title: Data Sources description: null data_fields: - data_source: Access Tokens description: Logs tracking the identity and privileges of the user account associated with a process or thread. - data_source: Anti-virus description: Logs provided by AV providers such as alerts that need to be investigated - data_source: API monitoring description: Logs monitoring API calls on endpoints - data_source: Application Logs description: TBD - data_source: Asset Management description: Logs providing up to date information about active endpoints in an environment (Scope) - data_source: Authentication logs description: Logs tracking log on activity in an environment. For example, users authenticating to other endpoints via WinRM, WMI, etc. - data_source: Binary file metadata description: Information about binary files over the wire or locally on an endpoint. - data_source: BIOS description: Logs providing information about the integrity of existing BIOs - data_source: Browser extensions description: Logs monitoring for browser extensions or plugins that can add functionality and customize aspects of internet browsers. Monitoring for any new items written to the Registry or PE files written to disk could correlate with browser extension installation - data_source: Data loss prevention description: Logs monitoring file access and removable media devices. Those could be similar to the ones from Windows security logs object access category - data_source: Detonation chamber description: TBD - data_source: Digital Certificate Logs description: Logs needed to detect primarily suspicious Root certificate installations. For example, you can get good information about the use of this technique from the HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates registry keys - data_source: DLL monitoring description: Logs monitoring the creation, modification or rename of DLLs. For example. One could monitor HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors for DLLs loaded by spoolsv.exe - data_source: DNS records description: Logs monitoring for changes to DNS records in endpoints. - data_source: EFI description: Logs providing information about the integrity of existing EFI. EFI modules can be collected and compared against a known-clean list of EFI executable binaries to detect potentially malicious modules - data_source: Email gateway description: TBD - data_source: Environment variable description: Logs tracking users checking or changing their environment variables (HISTCONTROL). (Lunix/MacOs) - data_source: File monitoring description: Logs tracking any modification, creation or rename of files either locally or over the wire - data_source: Host network interface description: Logs tracking changes to the host network interface. For example, an adversary may place a network interface into promiscuous mode - data_source: Kernel drivers description: Logs monitoring the registry and file system for driver installs - data_source: Loaded DLLs description: Logs monitoring dlls being loaded by process execution. Similar approach to DLL monitoring. They both can be used together in certain techniques. - data_source: Mail server description: TBD - data_source: Malware reverse engineering description: Information obtained by looking at samples of malware. For example, it may be possible to obtain the algorithm and key from samples of malware using custom encryption. This can help to decode network traffic. - data_source: MBR description: Logs providing information about changes to the MBR (might not be provided by default logs on the endpoints) - data_source: Named Pipes description: Logs tracking named pipes creation and connection events (i.e Sysmon Event IDs 17 and 18) - data_source: Netflow/Enclave netflow description: Netflow logs - TBD - data_source: Network device logs description: TBD - data_source: Network intrusion detection system description: TBD - data_source: Network protocol analysis description: Network logs prodiving information about protocols being used in network connections. This can be obtained from endpoint and network data sets - data_source: Packet capture description: TBD - data_source: PowerShell logs description: Windows PowerShell logs - data_source: Process command-line parameters description: Logs monitoring process command line arguments - data_source: Process monitoring description: Logs monitoring process execution - data_source: Process use of network description: Logs tracking processes making network connections - data_source: Sensor health and status description: Logs monitoring data sensor status in case they are disabled to stop collecting and sending logs to a SIEM. For example, Sysmon EID 4 tells you when its service stops - data_source: Services description: Logs about services being installed or highjacked in a system (i.e Windows Security Log 4697 or Windows System log 7045) - data_source: SSL/TLS inspection description: Information about encrypted channels being used by adversaries. This could be part of netflow data - data_source: System calls description: TBD - data_source: Third-party application logs description: Logs indicating the usage of third party software. For example, an adversary using VNC - data_source: User interface description: Logs inidicating processes that normally require user-driven events. For example, clicking or typing a password in a fake credentials prompt. This might be provided by API monitoring data sources - data_source: VBR description: Logs tracking changes to the VBR (might not be provided by default logs on the endpoints) - data_source: Web application firewall logs description: TBD - data_source: Web logs description: TBD - data_source: Web proxy description: TBD - data_source: Windows Error Reporting description: Logs providing software and operating system crash information. OS system crash reports (usually offline analysis of crash reports need to happen) - data_source: Windows event logs description: Windows event logs used to track user creation, permissions modifications, and even changes to groups. Based on the techniques linked to this data source, it seemed to be also focused on scheduled tasks, account manipulations, account creation and SID-history logs. (We can say every Windows event log here) - data_source: Windows Registry description: Logs tracking any creation, deletion and modification of registry keys in Windows environments - data_source: WMI Objects description: Logs capturing WMI event subscription events references: [] tags: []