mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
89 lines
2.7 KiB
JSON
89 lines
2.7 KiB
JSON
{
|
|
"asset_type": "Endpoint",
|
|
"channel": "ESCU",
|
|
"confidence": "high",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest",
|
|
"rule_description": "The Event Logging System has been cleared or shutdown on $dest$",
|
|
"rule_title": "Windows Event Log Cleared on $dest$"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 60
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest, signature_id",
|
|
"suppress_period": "28800s"
|
|
}
|
|
},
|
|
"creation_date": "2017-02-17",
|
|
"data_metadata": {
|
|
"data_eventtypes": [
|
|
"wineventlog_security",
|
|
"wineventlog_system"
|
|
],
|
|
"data_source": [
|
|
"Microsoft Windows"
|
|
],
|
|
"providing_technologies": [
|
|
"Microsoft Windows"
|
|
]
|
|
},
|
|
"eli5": "This search looks at the Windows security and system event logs. EventCode 1002 in the security log indicates that the log has been cleared, EventCode 1000 in the security log indicates the event logging service has been shut down, and EventCode 104 in the system log indicates the application log has been cleared. If any of these events are found, a notable will be generated.",
|
|
"how_to_implement": "To successfully implement this search, you need to be ingesting Windows event logs from your hosts.",
|
|
"known_false_positives": "It is possible that these logs may be legitimately cleared by Administrators.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 3",
|
|
"CIS 5",
|
|
"CIS 6"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Actions on Objectives"
|
|
],
|
|
"mitre_attack": [
|
|
"Defense Evasion",
|
|
"Indicator Removal on Host"
|
|
],
|
|
"nist": [
|
|
"DE.DP",
|
|
"PR.IP",
|
|
"PR.AC",
|
|
"PR.AT",
|
|
"DE.AE"
|
|
]
|
|
},
|
|
"modification_date": "2019-02-27",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "((eventtype=wineventlog_security) AND (signature_id=1102 OR signature_id=1100)) OR ((eventtype=wineventlog_system) AND signature_id=104) | stats count min(_time) as firstTime max(_time) as lastTime by signature_id dest user| `ctime(firstTime)` | `ctime(lastTime)`",
|
|
"search_description": "This search looks for Windows events that indicate one of the Windows event logs has been purged.",
|
|
"search_id": "ad517544-aff9-4c96-bd99-d6eb43bfbb6a",
|
|
"search_name": "Windows Event Log Cleared",
|
|
"search_type": "detection",
|
|
"security_domain": "endpoint",
|
|
"spec_version": 1,
|
|
"version": "3.0"
|
|
}
|