admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update OCSF 4688 samples

Browse Source 
Signed-off-by: Michael Radka <mradka@splunk.com>
This commit is contained in:
Michael Radka
2022-10-07 13:55:46 -04:00
parent 48772734ee
commit d8d79fa3d1
2 changed files with 138 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe/ocsf_new/sample_4688.json
+69 -30
View File
@@ -1,35 +1,74 @@
{
"Keywords": "Audit Success",
"TaskCategory": "Process Creation",
"Message": "A new process has been created.",
"EventType": "0",
"SourceName": "Microsoft Windows security auditing.",
"EventCode": "4688",
"Type": "Information",
"Target Subject": {
"Account Name": "-",
"Security ID": "NULL SID",
"Logon ID": "0x0",
"Account Domain": "-"
"metadata": {
"version": "0.9.0"
},
"Process Information": {
"New Process Name": "C:\\Windows\\System32\\reg.exe",
"Token Elevation Type": "%%1936",
"Process Command Line": "reg save HKLM\\system C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\system ",
"New Process ID": "0x1258",
"Creator Process Name": "C:\\Windows\\System32\\cmd.exe",
"Mandatory Label": "Mandatory Label\\High Mandatory Level",
"Creator Process ID": "0xf6c"
"category_uid": 1,
"actor_process": {
"file": {
"path": "C:\\Windows\\System32\\cmd.exe",
"parent_folder": "C:\\Windows\\System32",
"type_id": 1,
"name": "cmd.exe"
},
"pid": 3948
},
"Creator Subject": {
"Account Name": "Administrator",
"Security ID": "ATTACKRANGE\\Administrator",
"Logon ID": "0x55E621",
"Account Domain": "ATTACKRANGE"
"process": {
"file": {
"path": "C:\\Windows\\System32\\reg.exe",
"parent_folder": "C:\\Windows\\System32",
"type_id": 1,
"name": "reg.exe"
},
"cmd_line": "reg save HKLM\\system C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\system ",
"pid": 4696,
"run_as": {
"uid": "NULL SID",
"domain": "-",
"name": "-",
"session_uid": "0x0"
}
},
"OpCode": "Info",
"ComputerName": "win-dc-725.attackrange.local",
"LogName": "Security",
"RecordNumber": "257874",
"event_time": "03/12/2021 10:48:14 AM"
"origin": {
"product": {
"name": "Microsoft Windows"
},
"feature": {
"name": "Security"
},
"device": {
"os": {
"type_id": 100,
"name": "Windows"
},
"type_id": 0,
"name": "win-dc-725.attackrange.local"
}
},
"message": "A new process has been created.",
"ref_event_uid": "257874",
"unmapped": {
"TaskCategory": "Process Creation",
"EventType": "0",
"SourceName": "Microsoft Windows security auditing.",
"Process Information": {
"Token Elevation Type": "%%1936",
"Mandatory Label": "Mandatory Label\\High Mandatory Level"
},
"OpCode": "Info"
},
"status_id": 1,
"class_uid": 1014,
"severity_id": 1,
"time": 1615564094000,
"user": {
"uid": "ATTACKRANGE\\Administrator",
"account_type": "Windows Account",
"domain": "ATTACKRANGE",
"name": "Administrator",
"account_type_id": 2,
"session_uid": "0x55E621"
},
"ref_event_code": "4688",
"event_time": "03/12/2021 10:48:14 AM",
"disposition_id": 1
}
detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe/ocsf_old/sample_4688.json
+69 -30
View File
@@ -1,35 +1,74 @@
{
"Keywords": "Audit Success",
"TaskCategory": "Process Creation",
"Message": "A new process has been created.",
"EventType": "0",
"SourceName": "Microsoft Windows security auditing.",
"EventCode": "4688",
"Type": "Information",
"Target Subject": {
"Account Name": "-",
"Security ID": "NULL SID",
"Logon ID": "0x0",
"Account Domain": "-"
"metadata": {
"version": "0.9.0"
},
"Process Information": {
"New Process Name": "C:\\Windows\\System32\\reg.exe",
"Token Elevation Type": "%%1936",
"Process Command Line": "reg save HKLM\\system C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\system ",
"New Process ID": "0x1258",
"Creator Process Name": "C:\\Windows\\System32\\cmd.exe",
"Mandatory Label": "Mandatory Label\\High Mandatory Level",
"Creator Process ID": "0xf6c"
"category_uid": 1,
"actor_process": {
"file": {
"path": "C:\\Windows\\System32\\cmd.exe",
"parent_folder": "C:\\Windows\\System32",
"type_id": 1,
"name": "cmd.exe"
},
"pid": 3948
},
"Creator Subject": {
"Account Name": "Administrator",
"Security ID": "ATTACKRANGE\\Administrator",
"Logon ID": "0x55E621",
"Account Domain": "ATTACKRANGE"
"process": {
"file": {
"path": "C:\\Windows\\System32\\reg.exe",
"parent_folder": "C:\\Windows\\System32",
"type_id": 1,
"name": "reg.exe"
},
"cmd_line": "reg save HKLM\\system C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\system ",
"pid": 4696,
"run_as": {
"uid": "NULL SID",
"domain": "-",
"name": "-",
"session_uid": "0x0"
}
},
"OpCode": "Info",
"ComputerName": "win-dc-725.attackrange.local",
"LogName": "Security",
"RecordNumber": "257874",
"event_time": "03/12/2021 10:48:14 AM"
"origin": {
"product": {
"name": "Microsoft Windows"
},
"feature": {
"name": "Security"
},
"device": {
"os": {
"type_id": 100,
"name": "Windows"
},
"type_id": 0,
"name": "win-dc-725.attackrange.local"
}
},
"message": "A new process has been created.",
"ref_event_uid": "257874",
"unmapped": {
"TaskCategory": "Process Creation",
"EventType": "0",
"SourceName": "Microsoft Windows security auditing.",
"Process Information": {
"Token Elevation Type": "%%1936",
"Mandatory Label": "Mandatory Label\\High Mandatory Level"
},
"OpCode": "Info"
},
"status_id": 1,
"class_uid": 1014,
"severity_id": 1,
"time": 1615564094000,
"user": {
"uid": "ATTACKRANGE\\Administrator",
"account_type": "Windows Account",
"domain": "ATTACKRANGE",
"name": "Administrator",
"account_type_id": 2,
"session_uid": "0x55E621"
},
"ref_event_code": "4688",
"event_time": "03/12/2021 10:48:14 AM",
"disposition_id": 1
}