mirror of
https://github.com/OTRF/OSSEM-DM
synced 2026-06-08 12:05:55 +00:00
Jose Rodriguez
ed1cbddce4
- updated numerical event_id to string. - alignment with OSSEM-DD and readme description
63 lines
1.7 KiB
YAML
63 lines
1.7 KiB
YAML
relationship_id: REL-2022-0155
|
|
name: Process modified File
|
|
contributors:
|
|
- Jose Rodriguez @Cyb3rPandaH
|
|
- Roberto Rodriguez @Cyb3rWard0g
|
|
- Olaf Hartong @olafhartong
|
|
attack:
|
|
data_source: file
|
|
data_component: file modification
|
|
behavior:
|
|
source: process
|
|
relationship: modified
|
|
target: file
|
|
security_events:
|
|
- event_id: '2'
|
|
name: A process changed a file creation time.
|
|
platform: windows
|
|
audit_category: FileCreateTime
|
|
channel: Microsoft-Windows-Sysmon/Operational
|
|
log_source: Microsoft-Windows-Sysmon
|
|
event_version:
|
|
- '4.32'
|
|
- event_id: '11'
|
|
name: FileCreate.
|
|
platform: windows
|
|
audit_category: FileCreate
|
|
channel: Microsoft-Windows-Sysmon/Operational
|
|
log_source: Microsoft-Windows-Sysmon
|
|
event_version:
|
|
- '4.32'
|
|
- event_id: '4670'
|
|
name: Permissions on an object were changed.
|
|
platform: windows
|
|
audit_category: Object Access
|
|
audit_sub_category: File System
|
|
channel: Security
|
|
log_source: Microsoft-Windows-Security-Auditing
|
|
event_version:
|
|
- '0'
|
|
- event_id: DeviceFileEvents
|
|
name: DeviceFileEvents
|
|
platform: windows
|
|
log_source: Microsoft Defender for Endpoint
|
|
filter_in:
|
|
- ActionType: FileModified
|
|
event_version:
|
|
- '0'
|
|
- '1'
|
|
- event_id: DeviceFileEvents
|
|
name: DeviceFileEvents
|
|
platform: windows
|
|
log_source: Microsoft Defender for Endpoint
|
|
filter_in:
|
|
- ActionType: FileRenamed
|
|
event_version:
|
|
- '0'
|
|
- '1'
|
|
references:
|
|
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-2-a-process-changed-a-file-creation-time
|
|
- https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-11-filecreate
|
|
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670
|
|
notes: null
|