From eec968f561442e92454810b1f1a6e6be6ace9525 Mon Sep 17 00:00:00 2001 From: Teoderick Contreras Date: Mon, 29 Jan 2024 20:36:20 +0000 Subject: [PATCH] bypass-win-defender2 --- ..._impair_defense_disable_pua_protection.yml | 73 ++++++++++++++++++ ...se_disable_realtime_signature_delivery.yml | 71 ++++++++++++++++++ ..._impair_defense_disable_web_evaluation.yml | 75 +++++++++++++++++++ ...defense_disable_win_defender_app_guard.yml | 74 ++++++++++++++++++ ...sable_win_defender_compute_file_hashes.yml | 70 +++++++++++++++++ ...fense_disable_win_defender_gen_reports.yml | 71 ++++++++++++++++++ ...isable_win_defender_network_protection.yml | 71 ++++++++++++++++++ 7 files changed, 505 insertions(+) create mode 100644 detections/endpoint/windows_impair_defense_disable_pua_protection.yml create mode 100644 detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml create mode 100644 detections/endpoint/windows_impair_defense_disable_web_evaluation.yml create mode 100644 detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml create mode 100644 detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml create mode 100644 detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml create mode 100644 detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml diff --git a/detections/endpoint/windows_impair_defense_disable_pua_protection.yml b/detections/endpoint/windows_impair_defense_disable_pua_protection.yml new file mode 100644 index 0000000000..4f548d3001 --- /dev/null +++ b/detections/endpoint/windows_impair_defense_disable_pua_protection.yml @@ -0,0 +1,73 @@ +name: Windows Impair Defense Disable PUA Protection +id: fbfef407-cfee-4866-88c1-f8de1c16147c +version: 1 +date: '2024-01-08' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 12 +- Sysmon Event ID 13 +- Sysmon Event ID 14 +description: The following analytic identifies a modification in the Windows registry to disable Windows Defender + PUA protection. + Setting PUAProtection to 0 typically disables the detection and protection against Potentially Unwanted Applications + by Microsoft Defender Antivirus. Potentially Unwanted Applications include software that may not be inherently + malicious but could exhibit behaviors that users may find undesirable, such as adware, browser toolbars, or software bundlers. + Disabling this feature might be preferred in certain situations, but it's essential to consider potential security implications. + Enabling PUA protection provides an additional layer of defense against software that might negatively impact user experience + or security. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\PUAProtection" + Registry.registry_value_data="0x00000000" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_pua_protection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://x.com/malmoeb/status/1742604217989415386?s=20 +- https://github.com/undergroundwires/privacy.sexy +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + confidence: 70 + impact: 70 + message: Windows Defender PUA protection set to disable on $dest$. + mitre_attack_id: + - T1562.001 + - T1562 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 49 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.action + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml b/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml new file mode 100644 index 0000000000..9a3e3df631 --- /dev/null +++ b/detections/endpoint/windows_impair_defense_disable_realtime_signature_delivery.yml @@ -0,0 +1,71 @@ +name: Windows Impair Defense Disable Realtime Signature Delivery +id: ffd99aea-542f-448e-b737-091c1b417274 +version: 1 +date: '2024-01-08' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 12 +- Sysmon Event ID 13 +- Sysmon Event ID 14 +description: The following analytic identifies a modification in the Windows registry to disable windows defender + realtime signature delivery feature. This setting governs how Windows Defender Antivirus receives updated signature + definitions for identifying and combating malware threats in real-time. The actual impact and behaviors associated + with different values for RealtimeSignatureDelivery can vary based on specific Windows Defender configurations and policies. + For instance, setting this value to 0 or 1 might control whether real-time signatures are delivered via different methods + such as through Windows Update or directly from Microsoft's cloud-based services. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Signature Updates\\RealtimeSignatureDelivery" + Registry.registry_value_data="0x00000000" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_realtime_signature_delivery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://x.com/malmoeb/status/1742604217989415386?s=20 +- https://github.com/undergroundwires/privacy.sexy +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + confidence: 70 + impact: 70 + message: Windows Defender File realtime signature delivery set to disable on $dest$. + mitre_attack_id: + - T1562.001 + - T1562 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 49 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.action + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml b/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml new file mode 100644 index 0000000000..f5e186b69c --- /dev/null +++ b/detections/endpoint/windows_impair_defense_disable_web_evaluation.yml @@ -0,0 +1,75 @@ +name: Windows Impair Defense Disable Web Evaluation +id: e234970c-dcf5-4f80-b6a9-3a562544ca5b +version: 1 +date: '2024-01-08' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 12 +- Sysmon Event ID 13 +- Sysmon Event ID 14 +description: The following analytic identifies a modification in the Windows registry to disable Windows Defender + web content evaluation. The "EnableWebContentEvaluation" registry entry typically relates to security settings + within Microsoft Edge or Internet Explorer, enabling the evaluation of web content for security purposes. + When attackers modify "EnableWebContentEvaluation" to 0, they might attempt to disable the browser's + capability to evaluate web content for security purposes. Disabling this feature could potentially impact + the browser's ability to assess the security risks associated with web content, such as potentially malicious scripts, + active content, or unsafe web elements. + By turning off content evaluation, attackers might aim to exploit security vulnerabilities present in web content without + triggering security warnings or blocks. This manipulation increases the risk of users accessing or interacting with malicious + content, potentially leading to security compromises or system exploitation. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry + WHERE Registry.registry_path= "*\\Windows\\CurrentVersion\\AppHost\\EnableWebContentEvaluation" Registry.registry_value_data= "0x00000000" + BY _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name + Registry.registry_value_data Registry.process_guid + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_web_evaluation_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://x.com/malmoeb/status/1742604217989415386?s=20 +- https://github.com/undergroundwires/privacy.sexy +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + confidence: 70 + impact: 70 + message: Windows Defender web content evaluation feature set to disable on $dest$. + mitre_attack_id: + - T1562.001 + - T1562 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 49 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.action + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml new file mode 100644 index 0000000000..9bb1798e94 --- /dev/null +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_app_guard.yml @@ -0,0 +1,74 @@ +name: Windows Impair Defense Disable Win Defender App Guard +id: 8b700d7e-54ad-4d7d-81cc-1456c4703306 +version: 1 +date: '2024-01-08' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 12 +- Sysmon Event ID 13 +- Sysmon Event ID 14 +description: The following analytic identifies a modification in the Windows registry to disable Windows Defender + audit application guard. + Microsoft Defender Application Guard provides enhanced security by isolating potentially malicious documents and + websites in a containerized environment, protecting the system against various threats. Auditing and logging are + essential components of security measures, providing visibility into activities within the isolated environment. + Disabling auditing events within Application Guard might not be a standard or recommended practice since auditing + is crucial for security monitoring and threat detection within the isolated container. However, there might be + settings or configurations related to audit policies in the broader Windows Defender or operating system settings. + This registry setting is being abuse by several threat actors, adversaries and red teamers to bypasses Windows defender detections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Policies\\Microsoft\\AppHVSI\\AuditApplicationGuard" + Registry.registry_value_data="0x00000000" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_win_defender_app_guard_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://x.com/malmoeb/status/1742604217989415386?s=20 +- https://github.com/undergroundwires/privacy.sexy +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + confidence: 70 + impact: 70 + message: Windows Defender AuditApplicationGuard feature set to disable on $dest$. + mitre_attack_id: + - T1562.001 + - T1562 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 49 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.action + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml new file mode 100644 index 0000000000..ad16f6027d --- /dev/null +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_compute_file_hashes.yml @@ -0,0 +1,70 @@ +name: Windows Impair Defense Disable Win Defender Compute File Hashes +id: fe52c280-98bd-4596-b6f6-a13bbf8ac7c6 +version: 1 +date: '2024-01-08' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 12 +- Sysmon Event ID 13 +- Sysmon Event ID 14 +description: The following analytic identifies a modification in the Windows registry to disable Windows Defender file hashes computation. + The EnableFileHashComputation registry setting likely pertains to whether Windows Defender's MpEngine (Malware Protection Engine) computes + file hashes. Setting this value to 0 might disable the file hash computation feature within Windows Defender, which could affect certain + malware detection or scanning functionalities that rely on file hash analysis. This registry setting is being abuse by several threat actors, adversaries + and red teamers to bypasses Windows defender detections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\MpEngine\\EnableFileHashComputation" + Registry.registry_value_data="0x00000000" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_win_defender_compute_file_hashes_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://x.com/malmoeb/status/1742604217989415386?s=20 +- https://github.com/undergroundwires/privacy.sexy +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + confidence: 70 + impact: 70 + message: Windows Defender File hashes computation set to disable on $dest$. + mitre_attack_id: + - T1562.001 + - T1562 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 49 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.action + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml new file mode 100644 index 0000000000..a1cd201ebe --- /dev/null +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_gen_reports.yml @@ -0,0 +1,71 @@ +name: Windows Impair Defense Disable Win Defender Gen reports +id: 93f114f6-cb1e-419b-ac3f-9e11a3045e70 +version: 1 +date: '2024-01-08' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 12 +- Sysmon Event ID 13 +- Sysmon Event ID 14 +description: The following analytic identifies a modification in the Windows registry to disable Windows Defender + generic ports. This registry can disable the sending of Watson events in Windows Defender. This is by preventing + the transmission of generic or non-specific error reports to Microsoft's Windows Error Reporting service, + commonly known as Watson. This kind of setting could potentially be employed to limit or control the data sent to + Microsoft for error analysis, often in scenarios where privacy or specific reporting requirements are in place. + This registry setting is being abuse by several threat actors, adversaries and red teamers to bypasses Windows defender detections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Reporting\\DisableGenericRePorts" + Registry.registry_value_data="0x00000001" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_win_defender_gen_reports_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://x.com/malmoeb/status/1742604217989415386?s=20 +- https://github.com/undergroundwires/privacy.sexy +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + confidence: 70 + impact: 70 + message: Windows Defender DisableGenericRePorts registry is set to enable on $dest$. + mitre_attack_id: + - T1562.001 + - T1562 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 49 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.action + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml b/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml new file mode 100644 index 0000000000..7377307d55 --- /dev/null +++ b/detections/endpoint/windows_impair_defense_disable_win_defender_network_protection.yml @@ -0,0 +1,71 @@ +name: Windows Impair Defense Disable Win Defender Network Protection +id: 8b6c15c7-5556-463d-83c7-986326c21f12 +version: 1 +date: '2024-01-08' +author: Teoderick Contreras, Splunk +status: production +type: TTP +data_source: +- Sysmon Event ID 12 +- Sysmon Event ID 13 +- Sysmon Event ID 14 +description: The following analytic identifies a modification in the Windows registry to disable Windows Defender + exploit guard network protection. The EnableNetworkProtection registry entry controls the activation or deactivation + of Network Protection within Windows Defender Exploit Guard. When set to 1, it typically signifies that Network Protection + is enabled, offering additional security measures against network-based threats by analyzing and blocking potentially + malicious network activity. This registry setting is being abuse by several threat actors, adversaries + and red teamers to bypasses Windows defender detections. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Windows Defender Exploit Guard\\Network Protection\\EnableNetworkProtection" + Registry.registry_value_data="0x00000000" + by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest + | `drop_dm_object_name(Registry)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_impair_defense_disable_win_defender_network_protection_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. +known_false_positives: It is unusual to turn this feature off a Windows system since + it is a default security control, although it is not rare for some policies to disable + it. Although no false positives have been identified, use the provided filter macro + to tune the search. +references: +- https://x.com/malmoeb/status/1742604217989415386?s=20 +- https://github.com/undergroundwires/privacy.sexy +tags: + analytic_story: + - Windows Defense Evasion Tactics + - Windows Registry Abuse + asset_type: Endpoint + confidence: 70 + impact: 70 + message: Windows Defender Exploit Guard network protection set to disable on $dest$. + mitre_attack_id: + - T1562.001 + - T1562 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 49 + required_fields: + - _time + - Registry.registry_key_name + - Registry.registry_value_name + - Registry.dest + - Registry.user + - Registry.registry_path + - Registry.action + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/disable-windows-security-defender-features/windefender-bypas-2-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog