains">.vbe</CommandLine>
307+
<CommandLine condition="contains any">.jse;.js;.vba;.vbe</CommandLine>
311308
</Rule>
312309
<Rule name="Attack=T1059,Technique=Scripting,Tactic=Execution,DS=Process: Process Creation,Level=3,Alert=Suspicious scripting to dll commands,Risk=70" groupRelation="and">
313310
<ParentImage condition="contains any">\wscript.exe;\cscript.exe</ParentImage>
@@ -321,10 +318,7 @@
321318
</Rule>
322319
<Rule name="Attack=T1059,Technique=Scripting,Tactic=Execution,DS=Process: Process Creation,Level=2,Alert=cscript execution,Risk=60" groupRelation="and">
323320
<Image condition="image">cscript.exe</Image>
324-
<CommandLine condition="contains">.js</CommandLine>
325-
<CommandLine condition="contains">.jse</CommandLine>
326-
<CommandLine condition="contains">.vba</CommandLine>
327-
<CommandLine condition="contains">.vbe</CommandLine>
321+
<CommandLine condition="contains any">.jse;.js;.vba;.vbe</CommandLine>
328322
</Rule>
329323
<Rule name="Attack=T1059,Technique=Scripting,Tactic=Execution,DS=Process: Process Creation,Level=4,Alert=Suspicious or Malicious mshta exec,Risk=70" groupRelation="and">
330324
<CommandLine condition="contains any">mshta vbscript:CreateObject("Wscript.Shell");mshta vbscript:Execute("Execute;mshta vbscript:CreateObject("Wscript.Shell").Run("mshta.exe;javascript:a=</CommandLine>
@@ -2484,10 +2478,10 @@
24842478
<CommandLine condition="image">start-bitstransfer</CommandLine>
24852479
</Rule>
24862480
<Rule name="Attack=T1105,Technique=Ingress Tool Transfer,Tactic=Command And Control,DS=Process: Process Creation,Level=4,Alert=Expand File copy,Risk=70" groupRelation="and">
2487-
<CommandLine condition="contains">expand \\</CommandLine>
2481+
<CommandLine condition="contains all">expand;\\</CommandLine>
24882482
</Rule>
24892483
<Rule name="Attack=T1105,Technique=Ingress Tool Transfer,Tactic=Command And Control,DS=Process: Process Creation,Level=4,Alert=Expand File copy,Risk=70" groupRelation="and">
2490-
<CommandLine condition="contains">expand.exe \\</CommandLine>
2484+
<CommandLine condition="contains all">expand.exe;\\</CommandLine>
24912485
</Rule>
24922486
<Rule name="Attack=T1105,Technique=Ingress Tool Transfer,Tactic=Command And Control,DS=Process: Process Creation,Level=4,Alert=Ingress Tool Transfer with ieexec,Risk=70" groupRelation="and">
24932487
<CommandLine condition="contains">ieexec http</CommandLine>
@@ -2505,10 +2499,10 @@
25052499
<CommandLine condition="contains any">esentutl.exe /y \\;esentutl.exe -y \\</CommandLine>
25062500
</Rule>
25072501
<Rule name="Attack=T1105,Technique=Ingress Tool Transfer,Tactic=Command And Control,DS=Process: Process Creation,Level=4,Alert=extrac32 Ingress Tool Transfer,Risk=70" groupRelation="and">
2508-
<CommandLine condition="contains">extrac32 \\</CommandLine>
2502+
<CommandLine condition="contains all">extrac32;\\</CommandLine>
25092503
</Rule>
25102504
<Rule name="Attack=T1105,Technique=Ingress Tool Transfer,Tactic=Command And Control,DS=Process: Process Creation,Level=4,Alert=extrac32 Ingress Tool Transfer,Risk=70" groupRelation="and">
2511-
<CommandLine condition="contains">extrac32.exe \\</CommandLine>
2505+
<CommandLine condition="contains all">extrac32.exe;\\</CommandLine>
25122506
</Rule>
25132507
<!--MITRE ATT&CK TECHNIQUE: Multi-Stage Channels-->
25142508
<!--MITRE ATT&CK TECHNIQUE: Non-Application Layer Protocol-->
@@ -2650,10 +2644,16 @@
26502644
<CommandLine condition="contains">erase</CommandLine>
26512645
</Rule>
26522646
<Rule name="Attack=None,Technique=None,Tactic=None,DS=Process: Process Creation,Level=2,Alert=vShadow Commands" groupRelation="and">
2653-
<CommandLine condition="contains">-nw -exec=</CommandLine>
2647+
<CommandLine condition="contains all">-nw;-exec=</CommandLine>
2648+
</Rule>
2649+
<Rule name="Attack=None,Technique=None,Tactic=None,DS=Process: Process Creation,Level=2,Alert=vShadow Commands" groupRelation="and">
2650+
<CommandLine condition="contains all">/nw;/exec=</CommandLine>
2651+
</Rule>
2652+
<Rule name="Attack=None,Technique=None,Tactic=None,DS=Process: Process Creation,Level=0,Alert=vShadow Commands" groupRelation="and">
2653+
<CommandLine condition="contains all">-p;-nw</CommandLine>
26542654
</Rule>
26552655
<Rule name="Attack=None,Technique=None,Tactic=None,DS=Process: Process Creation,Level=0,Alert=vShadow Commands" groupRelation="and">
2656-
<CommandLine condition="contains">-p -nw</CommandLine>
2656+
<CommandLine condition="contains all">/p;/nw</CommandLine>
26572657
</Rule>
26582658
<Rule name="Attack=T1485,Technique=Data Destruction,Tactic=Impact,DS=Process: Process Creation,Level=4,Alert=Data Destruction with shred Detected,Risk=100" groupRelation="and">
26592659
<Image condition="contains">shred</Image>
@@ -2678,8 +2678,7 @@
26782678
<!--MITRE ATT&CK TECHNIQUE: Disk Wipe-->
26792679
<Rule name="Attack=T1107,Technique=File Deletion,Tactic=Defense Evasion,DS=Process: Process Creation,Level=3,Alert=FSUtil USN Journal Deletion,Risk=60" groupRelation="and">
26802680
<Image condition="image">fsutil.exe</Image>
2681-
<CommandLine condition="contains">deletejournal</CommandLine>
2682-
<CommandLine condition="contains">usn</CommandLine>
2681+
<CommandLine condition="contains all">usn;deletejournal</CommandLine>
26832682
</Rule>
26842683
<!--MITRE ATT&CK TECHNIQUE: Endpoint Denial of Service-->
26852684
<!--MITRE ATT&CK TECHNIQUE: Firmware Corruption-->
@@ -2950,7 +2949,7 @@
29502949
<ParentImage condition="image">C:\Windows\System32\wbem\WmiPrvSE.exe</ParentImage>
29512950
</Rule>
29522951
<Rule name="exclude armoury Crate from cmdline file deletion rule" groupRelation="and">
2953-
<ParentImage condition="excludes">C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe</ParentImage>
2952+
<ParentImage condition="image">C:\Program Files\ASUS\ARMOURY CRATE Service\ArmouryCrate.Service.exe</ParentImage>
29542953
</Rule>
29552954
</ProcessCreate>
29562955
</RuleGroup>
@@ -9680,7 +9679,7 @@
96809679
<Image condition="begin with">C:\Users\</Image>
96819680
<Image condition="contains">Content.Outlook</Image>
96829681
</Rule>
9683-
<Rule name="Attack=T1036.008,Technique=Masquerading: Masquerade File Type,Tactic=Defense Evasion,DS=File: File Creation,Level=4,Alert=Pe File Detected under Unusual File extension,Risk=10" groupRelation="or">
9682+
<Rule name="Attack=T1036.008,Technique=Masquerading: Masquerade File Type,Tactic=Defense Evasion,DS=File: File Creation,Level=4,Alert=Pe File Detected under Unusual File extension,Risk=10" groupRelation="and">
96849683
<TargetFilename condition="not end with">.exe</TargetFilename>
96859684
<TargetFilename condition="not end with">.dll</TargetFilename>
96869685
<TargetFilename condition="not end with">.sys</TargetFilename>

0 commit comments

Comments
 (0)