Skip to content

Commit bedeaed

Browse files
w0rk3rtradebot-elastic
w0rk3r
authored and
tradebot-elastic
committed
[Security Content] Windows Setup Guides - WinEventLog & Sysmon (#5162)
* [Security Content] Windows Setup Guides * Move it to the right folder * Fix link * test * ++ * ++ * ++ * ++ * ++ * ++ * ++ * ++ * Fix links * ++ * ++ * Update pyproject.toml * Update docs/audit_policies/windows/sysmon_eventid1_process_creation.md Co-authored-by: Copilot <[email protected]> * Update docs/audit_policies/windows/audit_powershell_scriptblock.md Co-authored-by: Copilot <[email protected]> * Update pyproject.toml --------- Co-authored-by: Copilot <[email protected]> (cherry picked from commit a2bf7f0)
1 parent f7b4a96 commit bedeaed

34 files changed

+1374
-2
lines changed

‎docs/audit_policies/windows/README.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Windows Audit Policies
2+
3+
Windows related audit policies that need to be implemented in order to generate the events that power our detection rules. It serves as a centralized view of the policies we use so you don't need to go through every rule to know the different audit policies required.
4+
5+
Audit Policies:
6+
7+
* [Audit Authorization Policy Change](audit_authorization_policy_change.md)
8+
* [Audit Computer Account Management](audit_computer_account_management.md)
9+
* [Audit Detailed File Share](audit_detailed_file_share.md)
10+
* [Audit Directory Service Access](audit_directory_service_access.md)
11+
* [Audit Directory Service Changes](audit_directory_service_changes.md)
12+
* [Audit Filtering Platform Connection](audit_filtering_platform_connection.md)
13+
* [Audit Filtering Platform Packet Drop](audit_filtering_platform_packet_drop.md)
14+
* [Audit Handle Manipulation](audit_handle_manipulation.md)
15+
* [Audit Logon](audit_logon.md)
16+
* [Audit Other Object Access Events](audit_other_object_access_events.md)
17+
* [Audit Policy Change](audit_policy_change.md)
18+
* [Audit Process Creation and Command Line](audit_process_creation_and_command_line.md)
19+
* [Audit Security Group Management](audit_security_group_management.md)
20+
* [Audit Security System Extension](audit_security_system_extension.md)
21+
* [Audit Sensitive Privilege Use](audit_sensitive_privilege_use.md)
22+
* [Audit Special Logon](audit_special_logon.md)
23+
* [Audit Token Right Adjusted Events](audit_token_right_adjusted_events.md)
24+
* [Audit User Account Management](audit_user_account_management.md)
25+
* [Audit Powershell Script Block Logging](audit_powershell_scriptblock.md)
26+
27+
---
28+
29+
# Sysmon Configuration Guides
30+
31+
**Caution:** The following guides provide minimal configuration examples designed to enable specific Sysmon Event IDs. Collecting Sysmon events without a tailored configuration for your environment will cause high data volume and potentially high CPU-load, and these setup instructions require significant tuning to be production-ready.
32+
33+
To build an efficient and production-ready configuration, we strongly recommend exploring these community resources:
34+
35+
- [TrustedSec Sysmon Community Guide](https://github.com/trustedsec/SysmonCommunityGuide)
36+
- [olafhartong - sysmon-modular](https://github.com/olafhartong/sysmon-modular)
37+
- [Neo23x0 - sysmon-config](https://github.com/Neo23x0/sysmon-config)
38+
39+
For a production-ready and more integrated solution that is designed to work with our detection rules and also provide native Endpoint Protection and Response, check out [Elastic Endpoint Security](https://www.elastic.co/security/endpoint-security).
40+
41+
* [Sysmon Event ID 1: Process Creation](sysmon_eventid1_process_creation.md)
42+
* [Sysmon Event ID 2: File Creation Time Changed](sysmon_eventid2_file_creation_time_changed.md)
43+
* [Sysmon Event ID 3: Network Connection](sysmon_eventid3_network_connection.md)
44+
* [Sysmon Event ID 7: Image Loaded](sysmon_eventid7_image_loaded.md)
45+
* [Sysmon Event ID 8: Create Remote Thread](sysmon_eventid8_createremotethread.md)
46+
* [Sysmon Event ID 10: Process Accessed](sysmon_eventid10_process_access.md)
47+
* [Sysmon Event ID 11: File Create](sysmon_eventid11_file_create.md)
48+
* [Sysmon Event IDs 12, 13, 14: Registry Events](sysmon_eventid12_13_14_registry_event.md)
49+
* [Sysmon Event IDs 17, 18: Named Pipe Events](sysmon_eventid17_18_pipe_event.md)
50+
* [Sysmon Event IDs 19, 20, 21: WMI Events](sysmon_eventid19_20_21_wmi_event.md)
51+
* [Sysmon Event ID 22: DNS Query](sysmon_eventid22_dns_query.md)
52+
* [Sysmon Event ID 23: File Delete](sysmon_eventid23_file_delete.md)

‎docs/audit_policies/windows/audit_authorization_policy_change.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Audit Authorization Policy Change
2+
3+
## Setup
4+
5+
Some detection rules require monitoring changes to authorization policies to detect unauthorized modifications or misconfigurations. Enabling this setting ensures visibility into changes affecting user rights and security policies, helping maintain compliance and security.
6+
7+
**Caution:** Enabling this audit policy can generate a high volume of events. Evaluate the audit policy in a group of servers to measure volume and filter unwanted events before deploying in the entire domain.
8+
9+
### Enable Audit Policy via Group Policy
10+
11+
To enable `Audit Authorization Policy Change` across a group of servers using Active Directory Group Policies, administrators must enable the `Audit Authorization Policy Change` policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
12+
13+
```
14+
Computer Configuration >
15+
Windows Settings >
16+
Security Settings >
17+
Advanced Audit Policy Configuration >
18+
Audit Policies >
19+
Policy Change >
20+
Audit Authorization Policy Change (Success,Failure)
21+
```
22+
23+
### Enable Locally using auditpol
24+
25+
To enable this policy on a local machine, run the following command in an elevated command prompt:
26+
27+
```
28+
auditpol.exe /set /subcategory:"Authorization Policy Change" /success:enable /failure:enable
29+
```
30+
31+
## Event IDs
32+
33+
When this audit policy is enabled, the following event IDs may be generated:
34+
35+
* **4703**: A user right was adjusted.
36+
* **4704**: A user right was assigned.
37+
* **4705**: A user right was removed.
38+
* **4670**: Permissions on an object were changed.
39+
* **4911**: Resource attributes of the object were changed.
40+
* **4913**: Central Access Policy on the object was changed.
41+
42+
## Related Rules
43+
44+
Use the following GitHub search to identify rules that use the events listed:
45+
46+
[Elastic Detection Rules Github Repo Search](https://github.com/search?q=repo%3Aelastic%2Fdetection-rules+%22Windows+Security+Event+Logs%22+AND+%28%224703%22+OR+%22Token+Right+Adjusted+Events%22+OR+%224704%22+OR+%22user-right-assigned%22+OR+%224705%22+OR+%22user-right-removed%22+OR+%224670%22+OR+%22permissions-changed%22+OR+%224911%22+OR+%224913%22%29++language%3ATOML&type=code)

‎docs/audit_policies/windows/audit_computer_account_management.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Audit Computer Account Management
2+
3+
## Setup
4+
5+
Some detection rules require monitoring computer account management events to track changes to computer accounts in the domain. Enabling this setting provides visibility into when computer accounts are created, changed, or deleted, which is crucial for detecting potential malicious activity like adding unauthorized computer accounts.
6+
7+
### Enable Audit Policy via Group Policy
8+
9+
To enable `Audit Computer Account Management` events across a group of servers using Active Directory Group Policies, administrators must enable the `Audit Computer Account Management` policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
10+
11+
```
12+
Computer Configuration >
13+
Policies >
14+
Windows Settings >
15+
Security Settings >
16+
Advanced Audit Policies Configuration >
17+
Audit Policies >
18+
Account Management >
19+
Audit Computer Account Management (Success,Failure)
20+
```
21+
22+
### Enable Locally using auditpol
23+
24+
To enable this policy on a local machine, run the following command in an elevated command prompt:
25+
26+
```
27+
auditpol.exe /set /subcategory:"Computer Account Management" /success:enable /failure:enable
28+
```
29+
30+
## Event IDs
31+
32+
When this audit policy is enabled, the following event IDs may be generated:
33+
34+
* **4741**: A computer account was created.
35+
* **4742**: A computer account was changed.
36+
* **4743**: A computer account was deleted.
37+
38+
## Related Rules
39+
40+
Use the following GitHub search to identify rules that use the events listed:
41+
42+
[Elastic Detection Rules Github Repo Search](https://github.com/search?q=repo%3Aelastic%2Fdetection-rules+%22Windows+Security+Event+Logs%22+AND+%28%224741%22+OR+%22added-computer-account%22+OR+%224742%22+OR+%22changed-computer-account%22+OR+%224743%22+OR+%22deleted-computer-account%22%29+language%3ATOML+AND+NOT+%28%22%28for+example%2C+4741%29%22+OR+%22Review+the+event+ID+4741%22+OR+%22e.g.%2C+4741%22%29&type=code)

‎docs/audit_policies/windows/audit_detailed_file_share.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Audit Detailed File Share
2+
3+
## Setup
4+
5+
Some detection rules require monitoring file share access to detect unauthorized access attempts or modifications. Enabling this setting helps improve security visibility and ensures compliance by tracking access to shared files and folders.
6+
7+
**Caution:** Enabling this audit policy can generate a high volume of events. Evaluate the audit policy in a group of servers to measure volume and filter unwanted events before deploying in the entire domain.
8+
9+
### Enable Audit Policy via Group Policy
10+
11+
To enable `Audit Detailed File Share` across a group of servers using Active Directory Group Policies, administrators must enable the `Audit Detailed File Share` policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
12+
13+
```
14+
Computer Configuration >
15+
Policies >
16+
Windows Settings >
17+
Security Settings >
18+
Advanced Audit Policies Configuration >
19+
Audit Policies >
20+
Object Access >
21+
Audit Detailed File Share (Success,Failure)
22+
```
23+
24+
### Enable Locally using auditpol
25+
26+
To enable this policy on a local machine, run the following command in an elevated command prompt:
27+
28+
```
29+
auditpol.exe /set /subcategory:"File Share" /success:enable /failure:disable
30+
```
31+
32+
## Event IDs
33+
34+
When this audit policy is enabled, the following event IDs may be generated:
35+
36+
* **5145**: A network share object was checked to see whether client can be granted desired access.
37+
38+
## Related Rules
39+
40+
Use the following GitHub search to identify rules that use the events listed:
41+
42+
[Elastic Detection Rules Github Repo Search](https://github.com/search?q=repo%3Aelastic%2Fdetection-rules+%22Windows+Security+Event+Logs%22+AND+%28%225145%22+OR+%22network-share-object-access-checked%22%29++language%3ATOML&type=code)

‎docs/audit_policies/windows/audit_directory_service_access.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Audit Directory Service Access
2+
3+
## Setup
4+
5+
Some detection rules require configuring audit policies to generate events when Active Directory objects are accessed. These audit policies apply exclusively to Domain Controllers, as other servers do not produce events related to Active Directory object modifications.
6+
7+
**Caution:** Enabling this audit policy can generate a high volume of events. Evaluate the audit policy in a group of servers to measure volume and filter unwanted events before deploying in the entire domain.
8+
9+
### Enable Audit Policy via Group Policy
10+
11+
To enable `Audit Directory Service Access` on all Domain Controllers via Group Policy, administrators must enable the `Audit Directory Service Access` policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
12+
13+
```
14+
Computer Configuration >
15+
Policies >
16+
Windows Settings >
17+
Security Settings >
18+
Advanced Audit Policies Configuration >
19+
Audit Policies >
20+
DS Access >
21+
Audit Directory Service Access (Success,Failure)
22+
```
23+
24+
### Enable Locally using auditpol
25+
26+
To enable this policy on a local machine, run the following command in an elevated command prompt:
27+
28+
```
29+
auditpol.exe /set /subcategory:"Directory Service Access" /success:enable /failure:enable
30+
```
31+
32+
## Event IDs
33+
34+
When this audit policy is enabled, the following event IDs may be generated:
35+
36+
* **4661**: A handle to an object was requested.
37+
* **4662**: An operation was performed on an object.
38+
39+
## Related Rules
40+
41+
Use the following GitHub search to identify rules that use the events listed:
42+
43+
[Elastic Detection Rules Github Repo Search](https://github.com/search?q=repo%3Aelastic%2Fdetection-rules+%22Windows+Security+Event+Logs%22+AND+%28%224661%22+OR+%224662%22+OR+%22object-operation-performed%22%29++language%3ATOML&type=code)

‎docs/audit_policies/windows/audit_directory_service_changes.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Audit Directory Service Changes
2+
3+
## Setup
4+
5+
Some detection rules require configuring audit policies to generate events when Active Directory objects are modified. These audit policies apply exclusively to Domain Controllers, as other servers do not produce events related to Active Directory object modifications.
6+
7+
**Caution:** Enabling this audit policy can generate a high volume of events. Evaluate the audit policy in a group of servers to measure volume and filter unwanted events before deploying in the entire domain.
8+
9+
### Enable Audit Policy via Group Policy
10+
11+
To enable `Audit Directory Service Changes` on all Domain Controllers via Group Policy, administrators must enable the `Audit Directory Service Changes` policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
12+
13+
```
14+
Computer Configuration >
15+
Policies >
16+
Windows Settings >
17+
Security Settings >
18+
Advanced Audit Policies Configuration >
19+
Audit Policies >
20+
DS Access >
21+
Audit Directory Service Changes (Success,Failure)
22+
```
23+
24+
### Enable Locally using auditpol
25+
26+
To enable this policy on a local machine, run the following command in an elevated command prompt:
27+
28+
```
29+
auditpol.exe /set /subcategory:"Directory Service Changes" /success:enable /failure:enable
30+
```
31+
32+
### Additional Settings
33+
34+
The `Audit Directory Service Changes` policy does not cover all objects monitored by the detection rules. To address these gaps, in addition to enabling the audit policy, configure additional Access Control Entries (ACEs) using [Set-AuditRule](https://github.com/OTRF/Set-AuditRule) to ensure proper monitoring.
35+
36+
Below is a list of example Audit Rules. Modify them to match the Distinguished Names specific to your environment:
37+
38+
Audit changes on the MicrosoftDNS object:
39+
40+
```
41+
Set-AuditRule -AdObjectPath 'AD:\\CN=MicrosoftDNS,DC=DomainDNSZones,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights CreateChild -InheritanceFlags Descendents -AttributeGUID e0fa1e8c-9b45-11d0-afdd-00c04fd930c9 -AuditFlags Success
42+
```
43+
44+
Audit changes on the msDS-KeyCredentialLink attribute of User objects:
45+
46+
```
47+
Set-AuditRule -AdObjectPath 'AD:\\CN=Users,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights WriteProperty -InheritanceFlags Children -AttributeGUID 5b47d60f-6090-40b2-9f37-2a4de88f3063 -AuditFlags Success
48+
```
49+
50+
Audit changes on the servicePrincipalName attribute of User objects:
51+
52+
```
53+
Set-AuditRule -AdObjectPath 'AD:\\CN=Users,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights WriteProperty -InheritanceFlags Children -AttributeGUID f3a64788-5306-11d1-a9c5-0000f80367c1 -AuditFlags Success
54+
```
55+
56+
## Event IDs
57+
58+
When this audit policy is enabled, the following event IDs may be generated:
59+
60+
* **5136**: A directory service object was modified.
61+
* **5137**: A directory service object was created.
62+
* **5138**: A directory service object was undeleted.
63+
* **5139**: A directory service object was moved.
64+
* **5141**: A directory service object was deleted.
65+
66+
## Related Rules
67+
68+
Use the following GitHub search to identify rules that use the events listed:
69+
70+
[Elastic Detection Rules Github Repo Search](https://github.com/search?q=repo%3Aelastic%2Fdetection-rules+%22Windows+Security+Event+Logs%22+AND+%28%225136%22+OR+%22directory-service-object-modified%22+OR+%225137%22+OR+%225138%22+OR+%225139%22+OR+%225141%22%29++language%3ATOML&type=code)

‎docs/audit_policies/windows/audit_filtering_platform_connection.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# Audit Filtering Platform Connection
2+
3+
## Setup
4+
5+
Some detection rules require monitoring network connections managed by the Windows Filtering Platform (WFP) to detect unauthorized or suspicious network activity.
6+
7+
**Caution:** Enabling this audit policy can generate a high volume of events. Evaluate the audit policy in a group of servers to measure volume and filter unwanted events before deploying in the entire domain.
8+
9+
### Enable Audit Policy via Group Policy
10+
11+
To enable `Audit Filtering Platform Connection` across a group of servers using Active Directory Group Policies, administrators must enable the `Audit Filtering Platform Connection` policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
12+
13+
```
14+
Computer Configuration >
15+
Windows Settings >
16+
Security Settings >
17+
Advanced Security Audit Policy Settings >
18+
Audit Policies >
19+
Object Access >
20+
Audit Filtering Platform Connection (Success,Failure)
21+
```
22+
23+
### Enable Locally using auditpol
24+
25+
To enable this policy on a local machine, run the following command in an elevated command prompt:
26+
27+
```
28+
auditpol.exe /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable
29+
```
30+
31+
## Event IDs
32+
33+
When this audit policy is enabled, the following event IDs may be generated:
34+
35+
* **5031**: The Windows Firewall Service blocked an application from accepting incoming connections on the network.
36+
* **5150**: The Windows Filtering Platform blocked a packet.
37+
* **5151**: A more restrictive Windows Filtering Platform filter has blocked a packet.
38+
* **5154**: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
39+
* **5155**: The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
40+
* **5156**: The Windows Filtering Platform has permitted a connection.
41+
* **5157**: The Windows Filtering Platform has blocked a connection.
42+
* **5158**: The Windows Filtering Platform has permitted a bind to a local port.
43+
* **5159**: The Windows Filtering Platform has blocked a bind to a local port.
44+
45+
## Related Rules
46+
47+
Use the following GitHub search to identify rules that use the events listed:
48+
49+
[Elastic Detection Rules Github Repo Search](https://github.com/search?q=repo%3Aelastic%2Fdetection-rules+%22Windows+Security+Event+Logs%22+AND+%28%225031%22+OR+%225150%22+OR+%225151%22+OR+%225154%22+OR+%225155%22+OR+%225156%22+OR+%22windows-firewall-connection%22+OR+%225157%22+OR+%22windows-firewall-packet-block%22+OR+%225158%22+OR+%22windows-firewall-bind-local-port%22+OR+%225159%22%29+language%3ATOML+AND+NOT+%28%224605157a5b80%22+OR+%225151a804f31b%22%29&type=code)

‎docs/audit_policies/windows/audit_filtering_platform_packet_drop.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Audit Filtering Platform Packet Drop
2+
3+
## Setup
4+
5+
Some detection rules require monitoring Filtering Platform Packet Drop events to detect when network packets are being dropped by the Windows Filtering Platform (WFP). Enabling this setting provides visibility into network traffic that is being blocked, which can be an indicator of malicious activity or network reconnaissance.
6+
7+
**Caution:** Enabling this audit policy can generate a high volume of events. Evaluate the audit policy in a group of servers to measure volume and filter unwanted events before deploying in the entire domain.
8+
9+
### Enable Audit Policy via Group Policy
10+
11+
To enable `Audit Filtering Platform Packet Drop` events across a group of servers using Active Directory Group Policies, administrators must enable the `Audit Filtering Platform Packet Drop` policy. Follow these steps to configure the audit policy via Advanced Audit Policy Configuration:
12+
13+
```
14+
Computer Configuration >
15+
Policies >
16+
Windows Settings >
17+
Security Settings >
18+
Advanced Audit Policies Configuration >
19+
Audit Policies >
20+
Object Access >
21+
Audit Filtering Platform Packet Drop (Success,Failure)
22+
```
23+
24+
### Enable Locally using auditpol
25+
26+
To enable this policy on a local machine, run the following command in an elevated command prompt:
27+
28+
```
29+
auditpol.exe /set /subcategory:"Filtering Platform Packet Drop" /success:enable /failure:enable
30+
```
31+
32+
## Event IDs
33+
34+
When this audit policy is enabled, the following event IDs may be generated:
35+
36+
* **5152**: The Windows Filtering Platform blocked a packet.
37+
* **5153**: A more restrictive Windows Filtering Platform filter has blocked a packet.
38+
39+
## Related Rules
40+
41+
Use the following GitHub search to identify rules that use the events listed:
42+
43+
[Elastic Detection Rules Github Repo Search](https://github.com/search?q=repo%3Aelastic%2Fdetection-rules+%22Windows+Security+Event+Logs%22+AND+%28%225152%22+OR+%22windows-firewall-packet-drop%22+OR+%225153%22%29+language%3ATOML+AND+NOT+%28%22%28for+example%2C+5152%29%22+OR+%22Review+the+event+ID+5152%22+OR+%22e.g.%2C+5152%22%29&type=code)

0 commit comments

Comments
 (0)