From da745b77af01d1c28d5f765724da0ec6c1c05668 Mon Sep 17 00:00:00 2001 From: Andrew Rathbun Date: Sun, 11 Apr 2021 13:23:01 -0400 Subject: [PATCH 1/3] Create Microsoft-Windows-SMBServer-Operational_Microsoft-Windows-SMBServer_1020.map --- ...ional_Microsoft-Windows-SMBServer_1020.map | 94 +++++++++++++++++++ 1 file changed, 94 insertions(+) create mode 100644 evtx/Maps/Microsoft-Windows-SMBServer-Operational_Microsoft-Windows-SMBServer_1020.map diff --git a/evtx/Maps/Microsoft-Windows-SMBServer-Operational_Microsoft-Windows-SMBServer_1020.map b/evtx/Maps/Microsoft-Windows-SMBServer-Operational_Microsoft-Windows-SMBServer_1020.map new file mode 100644 index 00000000..bdf65d6f --- /dev/null +++ b/evtx/Maps/Microsoft-Windows-SMBServer-Operational_Microsoft-Windows-SMBServer_1020.map @@ -0,0 +1,94 @@ +Author: Andrew Rathbun +Description: File system operation has taken longer than expected +EventId: 1020 +Channel: Microsoft-Windows-SMBServer/Operational +Provider: Microsoft-Windows-SMBServer +Maps: + - + Property: Username + PropertyValue: "%Username%" + Values: + - + Name: Username + Value: "/Event/UserData/EventData/Username" + - + Property: ExecutableInfo + PropertyValue: "FileName: %FileName%" + Values: + - + Name: FileName + Value: "/Event/UserData/EventData/FileName" + - + Property: PayloadData1 + PropertyValue: "The threshold is %Threshold% milliseconds (15 seconds)" + Values: + - + Name: Threshold + Value: "/Event/UserData/EventData/Threshold" + - + Property: PayloadData2 + PropertyValue: "The I/O operation took %Duration% milliseconds" + Values: + - + Name: Duration + Value: "/Event/UserData/EventData/Duration" + - + Property: PayloadData3 + PropertyValue: "ClientName: %ClientName%" + Values: + - + Name: ClientName + Value: "/Event/UserData/EventData/ClientName" + - + Property: PayloadData4 + PropertyValue: "ShareName: %ShareName%" + Values: + - + Name: ShareName + Value: "/Event/UserData/EventData/ShareName" + +# Documentation: +# https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/troubleshoot-event-id-1020-warnings-file-server +# +# Example Event Data: +# +# +# +# 1020 +# 1 +# 3 +# 1020 +# 0 +# 0x2000000000000008 +# +# 72 +# +# +# Microsoft-Windows-SMBServer/Operational +# HOSTNAME.domain +# +# +# +# +# 5 +# 4d0b74f0-14cc-0001-4f6e-114dcc14d701 +# 0x4C04C0200015 +# 4d0b74f0-14cc-0001-395e-679dcc14d701 +# 25 +# HOSTNAME\username +# 12 +# \\10.1.10.20 +# 16 +# 02-00-C5-EC-0A-01-0A-1E-00-00-00-00-00-00-00-00 +# 10 +# \\*\SYSVOL +# 73 +# HOSTNAME.DOMAIN\POLICIES\{82B745A2-GG6D-4571-B214-0D8FCB672A5E}\GPT.INI +# 46852 +# 15000 +# 9568402 +# 0 +# 0 +# +# +# From 9e01895c8768a12d36f1cd1674846e35afeada72 Mon Sep 17 00:00:00 2001 From: Andrew Rathbun Date: Sun, 11 Apr 2021 14:02:09 -0400 Subject: [PATCH 2/3] Update Security_Microsoft-Windows-Security-Auditing_5145.map --- ...crosoft-Windows-Security-Auditing_5145.map | 49 ++++++++++++++++++- 1 file changed, 47 insertions(+), 2 deletions(-) diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5145.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5145.map index 2fa63b64..50effbf7 100644 --- a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5145.map +++ b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5145.map @@ -43,22 +43,67 @@ Maps: Value: "/Event/EventData/Data[@Name=\"RelativeTargetName\"]" - Property: PayloadData3 - PropertyValue: "AccessList: %AccessList% (AccessMask: %AccessMask%)" + PropertyValue: "AccessList: %AccessList%" Values: - Name: AccessList Value: "/Event/EventData/Data[@Name=\"AccessList\"]" + Refine: "%%(.{4})" + - + Property: PayloadData4 + PropertyValue: "AccessMask: %AccessMask%" + Values: - Name: AccessMask Value: "/Event/EventData/Data[@Name=\"AccessMask\"]" - - Property: PayloadData4 + Property: PayloadData5 PropertyValue: "SID: %SubjectUserSid%" Values: - Name: SubjectUserSid Value: "/Event/EventData/Data[@Name=\"SubjectUserSid\"]" +Lookups: + - + Name: AccessList + Default: Unknown code + Values: + "%%4416": ReadData (or ListDirectory) + "%%4417": WriteData (or AddFile) + "%%4418": AppendData (or AddSubdirectory or CreatePipeInstance) + "%%4419": ReadEA (or Enumerate SubKeys) + "%%4420": WriteEA + "%%4421": Execute/Traverse + "%%4422": DeleteChild + "%%4423": ReadAttributes + "%%4424": WriteAttributes + "%%1537": DELETE + "%%1538": READ_CONTROL + "%%1539": WRITE_DAC + "%%1540": WRITE_OWNER + "%%1541": SYNCHRONIZE + "%%1542": ACCESS_SYS_SEC + - + Name: AccessMask + Default: Unknown code + Values: + "%%4416": ReadData (or ListDirectory) + "%%4417": WriteData (or AddFile) + "%%4418": AppendData (or AddSubdirectory or CreatePipeInstance) + "%%4419": ReadEA (or Enumerate SubKeys) + "%%4420": WriteEA + "%%4421": Execute/Traverse + "%%4422": DeleteChild + "%%4423": ReadAttributes + "%%4424": WriteAttributes + "%%1537": DELETE + "%%1538": READ_CONTROL + "%%1539": WRITE_DAC + "%%1540": WRITE_OWNER + "%%1541": SYNCHRONIZE + "%%1542": ACCESS_SYS_SEC + # Documentation: # https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5145 # https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145 From 4733f9f721c0496d1d261f14e4641a25e223d720 Mon Sep 17 00:00:00 2001 From: Andrew Rathbun Date: Sun, 11 Apr 2021 14:03:04 -0400 Subject: [PATCH 3/3] Update Security_Microsoft-Windows-Security-Auditing_5140.map --- ...crosoft-Windows-Security-Auditing_5140.map | 57 ++++++++++++++++++- 1 file changed, 56 insertions(+), 1 deletion(-) diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5140.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5140.map index 4555d1d5..01999204 100644 --- a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5140.map +++ b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_5140.map @@ -1,4 +1,4 @@ -Author: Eric Zimmerman saericzimmerman@gmail.com +Author: Eric Zimmerman saericzimmerman@gmail.com and Andrew Rathbun Description: A network share object was accessed EventId: 5140 Channel: Security @@ -41,6 +41,61 @@ Maps: - Name: SubjectUserSid Value: "/Event/EventData/Data[@Name=\"SubjectUserSid\"]" + - + Property: PayloadData3 + PropertyValue: "AccessList: %AccessList%" + Values: + - + Name: AccessList + Value: "/Event/EventData/Data[@Name=\"AccessList\"]" + Refine: "%%(.{4})" + - + Property: PayloadData4 + PropertyValue: "AccessMask: %AccessMask%" + Values: + - + Name: AccessMask + Value: "/Event/EventData/Data[@Name=\"AccessMask\"]" + +Lookups: + - + Name: AccessList + Default: Unknown code + Values: + "%%4416": ReadData (or ListDirectory) + "%%4417": WriteData (or AddFile) + "%%4418": AppendData (or AddSubdirectory or CreatePipeInstance) + "%%4419": ReadEA (or Enumerate SubKeys) + "%%4420": WriteEA + "%%4421": Execute/Traverse + "%%4422": DeleteChild + "%%4423": ReadAttributes + "%%4424": WriteAttributes + "%%1537": DELETE + "%%1538": READ_CONTROL + "%%1539": WRITE_DAC + "%%1540": WRITE_OWNER + "%%1541": SYNCHRONIZE + "%%1542": ACCESS_SYS_SEC + - + Name: AccessMask + Default: Unknown code + Values: + "%%4416": ReadData (or ListDirectory) + "%%4417": WriteData (or AddFile) + "%%4418": AppendData (or AddSubdirectory or CreatePipeInstance) + "%%4419": ReadEA (or Enumerate SubKeys) + "%%4420": WriteEA + "%%4421": Execute/Traverse + "%%4422": DeleteChild + "%%4423": ReadAttributes + "%%4424": WriteAttributes + "%%1537": DELETE + "%%1538": READ_CONTROL + "%%1539": WRITE_DAC + "%%1540": WRITE_OWNER + "%%1541": SYNCHRONIZE + "%%1542": ACCESS_SYS_SEC # Documentation: # https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5140