Security Monitoring

Security.Monitoring :: 1.0.3.5 (Management Pack)

1.0.0.0 - detect certain tools, pth detection, credential elevation detection, event collector monitor,
1.0.1.0 - monitor wdigest registry key
1.0.1.4 - added event checking for clearing event logs, local account creation, service creation.
1.0.1.5 - added threat hunting view and special groups rule.
1.0.1.7 - added event collection rules for threat hunting.
1.0.1.9 - added WEF rules targeting forwarded events logs.

Management Pack Elements

Show Management Pack References

TypeDefinitions

ModuleTypes

DataSourceModuleType (1)
ProbeActionModuleType (1)

UnitMonitorType (2)

Monitoring

Monitors

UnitMonitor (5)

Rule (61)
Recovery (2)
Overrides

MonitorPropertyOverride (4)
RulePropertyOverride (3)

Presentation

FolderItem (4)
Folder (2)
View (4)

Reporting

Report (3)
ReportResource (3)

DataSource Modules (1)

	DisplayName	ID	Isolation	Accessibility
	GPO Change Event then run correlation script DS	SecurityMonitoringMP.GPOMonitoring.Event.DS	Any	Public

ProbeAction Modules (1)

	ID	Isolation	Accessibility
	SecurityMonitoringMP.GPOMonitoring.ProbeActionModule.GPOCorrelationScript	Any	Public

Unit Monitor Types (2)

	DisplayName	ID	Accessibility	Support Monitor Recalculate
	Check Existence of RegKey Monitor Type	SecurityMonitoringMP.RegValueExistsMonitorType	Internal	False
	Check value of registry key	SecurityMonitoringMP.RegValueMonitorType	Internal	False

Unit Monitors (5)

DisplayName	ID	Target	Category	Enabled	Alert Generate	Accessibility
Security Monitoring: Repeated RDP Logon Failures	SecurityMonitoringMP.Event.RepeatedLogonMonitor	Microsoft.Windows.Server.OperatingSystem	Custom	True	True	Public
A System - Is Pending Restart	SecurityMonitoringMP.Event.SystemPendingRestart	Microsoft.Windows.Server.OperatingSystem	Custom	False	True	Public
Security Monitoring: Event Log Collector Service is stopped	SecurityMonitoringMP.Health.EventCollectorMonitor	WindowsEventCollectorDiscovery.EventLogCollectorServer	Custom	True	True	Public
Security Monitoring: UseLogonCredential key does not exist	SecurityMonitoringMP.UseLogonCredentialExistsMonitor	Microsoft.Windows.Server.OperatingSystem	Custom	True	True	Internal
Security Monitoring: Wdigest passwords stored in clear text	SecurityMonitoringMP.WDigestRegConfiguredMonitor	Microsoft.Windows.Server.OperatingSystem	Custom	True	True	Internal

Rules (61)

DisplayName	ID	Target	Category	Enabled	Alert Generate
Failed RDP Logon	SecurityMonitoring.Event.FailedLogin	Microsoft.Windows.Server.OperatingSystem	Custom	True	True
Collect Failed Login Attemts	SecurityMonitoring.Failed.Login.Attempts.Collection	Microsoft.Windows.Computer	EventCollection	True	False
Security Monitoring: Domain Admins membership has changed	SecurityMonitoringMP.Accounts.DomainAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	True
Security Monitoring: Enterprise Admins membership has changed	SecurityMonitoringMP.Accounts.EnterpriseAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	True
Security Monitoring: Local Administrators Group was Modified	SecurityMonitoringMP.Accounts.LocalAdminChange	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: Schema Admins membership has changed	SecurityMonitoringMP.Accounts.SchemaAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	True
Security Monitoring: Mimikatz in use	SecurityMonitoringMP.APPLocker.Mimikatz	Microsoft.Windows.Computer	Alert	False	True
Security Monitoring: Prohibited App in Use	SecurityMonitoringMP.APPLocker.ProhibitedApp	Microsoft.Windows.Computer	Alert	True	True
Security Monitoring: PSEXEC in Use	SecurityMonitoringMP.APPLocker.PSExec	Microsoft.Windows.Computer	Alert	False	True
Security Monitoring: WCE in Use	SecurityMonitoringMP.APPLocker.WCE	Microsoft.Windows.Computer	Alert	False	True
Security Monitoring: WinRar in use	SecurityMonitoringMP.APPLocker.WinRar	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
Security Monitoring: A suspicious process creation (AppLocker bypass) was executed	SecurityMonitoringMP.Event.4688.SuspiciousApplockerJava	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: A suspicious process creation (AppLocker bypass using regsvr32) was execuited	SecurityMonitoringMP.Event.4688.SuspiciousApplockerRegsvr	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: A suspicious process creation (cmd) was executed	SecurityMonitoringMP.Event.4688.SuspiciousCMD	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: A suspicious process creation (FTP script execution via echo command) was executed	SecurityMonitoringMP.Event.4688.SuspiciousFTPCommand	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: A suspicious process creation (registry) was executed	SecurityMonitoringMP.Event.4688.SuspiciousReg	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring; A suspicious process creation (malicious use of WindowPosition with PowerShell) was executed	SecurityMonitoringMP.Event.4688.SuspiciousWindowsPosition	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: Possible Golden Ticket in Use	SecurityMonitoringMP.Event.GoldenTicketDetection	Microsoft.Windows.Server.DC.Computer	Alert	True	True
Security Monitoring: A New GPO has been created	SecurityMonitoringMP.Event.GPOCreation	Microsoft.Windows.Server.DC.Computer	Alert	True	True
Security Monitoring: A GPO was Deleted	SecurityMonitoringMP.Event.GPODelection	Microsoft.Windows.Server.DC.Computer	Alert	True	True
Security Monitoring: Local account created on a member server	SecurityMonitoringMP.Event.LocalAccountCreatedonServer	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: Scheduled Task was Created	SecurityMonitoringMP.Event.ScheduledTaskCreation	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: Security Log was cleared	SecurityMonitoringMP.Event.SecurityLogCleared	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: A Service was created on a domain controller	SecurityMonitoringMP.Event.ServiceCreatedonDC	Microsoft.Windows.Server.DC.Computer	Alert	True	True
Security Monitoring: A service was created on a member server	SecurityMonitoringMP.Event.ServiceCreatedonMemberServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
Security Monitoring: Service associated with a known threat was created on a member server	SecurityMonitoringMP.Event.ServiceKnownThreat	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: A Smart Card has been Disabled to Allow for Interactive Logon	SecurityMonitoringMP.Event.SmartCardDisabled	Microsoft.Windows.Server.DC.Computer	Alert	True	True
Security Monitoring: Software was Installed on a Server	SecurityMonitoringMP.Event.SoftwareInstallOnServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
Security Monitoring: Software was Removed from a Server	SecurityMonitoringMP.Event.SoftwareRemovedFromServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
Security Monitoring: The system Log was cleared	SecurityMonitoringMP.Event.SystemLogCleared	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: A system has been powered off	SecurityMonitoringMP.Event.SystemPoweredOff	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
Security Monitoring: A system was restarted	SecurityMonitoringMP.Event.SystemRestarted	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
Security Monitoring: Unexpected System Shutdown	SecurityMonitoringMP.Event.UnexpectedShutdown	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
Security Monitoring Collection: Event ID 4672	SecurityMonitoringMP.EventCollection.4672	Microsoft.Windows.Server.OperatingSystem	EventCollection	False	False
Security Monitoring Collection: Event ID 4624 Logon Type 4	SecurityMonitoringMP.EventCollection.BatchLogon	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
Security Monitoring Event Collection: Event ID 4769 result 0x1F	SecurityMonitoringMP.EventCollection.GoldenTicket	Microsoft.Windows.Server.DC.Computer	EventCollection	True	False
Security Monitoring Collection: Event ID 4694	SecurityMonitoringMP.EventCollection.SpecialGroupLogon	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
Security Monitoring Forwarded Events: A suspicious process creation (AppLocker bypass) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousApplockerJava	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring: A suspicious process creation (AppLocker bypass using regsvr32) was execuited	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousApplockerRegsvr	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: A suspicious process creation (cmd) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousCMD	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: A suspicious process creation (FTP script execution via echo command) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousFTPCommand	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: A suspicious process creation (registry) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousReg	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: A suspicious process creation (malicious use of WindowPosition with PowerShell) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousWindowsPosition	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: Potential Credential Swap in Progress	SecurityMonitoringMP.ForwardedEvents.CredentialSwap	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: Local User Created or Deleted in Administrator Security Group	SecurityMonitoringMP.ForwardedEvents.LocalUserCreatedDeleted	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: Invoke-Mimikatz in use	SecurityMonitoringMP.ForwardedEvents.PowerSploit	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: Prohibited App in Use	SecurityMonitoringMP.ForwardedEvents.ProhibitedApp	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: Possible PtH Attack in Progress Against Tier 2	SecurityMonitoringMP.ForwardedEvents.PtHTier2	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	False	True
Security Monitoring Forwarded Events: Security log cleared on a server configured to forward events	SecurityMonitoringMP.ForwardedEvents.SecurityLogCleared	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: Service Created on system	SecurityMonitoringMP.ForwardedEvents.ServiceCreation	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	False	True
Security Monitoring Forwarded Events: Service associated with a known threat was created on a forwarding computer	SecurityMonitoringMP.ForwardedEvents.ServiceCreationKnownThreats	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: Special Group logon event	SecurityMonitoringMP.ForwardedEvents.SpecialGroupLogon	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
Security Monitoring Forwarded Events: System Log was Cleared	SecurityMonitoringMP.ForwardedEvents.SystemLogCleared	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
GPO Change Event then run correlation script Rule	SecurityMonitoringMP.GPOMonitoring.EventAndScript.Rule	Microsoft.Windows.Server.DC.Computer	Custom	True	True
Security Monitoring: Invoke-Mimikatz in use	SecurityMonitoringMP.PowerShellLog.PowerSploit	Microsoft.Windows.OperatingSystem	Alert	True	True
Security Monitoring: Potential Credential Swap in Progress	SecurityMonitoringMP.Pth.CredentialSwap	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring: Possible PtH attack in progress (successful) against DC	SecurityMonitoringMP.Pth.PtHAgainstDC	Microsoft.Windows.Server.DC.Computer	Alert	False	True
Security Monitoring: Possible PtH Attack in Progress against tier 1	SecurityMonitoringMP.Pth.PtHAgainstTier1	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
Security Monitoring Threat Hunting: Batch Logon in use	SecurityMonitoringMP.ThreatHunt.BatchLogonInUse	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
Security Monitoring Threat Hunting: Kerberos Integrity Check on Decrypted Field Failed	SecurityMonitoringMP.ThreatHunt.GoldenTicket	Microsoft.Windows.Server.DC.Computer	Alert	True	True
Security Monitoring Threat Hunting: Special Group logon event	SecurityMonitoringMP.ThreatHunt.SpecialGroupLogon	Microsoft.Windows.Server.OperatingSystem	Alert	True	True

Recoveries (2)

	DisplayName	ID	Target	Monitor	Reset Monitor	Category	Enabled	Accessibility
	Modify Windows Firewall	SecurityMonitoringMP.Recovery.BlockPortWindowsFW	Microsoft.Windows.Server.OperatingSystem	SecurityMonitoringMP.Event.RepeatedLogonMonitor	False	Custom	false	Public
	Restart Service	SecurityMonitoringMP.Recovery.RestartWecSVC	WindowsEventCollectorDiscovery.EventLogCollectorServer	SecurityMonitoringMP.Health.EventCollectorMonitor	True	Custom	true	Public

Monitor Property Overrides (4)

ID	Context	Target
OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2012Full	Microsoft.Windows.Server.6.2.Full.OperatingSystem	SecurityMonitoringMP.UseLogonCredentialExistsMonitor
OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2012OS	Microsoft.Windows.Server.6.2.OperatingSystem	SecurityMonitoringMP.UseLogonCredentialExistsMonitor
OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2012R2	Microsoft.Windows.Server.2012.R2.OperatingSystem	SecurityMonitoringMP.UseLogonCredentialExistsMonitor
OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2016	Microsoft.Windows.Server.10.0.OperatingSystem	SecurityMonitoringMP.UseLogonCredentialExistsMonitor

Rule Property Overrides (3)

ID	Context	Target
OverrideForRuleSecurityMonitoringMP.Pth.PtHAgainstTier1.ServerDCComputer	Microsoft.Windows.Server.DC.Computer	SecurityMonitoringMP.Pth.PtHAgainstTier1
OverrideForRuleSecurityMonitoringMP.Pth.PtHAgainstTier1.SQLComputer	Microsoft.SQLServer.ComputerGroup	SecurityMonitoringMP.Pth.PtHAgainstTier1
OverrideForRuleSecurityMonitoringMPEventLocalAccountCreatedonServer.DomainControllers	Microsoft.Windows.Server.DC.Computer	SecurityMonitoringMP.Event.LocalAccountCreatedonServer

Folder Items (4)

ID	FolderName	ElementID
i08b0d1b442c04c8daf4574e19f39c3c9	SecurityMonitoringMP.Folder.SecurityMonitoring	SecurityMonitoringMP.View.SecurityMonitoringAlerts
i3691038e88044516a67ac5bbc79422c0	SecurityMonitoringMP.Folder.EventCollectors	SecurityMonitoringMP.View.EventCollectorState
i74a5ba1881174da89a4041962320a070	SecurityMonitoringMP.Folder.SecurityMonitoring	SecurityMonitoringMP.View.ThreatHuntingAlert
if3e38fad5d3547168a4bca954c52cecb	SecurityMonitoringMP.Folder.EventCollectors	SecurityMonitoringMP.View.EventCollectorAlerts

Folders (2)

	DisplayName	ID	ParentFolder	Accessibility
	Event Collectors	SecurityMonitoringMP.Folder.EventCollectors	SecurityMonitoringMP.Folder.SecurityMonitoring	Public
	Security Monitoring	SecurityMonitoringMP.Folder.SecurityMonitoring	Microsoft.SystemCenter.Monitoring.ViewFolder.Root	Public

Views (4)

DisplayName	ID	Target	Type	Accessibility	Visible
Event Collector Alerts	SecurityMonitoringMP.View.EventCollectorAlerts	WindowsEventCollectorDiscovery.EventLogCollectorServer	Microsoft.SystemCenter.AlertViewType	Public	True
Event Collector State	SecurityMonitoringMP.View.EventCollectorState	WindowsEventCollectorDiscovery.EventLogCollectorServer	Microsoft.SystemCenter.StateViewType	Public	True
Security Monitoring MP Alerts	SecurityMonitoringMP.View.SecurityMonitoringAlerts	System.Entity	Microsoft.SystemCenter.AlertViewType	Public	True
Threat Hunting	SecurityMonitoringMP.View.ThreatHuntingAlert	System.Entity	Microsoft.SystemCenter.AlertViewType	Public	True

Report Resources (3)

ID	File Name	Accessibility
FailedLoginDetails.ID	Failed Login Details.rdl	Internal
FailedLoginSummary.ID	Failed Login Summary.rdl	Internal
FailedLoginSummary24.ID	Failed Login Summary (24 hours).rdl	Internal

Reports (3)

ID	Accessibility	Visible
Security.Monitoring.FailedLoginDetails	Public	True
Security.Monitoring.FailedLoginSummary	Public	True
Security.Monitoring.FailedLoginSummary24Hours	Public	True