Skip to content

Commit 827a80b

Browse files
MHaggisMHaggis
committed
datasource
1 parent b3d4d87 commit 827a80b

5 files changed

+105
-7
lines changed

‎data_sources/windows_event_log_application_15457.yml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: Windows Event Log Application 15457
2+
id: 4491537e-520c-46f7-9209-f56f852aa237
3+
version: 1
4+
date: '2025-03-04'
5+
author: Michael Haag, Splunk
6+
description: Data source object for Windows Event Log Application 15457
7+
source: XmlWinEventLog:Application
8+
sourcetype: XmlWinEventLog
9+
separator: EventCode
10+
supported_TA:
11+
- name: Splunk Add-on for Microsoft Windows
12+
url: https://splunkbase.splunk.com/app/742
13+
version: 9.0.1
14+
fields:
15+
- CategoryString
16+
- Channel
17+
- Computer
18+
- Error_Code
19+
- EventCode
20+
- EventData_Xml
21+
- EventID
22+
- EventRecordID
23+
- Guid
24+
- Image_File_Name
25+
- Keywords
26+
- Level
27+
- Name
28+
- Opcode
29+
- ProcessID
30+
- Qualifiers
31+
- RecordNumber
32+
- RenderingInfo_Xml
33+
- SourceName
34+
- SubStatus
35+
- SystemTime
36+
- System_Props_Xml
37+
- Task
38+
- TaskCategory
39+
- ThreadID
40+
- UserData_Xml
41+
- UserID
42+
- Version
43+
- _bkt
44+
- _cd
45+
- _eventtype_color
46+
- _indextime
47+
- _raw
48+
- _serial
49+
- _si
50+
- _sourcetype
51+
- _subsecond
52+
- _time
53+
- action
54+
- category
55+
- date_hour
56+
- date_mday
57+
- date_minute
58+
- date_month
59+
- date_second
60+
- date_wday
61+
- date_year
62+
- date_zone
63+
- dest
64+
- dvc
65+
- dvc_nt_host
66+
- event_id
67+
- eventtype
68+
- host
69+
- id
70+
- index
71+
- linecount
72+
- name
73+
- parent_process
74+
- process_name
75+
- punct
76+
- result
77+
- service
78+
- service_id
79+
- service_name
80+
- severity
81+
- severity_id
82+
- signature
83+
- signature_id
84+
- source
85+
- sourcetype
86+
- splunk_server
87+
- splunk_server_group
88+
- status
89+
- subject
90+
- tag
91+
- tag::action
92+
- tag::eventtype
93+
- timeendpos
94+
- timestartpos
95+
- user_group_id
96+
- user_id
97+
- vendor_product
98+
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='MSSQLSERVER'/><EventID Qualifiers='16384'>15457</EventID><Version>0</Version><Level>4</Level><Task>2</Task><Opcode>0</Opcode><Keywords>0x80000000000000</Keywords><TimeCreated SystemTime='2025-02-04T19:46:19.5339693Z'/><EventRecordID>15827</EventRecordID><Correlation/><Execution ProcessID='0' ThreadID='0'/><Channel>Application</Channel><Computer>ar-win-2.attackrange.local</Computer><Security/></System><EventData><Data>show advanced options</Data><Data>1</Data><Data>0</Data><Binary>613C00000A00000009000000610072002D00770069006E002D0032000000070000006D00610073007400650072000000</Binary></EventData></Event>
99+

‎data_sources/windows_event_log_application_17135.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: Windows Event Log Application 17135
2-
id: 4491537e-520c-46f7-9209-f56f852aa237
2+
id: 4491537e-520c-46f7-9209-f56f852aa231
33
version: 1
44
date: '2025-02-26'
55
author: Michael Haag, Splunk

‎detections/endpoint/windows_sql_server_configuration_option_hunt.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ status: production
77
type: Hunting
88
description: This detection helps hunt for changes to SQL Server configuration options that could indicate malicious activity. It monitors for modifications to any SQL Server configuration settings, allowing analysts to identify potentially suspicious changes that may be part of an attack, such as enabling dangerous features or modifying security-relevant settings.
99
data_source:
10-
- Windows Event Log Application
10+
- Windows Event Log Application 15457
1111
search: '`wineventlog_application` EventCode=15457
1212
| rex field=EventData_Xml "<Data>(?<config_name>[^<]+)</Data><Data>(?<new_value>[^<]+)</Data><Data>(?<old_value>[^<]+)</Data>"
1313
| rename host as dest

‎detections/endpoint/windows_sql_server_critical_procedures_enabled.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ status: production
77
type: TTP
88
description: This detection identifies when critical SQL Server configuration options are modified, including "Ad Hoc Distributed Queries", "external scripts enabled", "Ole Automation Procedures", "clr enabled", and "clr strict security". These features can be abused by attackers for various malicious purposes - Ad Hoc Distributed Queries enables Active Directory reconnaissance through ADSI provider, external scripts and Ole Automation allow execution of arbitrary code, and CLR features can be used to run custom assemblies. Enabling these features could indicate attempts to gain code execution or perform reconnaissance through SQL Server.
99
data_source:
10-
- Windows Event Log Application
10+
- Windows Event Log Application 15457
1111
search: '`wineventlog_application` EventCode=15457
1212
| rex field=EventData_Xml "<Data>(?<config_name>[^<]+)</Data><Data>(?<new_value>[^<]+)</Data><Data>(?<old_value>[^<]+)</Data>"
1313
| where config_name IN ("Ad Hoc Distributed Queries", "external scripts enabled", "Ole Automation Procedures", "clr enabled", "clr strict security")

‎detections/endpoint/windows_sql_server_xp_cmdshell_config_change.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,8 @@ author: Michael Haag, Splunk
66
status: production
77
type: TTP
88
description: This detection identifies when the xp_cmdshell configuration is modified in SQL Server. The xp_cmdshell extended stored procedure allows execution of operating system commands and programs from SQL Server, making it a high-risk feature commonly abused by attackers for privilege escalation and lateral movement.
9-
9+
data_source:
10+
- Windows Event Log Application 15457
1011
search: '`wineventlog_application` EventCode=15457
1112
| rex field=EventData_Xml "<Data>(?<config_name>[^<]+)</Data><Data>(?<new_value>[^<]+)</Data><Data>(?<old_value>[^<]+)</Data>"
1213
| rename host as dest
@@ -59,9 +60,7 @@ rba:
5960
- field: config_name
6061
type: other
6162
score: 90
62-
threat_objects:
63-
- field: change_type
64-
type: file_name
63+
threat_objects: []
6564
tags:
6665
analytic_story:
6766
- SQL Server Abuse

0 commit comments

Comments
 (0)