From 19ea75d969d8a61d558328fb184ffe9bbd9e2c80 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 21 Jun 2021 17:50:09 -0400 Subject: [PATCH] adding references --- detections/endpoint/suspicious_event_log_service_behavior.yml | 3 ++- detections/endpoint/windows_event_log_cleared.yml | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 27bf78bf2c..0ff541b630 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -12,7 +12,8 @@ search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firs how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. -references: [] +references: + - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100 tags: analytic_story: - Windows Log Manipulation diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index ca4ece0ee9..7db56f97a0 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -15,7 +15,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin Windows event logs from your hosts. known_false_positives: It is possible that these logs may be legitimately cleared by Administrators. -references: [] +references: + - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102 tags: analytic_story: - Windows Log Manipulation