XML Windows Event Log Cleanup #3578
Conversation
|
Experimenting with the detection in #3566, as its a known case of using multiline Windows Event Logs... and it appears that in the XML format, the manipulation of the "Don't Require Preauth" setting on an account does not produce an event with a field specific to that, but you'd have to determine that was the change from the difference in the OldUacValue and the NewUacValue. Which seems... less than ideal, as a single event gets created no matter how many changes are made at once, further complicating any math that would need to be done. |
|
List of codes: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec I seem to recall Splunk adding some bitwise functions and operators in the last few versions, evaluating if these could make this less painful. |
|
Okay, re: #3566 Looks like the |
|
Non-removed detections with
|
Details
We've "declared victory" on using
XmlWinEventLoginstead of the classic multilineWinEventLogseveral times in the past, and we're still finding gaps. This PR will include all of the remaining cleanup, including altering the source macros to no longer reference the WinEventLog source or sourcetypes.Checklist
<platform>_<mitre att&ck technique>_<short description>nomenclatureNotes For Submitters and Reviewers
buildCI job when it fails will likely show an error about what is failing. You may have a very descriptive error of the specific field(s) in the specific file(s) that is causing an issue. In some cases, its also possible there is an issue with the YAML. Many of these can be caught with the pre-commit hooks if you set them up. These errors will be less descriptive as to what exactly is wrong, but will give you a column and row position in a specific file where the YAML processing breaks. If you're having trouble with this, feel free to add a comment to your PR tagging one of the maintainers and we'll be happy to help troubleshoot it.