Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New maps, various fixes #41

Merged
merged 2 commits into from
Dec 5, 2020
Merged

New maps, various fixes #41

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
28fdc37
Merge pull request #2 from EricZimmerman/master
AndrewRathbun Dec 3, 2020
c614569
New maps, various fixes
AndrewRathbun Dec 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions evtx/Maps/Microsoft-Windows-Partition-Diagnostic_1006.map
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Author: Mark Hallman mark.hallman@gmail.com, Hyun Yi @hyuunnn
Author: Mark Hallman mark.hallman@gmail.com, Hyun Yi @hyuunnn, Andrew Rathbun
Description: USB Insertion/Removal - EventId 1006
EventId: 1006
Channel: "Microsoft-Windows-Partition/Diagnostic"
Expand Down Expand Up @@ -44,4 +44,6 @@ Maps:
Values:
-
Name: ParentId
Value: "/Event/EventData/Data[@Name=\"ParentId\"]"
Value: "/Event/EventData/Data[@Name=\"ParentId\"]"

# Frankly, there is too much data to fit within 6 PayloadData columns. As always, all data is in the Payload column but there isn't enough room to map out all the information cleanly. There is a great blog post with more information here: https://www.atropos4n6.com/windows/extract-vsns-that-reside-in-windows-partition4diagnostic-evtx/.
2 changes: 1 addition & 1 deletion evtx/Maps/Microsoft-Windows-SysMon_Operational_1.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ Maps:
Value: "/Event/EventData/Data[@Name=\"ParentCommandLine\"]"
-
Property: UserName
PropertyValue: "Account: %User%"
"%User%"
Values:
-
Name: User
Expand Down
2 changes: 1 addition & 1 deletion evtx/Maps/Microsoft-Windows-SysMon_Operational_19.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ Maps:
Value: "/Event/EventData/Data[@Name=\"EventNamespace\"]"
-
Property: UserName
PropertyValue: "Account: %User%"
"%User%"
Values:
-
Name: User
Expand Down
2 changes: 1 addition & 1 deletion evtx/Maps/Microsoft-Windows-SysMon_Operational_20.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ Maps:
Value: "/Event/EventData/Data[@Name=\"Destination\"]"
-
Property: UserName
PropertyValue: "Account: %User%"
"%User%"
Values:
-
Name: User
Expand Down
2 changes: 1 addition & 1 deletion evtx/Maps/Microsoft-Windows-SysMon_Operational_21.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ Maps:
Value: "/Event/EventData/Data[@Name=\"Filter\"]"
-
Property: UserName
PropertyValue: "Account: %User%"
"%User%"
Values:
-
Name: User
Expand Down
2 changes: 1 addition & 1 deletion evtx/Maps/Microsoft-Windows-SysMon_Operational_23.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ Maps:
Value: "/Event/EventData/Data[@Name=\"Archived\"]"
-
Property: UserName
PropertyValue: "Account: %User%"
PropertyValue: "%User%"
Values:
-
Name: User
Expand Down
2 changes: 1 addition & 1 deletion evtx/Maps/Microsoft-Windows-SysMon_Operational_3.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ Maps:
Value: "/Event/EventData/Data[@Name=\"DestinationIp\"]"
-
Property: UserName
PropertyValue: "Account: %User%"
"%User%"
Values:
-
Name: User
Expand Down
6 changes: 3 additions & 3 deletions evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_100.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,21 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
Maps:
-
Property: PayloadData1
PropertyValue: Task %TaskName%
PropertyValue: "Task: %TaskName%"
Values:
-
Name: TaskName
Value: "/Event/EventData/Data[@Name=\"TaskName\"]"
-
Property: PayloadData2
PropertyValue: Context %UserContext%
PropertyValue: Context: %UserContext%
Values:
-
Name: UserContext
Value: "/Event/EventData/Data[@Name=\"UserContext\"]"
-
Property: PayloadData3
PropertyValue: Instance Id %InstanceId%
PropertyValue: Instance Id: %InstanceId%
Values:
-
Name: InstanceId
Expand Down
6 changes: 3 additions & 3 deletions evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_102.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,21 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
Maps:
-
Property: PayloadData1
PropertyValue: Task %TaskName%
PropertyValue: "Task: %TaskName%"
Values:
-
Name: TaskName
Value: "/Event/EventData/Data[@Name=\"TaskName\"]"
-
Property: PayloadData2
PropertyValue: Context %UserContext%
PropertyValue: Context: %UserContext%
Values:
-
Name: UserContext
Value: "/Event/EventData/Data[@Name=\"UserContext\"]"
-
Property: PayloadData3
PropertyValue: Instance Id %InstanceId%
PropertyValue: Instance Id: %InstanceId%
Values:
-
Name: InstanceId
Expand Down
2 changes: 1 addition & 1 deletion evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_106.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
Maps:
-
Property: PayloadData1
PropertyValue: Task %TaskName%
PropertyValue: "Task: %TaskName%"
Values:
-
Name: TaskName
Expand Down
4 changes: 2 additions & 2 deletions evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_119.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
Maps:
-
Property: PayloadData1
PropertyValue: Task %TaskName%
PropertyValue: "Task: %TaskName%"
Values:
-
Name: TaskName
Expand All @@ -19,7 +19,7 @@ Maps:
Value: "/Event/EventData/Data[@Name=\"UserName\"]"
-
Property: PayloadData3
PropertyValue: Instance Id %InstanceId%
PropertyValue: Instance Id: %InstanceId%
Values:
-
Name: InstanceId
Expand Down
2 changes: 1 addition & 1 deletion evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_140.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
Maps:
-
Property: PayloadData1
PropertyValue: Task %TaskName%
PropertyValue: "Task: %TaskName%"
Values:
-
Name: TaskName
Expand Down
2 changes: 1 addition & 1 deletion evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_141.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
Maps:
-
Property: PayloadData1
PropertyValue: Task %TaskName%
PropertyValue: "Task: %TaskName%"
Values:
-
Name: TaskName
Expand Down
4 changes: 2 additions & 2 deletions evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_200.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
Maps:
-
Property: PayloadData1
PropertyValue: Task %TaskName%
PropertyValue: "Task: %TaskName%"
Values:
-
Name: TaskName
Expand All @@ -19,7 +19,7 @@ Maps:
Value: "/Event/EventData/Data[@Name=\"ActionName\"]"
-
Property: PayloadData3
PropertyValue: Instance Id %TaskInstanceId%
PropertyValue: Instance Id: %TaskInstanceId%
Values:
-
Name: TaskInstanceId
Expand Down
4 changes: 2 additions & 2 deletions evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_201.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
Maps:
-
Property: PayloadData1
PropertyValue: Task %TaskName%
PropertyValue: "Task: %TaskName%"
Values:
-
Name: TaskName
Expand All @@ -19,7 +19,7 @@ Maps:
Value: "/Event/EventData/Data[@Name=\"ActionName\"]"
-
Property: PayloadData3
PropertyValue: Instance Id %TaskInstanceId%
PropertyValue: Instance Id: %TaskInstanceId%
Values:
-
Name: TaskInstanceId
Expand Down
2 changes: 1 addition & 1 deletion evtx/Maps/Security_1102.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ Maps:
Value: "/Event/UserData/LogFileCleared/SubjectUserName"
-
Property: PayloadData1
PropertyValue: SID (%SubjectUserSid%)
PropertyValue: "SID: (%SubjectUserSid%)"
Values:
-
Name: SubjectUserSid
Expand Down
2 changes: 1 addition & 1 deletion evtx/Maps/Security_4624.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ Maps:
Value: "/Event/EventData/Data[@Name=\"TargetUserName\"]"
-
Property: PayloadData2
PropertyValue: LogonType %LogonType%
PropertyValue: "LogonType %LogonType%"
Values:
-
Name: LogonType
Expand Down
2 changes: 1 addition & 1 deletion evtx/Maps/Security_4625.map
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ Maps:
Value: "/Event/EventData/Data[@Name=\"TargetUserName\"]"
-
Property: PayloadData2
PropertyValue: LogonType %LogonType%
PropertyValue: "LogonType %LogonType%"
Values:
-
Name: LogonType
Expand Down
75 changes: 75 additions & 0 deletions evtx/Maps/Security_4722.map
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
Author: Andrew Rathbun
Description: A user account was enabled
EventId: 4722
Channel: Security
Maps:
-
Property: UserName
PropertyValue: "%domain%\\%user% (%sid%)"
Values:
-
Name: domain
Value: "/Event/EventData/Data[@Name=\"SubjectDomainName\"]"
-
Name: user
Value: "/Event/EventData/Data[@Name=\"SubjectUserName\"]"
-
Name: sid
Value: "/Event/EventData/Data[@Name=\"SubjectUserSid\"]"
-
Property: PayloadData1
PropertyValue: "Target: %TargetDomainName%\\%TargetUserName% (%TargetSid%)"
Values:
-
Name: TargetUserName
Value: "/Event/EventData/Data[@Name=\"TargetUserName\"]"
-
Name: TargetDomainName
Value: "/Event/EventData/Data[@Name=\"TargetDomainName\"]"
-
Name: TargetSid
Value: "/Event/EventData/Data[@Name=\"TargetSid\"]"
-
Property: PayloadData2
PropertyValue: "SubjectLogonId: %SubjectLogonId%"
Values:
-
Name: SubjectLogonId
Value: "/Event/EventData/Data[@Name=\"SubjectLogonId\"]"


# Valid properties include:
# UserName
# RemoteHost
# ExecutableInfo --> used for things like process command line, scheduled task, info from service install, etc.
# PayloadData1 through PayloadData6

# Example payload data
# <EventData>
# <Data Name="TargetUserName">defaultuser1</Data>
# <Data Name="TargetDomainName">MICROSO-F9QCQ4I</Data>
# <Data Name="TargetSid">S-1-5-21-3634127885-2815721165-4177678784-1004</Data>
# <Data Name="SubjectUserSid">S-1-5-18</Data>
# <Data Name="SubjectUserName">MICROSO-F9QCQ4I$</Data>
# <Data Name="SubjectDomainName">TEMP</Data>
# <Data Name="SubjectLogonId">0x3E7</Data>
# <Data Name="PrivilegeList">-</Data>
# <Data Name="SamAccountName">defaultuser1</Data>
# <Data Name="DisplayName">%%1793</Data>
# <Data Name="UserPrincipalName">-</Data>
# <Data Name="HomeDirectory">%%1793</Data>
# <Data Name="HomePath">%%1793</Data>
# <Data Name="ScriptPath">%%1793</Data>
# <Data Name="ProfilePath">%%1793</Data>
# <Data Name="UserWorkstations">%%1793</Data>
# <Data Name="PasswordLastSet">%%1794</Data>
# <Data Name="AccountExpires">%%1794</Data>
# <Data Name="PrimaryGroupId">513</Data>
# <Data Name="AllowedToDelegateTo">-</Data>
# <Data Name="OldUacValue">0x0</Data>
# <Data Name="NewUacValue">0x15</Data>
# <Data Name="UserAccountControl">%%2080%%2082%%2084</Data>
# <Data Name="UserParameters">%%1793</Data>
# <Data Name="SidHistory">-</Data>
# <Data Name="LogonHours">%%1797</Data>
# </EventData>
75 changes: 75 additions & 0 deletions evtx/Maps/Security_4723.map
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
Author: Andrew Rathbun
Description: An attempt was made to change an account's password
EventId: 4723
Channel: Security
Maps:
-
Property: UserName
PropertyValue: "%domain%\\%user% (%sid%)"
Values:
-
Name: domain
Value: "/Event/EventData/Data[@Name=\"SubjectDomainName\"]"
-
Name: user
Value: "/Event/EventData/Data[@Name=\"SubjectUserName\"]"
-
Name: sid
Value: "/Event/EventData/Data[@Name=\"SubjectUserSid\"]"
-
Property: PayloadData1
PropertyValue: "Target: %TargetDomainName%\\%TargetUserName% (%TargetSid%)"
Values:
-
Name: TargetUserName
Value: "/Event/EventData/Data[@Name=\"TargetUserName\"]"
-
Name: TargetDomainName
Value: "/Event/EventData/Data[@Name=\"TargetDomainName\"]"
-
Name: TargetSid
Value: "/Event/EventData/Data[@Name=\"TargetSid\"]"
-
Property: PayloadData2
PropertyValue: "SubjectLogonId: %SubjectLogonId%"
Values:
-
Name: SubjectLogonId
Value: "/Event/EventData/Data[@Name=\"SubjectLogonId\"]"


# Valid properties include:
# UserName
# RemoteHost
# ExecutableInfo --> used for things like process command line, scheduled task, info from service install, etc.
# PayloadData1 through PayloadData6

# Example payload data
# <EventData>
# <Data Name="TargetUserName">defaultuser1</Data>
# <Data Name="TargetDomainName">MICROSO-F9QCQ4I</Data>
# <Data Name="TargetSid">S-1-5-21-3634127885-2815721165-4177678784-1004</Data>
# <Data Name="SubjectUserSid">S-1-5-18</Data>
# <Data Name="SubjectUserName">MICROSO-F9QCQ4I$</Data>
# <Data Name="SubjectDomainName">TEMP</Data>
# <Data Name="SubjectLogonId">0x3E7</Data>
# <Data Name="PrivilegeList">-</Data>
# <Data Name="SamAccountName">defaultuser1</Data>
# <Data Name="DisplayName">%%1793</Data>
# <Data Name="UserPrincipalName">-</Data>
# <Data Name="HomeDirectory">%%1793</Data>
# <Data Name="HomePath">%%1793</Data>
# <Data Name="ScriptPath">%%1793</Data>
# <Data Name="ProfilePath">%%1793</Data>
# <Data Name="UserWorkstations">%%1793</Data>
# <Data Name="PasswordLastSet">%%1794</Data>
# <Data Name="AccountExpires">%%1794</Data>
# <Data Name="PrimaryGroupId">513</Data>
# <Data Name="AllowedToDelegateTo">-</Data>
# <Data Name="OldUacValue">0x0</Data>
# <Data Name="NewUacValue">0x15</Data>
# <Data Name="UserAccountControl">%%2080%%2082%%2084</Data>
# <Data Name="UserParameters">%%1793</Data>
# <Data Name="SidHistory">-</Data>
# <Data Name="LogonHours">%%1797</Data>
# </EventData>
Loading