mirror of
https://github.com/OTRF/OSSEM-DM
synced 2026-06-08 12:05:55 +00:00
Jose Rodriguez
ed1cbddce4
- updated numerical event_id to string. - alignment with OSSEM-DD and readme description
26 lines
690 B
YAML
26 lines
690 B
YAML
relationship_id: REL-2022-0049
|
|
name: Firewall enabled
|
|
contributors:
|
|
- Jose Rodriguez @Cyb3rPandaH
|
|
attack:
|
|
data_source: firewall
|
|
data_component: firewall metadata
|
|
behavior:
|
|
source: firewall
|
|
relationship: enabled
|
|
target: null
|
|
security_events:
|
|
- event_id: '5024'
|
|
name: The Windows Firewall Service has started successfully.
|
|
platform: windows
|
|
audit_category: System
|
|
audit_sub_category: Other System Events
|
|
channel: Security
|
|
log_source: Microsoft-Windows-Security-Auditing
|
|
event_version:
|
|
- '0'
|
|
references:
|
|
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5024
|
|
notes:
|
|
- Potential contribution for ATT&CK - Firewall / firewall enable
|