hunters-forge-OSSEM/source/attack_data_sources/tables/Data_Sources.yml

title: Data Sources
description: null
data_fields:
- data_source: Access Tokens
  description: Logs tracking the identity and privileges of the user account associated
    with a process or thread.
- data_source: Anti-virus
  description: Logs provided by AV providers such as alerts that need to be investigated
- data_source: API monitoring
  description: Logs monitoring API calls on endpoints
- data_source: Application Logs
  description: TBD
- data_source: Asset Management
  description: Logs providing up to date information about active endpoints in an
    environment (Scope)
- data_source: Authentication logs
  description: Logs tracking log on activity in an environment. For example, users
    authenticating to other endpoints via WinRM, WMI, etc.
- data_source: Binary file metadata
  description: Information about binary files over the wire or locally on an endpoint.
- data_source: BIOS
  description: Logs providing information about the integrity of existing BIOs
- data_source: Browser extensions
  description: Logs monitoring for browser extensions or plugins that can add functionality
    and customize aspects of internet browsers. Monitoring for any new items written
    to the Registry or PE files written to disk could correlate with browser extension
    installation
- data_source: Data loss prevention
  description: Logs monitoring file access and removable media devices. Those could
    be similar to the ones from Windows security logs object access category
- data_source: Detonation chamber
  description: TBD
- data_source: Digital Certificate Logs
  description: Logs needed to detect primarily suspicious Root certificate installations.
    For example, you can get good information about the use of this technique from
    the HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates registry keys
- data_source: DLL monitoring
  description: Logs monitoring the creation, modification or rename of DLLs. For example.
    One could monitor HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors for DLLs
    loaded by spoolsv.exe
- data_source: DNS records
  description: Logs monitoring for changes to DNS records in endpoints.
- data_source: EFI
  description: Logs providing information about the integrity of existing EFI. EFI
    modules can be collected and compared against a known-clean list of EFI executable
    binaries to detect potentially malicious modules
- data_source: Email gateway
  description: TBD
- data_source: Environment variable
  description: Logs tracking users checking or changing their environment variables
    (HISTCONTROL). (Lunix/MacOs)
- data_source: File monitoring
  description: Logs tracking any modification, creation or rename of files either
    locally or over the wire
- data_source: Host network interface
  description: Logs tracking changes to the host network interface. For example, an
    adversary may place a network interface into promiscuous mode
- data_source: Kernel drivers
  description: Logs monitoring the registry and file system for driver installs
- data_source: Loaded DLLs
  description: Logs monitoring dlls being loaded by process execution. Similar approach
    to DLL monitoring. They both can be used together in certain techniques.
- data_source: Mail server
  description: TBD
- data_source: Malware reverse engineering
  description: Information obtained by looking at samples of malware. For example,
    it may be possible to obtain the algorithm and key from samples of malware using
    custom encryption. This can help to decode network traffic.
- data_source: MBR
  description: Logs providing information about changes to the MBR (might not be provided
    by default logs on the endpoints)
- data_source: Named Pipes
  description: Logs tracking named pipes creation and connection events (i.e Sysmon
    Event IDs 17 and 18)
- data_source: Netflow/Enclave netflow
  description: Netflow logs - TBD
- data_source: Network device logs
  description: TBD
- data_source: Network intrusion detection system
  description: TBD
- data_source: Network protocol analysis
  description: Network logs prodiving information about protocols being used in network
    connections. This can be obtained from endpoint and network data sets
- data_source: Packet capture
  description: TBD
- data_source: PowerShell logs
  description: Windows PowerShell logs
- data_source: Process command-line parameters
  description: Logs monitoring process command line arguments
- data_source: Process monitoring
  description: Logs monitoring process execution
- data_source: Process use of network
  description: Logs tracking processes making network connections
- data_source: Sensor health and status
  description: Logs monitoring data sensor status in case they are disabled to stop
    collecting and sending logs to a SIEM. For example, Sysmon EID 4 tells you when
    its service stops
- data_source: Services
  description: Logs about services being installed or highjacked in a system (i.e
    Windows Security Log 4697 or Windows System log 7045)
- data_source: SSL/TLS inspection
  description: Information about encrypted channels being used by adversaries. This
    could be part of netflow data
- data_source: System calls
  description: TBD
- data_source: Third-party application logs
  description: Logs indicating the usage of third party software. For example, an
    adversary using VNC
- data_source: User interface
  description: Logs inidicating processes that normally require user-driven events.
    For example, clicking or typing a password in a fake credentials prompt. This
    might be provided by API monitoring data sources
- data_source: VBR
  description: Logs tracking changes to the VBR (might not be provided by default
    logs on the endpoints)
- data_source: Web application firewall logs
  description: TBD
- data_source: Web logs
  description: TBD
- data_source: Web proxy
  description: TBD
- data_source: Windows Error Reporting
  description: Logs providing software and operating system crash information. OS
    system crash reports (usually offline analysis of crash reports need to happen)
- data_source: Windows event logs
  description: Windows event logs used to track user creation, permissions modifications,
    and even changes to groups. Based on the techniques linked to this data source,
    it seemed to be also focused on scheduled tasks, account manipulations, account
    creation and SID-history logs. (We can say every Windows event log here)
- data_source: Windows Registry
  description: Logs tracking any creation, deletion and modification of registry keys
    in Windows environments
- data_source: WMI Objects
  description: Logs capturing WMI event subscription events
references: []
tags: []