Security Monitoring

Security.Monitoring :: 1.0.7.1 (Management Pack)

All documentation can be found at the following page:
https://nathangau.wordpress.com/2017/05/01/introducing-the-security-monitoring-management-pack-for-scom/

• Show Management Pack XML
• Get Management Pack data in Excel format
• Security.Monitoring.mpb

Management Pack Elements

Classes (7)

	DisplayName	ID	Base Class	Abstract	Hosted	Singleton	Group	Extension	Accessibility
	Security Monitoring: Administrative Accouts Class	Security.Monitoring.AdminAccounts	Microsoft.Windows.ApplicationComponent	False	False	False	False	False	Internal
	Security Monitoring Configuration	Security.Monitoring.SecurityMonitoringDA	Microsoft.SystemCenter.ServiceDesigner.Service	False	False	False	False	False	Public
	Security Monitoring Configuration Domain Controllers	Security.Monitoring.SecurityMonitoringDA.DomainControllers	Microsoft.SystemCenter.ServiceDesigner.ServiceComponentGroup	False	False	False	False	False	Public
	Security Monitoring Configuration Member Servers	Security.Monitoring.SecurityMonitoringDA.MemberServers	Microsoft.SystemCenter.ServiceDesigner.ServiceComponentGroup	False	False	False	False	False	Public
	Security Monitoring: Extended Writeable Directory Monitoring Group	Security.Monitoring.WindowsComputersExtendedWriteableDirectoryMonitoring	Microsoft.SystemCenter.ComputerGroup	False	False	True	True	False	Public
	Security Monitoring: OS User Writeable Locations	Security.Monitoring.WriteableLocations	Microsoft.Windows.LocalApplication	False	True	False	False	False	Internal
	Security Monitoring: User Writeable Directories Seed Class	Security.Monitoring.WriteableLocationsSeedClass	Microsoft.Windows.Server.Computer	False	False	False	False	False	Internal

Relationship Types (4)

	DisplayName	ID	Source	Target	Accessibility	Abstract
	Security Monitoring DA Relationships	Security.Monitoring.SecurityMonitoringDARelationships	Security.Monitoring.SecurityMonitoringDA	Security.Monitoring.SecurityMonitoringDA.DomainControllers	Internal	False
	Security Monitoring DA Relationship for Domain Controller Class	Security.Monitoring.SecurityMonitoringDARelationshipsForDCs	Security.Monitoring.SecurityMonitoringDA.DomainControllers	Microsoft.Windows.Server.DC.Computer	Internal	False
	Security Monitoring DA Relationships for Member Servers	Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers	Security.Monitoring.SecurityMonitoringDA.MemberServers	Microsoft.Windows.Computer	Internal	False
	Security Monitoring DA Relationship for OS Class	Security.Monitoring.SecurityMonitoringDARelationshipsforMS	Security.Monitoring.SecurityMonitoringDA	Security.Monitoring.SecurityMonitoringDA.MemberServers	Internal	False

DataSource Modules (18)

	DisplayName	ID	Isolation	Accessibility
	GPO Change Event then run correlation script DS	SecurityMonitoringMP.GPOMonitoring.Event.DS	Any	Public
	Security.Monitoring.AuditPol.DS	Security.Monitoring.AuditPol.DS	Any	Public
	Security.Monitoring.DistributedApplication.DataSource	Security.Monitoring.DistributedApplication.DataSource	Any	Public
	Security.Monitoring.DistributedApplicationMS.DataSource	Security.Monitoring.DistributedApplicationMS.DataSource	Any	Public
	Security.Monitoring.MultiStringRegistry.DS	Security.Monitoring.MultiStringRegistry.DS	Any	Internal
	Security.Monitoring.SMBv1Connections.DS	Security.Monitoring.SMBv1Connections.DS	Any	Internal
	SecurityMonitoring.Event.RepeatedFailedLogind.DS	SecurityMonitoring.Event.RepeatedFailedLogind.DS	Any	Public
	SecurityMonitoringMP.4688CommandAudit.DS	SecurityMonitoringMP.4688CommandAudit.DS	Any	Internal
	SecurityMonitoringMP.DCServiceCreation.DS	SecurityMonitoringMP.DCServiceCreation.DS	Any	Public
	SecurityMonitoringMP.Discoveries.DiscoverWriteableFileLocations	SecurityMonitoringMP.Discoveries.DiscoverWriteableFileLocations	Any	Public
	SecurityMonitoringMP.GPOMonitoring.GPOEvent.DS	SecurityMonitoringMP.GPOMonitoring.GPOEvent.DS	Any	Public
	SecurityMonitoringMP.LocalAccountChange.DS	SecurityMonitoringMP.LocalAccountChange.DS	Any	Public
	SecurityMonitoringMP.Modules.SecurityLogClear.DS	SecurityMonitoringMP.Modules.SecurityLogClear.DS	Any	Public
	SecurityMonitoringMP.Modules.SystemLogClear.DS	SecurityMonitoringMP.Modules.SystemLogClear.DS	Any	Public
	SecurityMonitoringMP.ScheduledTaskCreation.DS	SecurityMonitoringMP.ScheduledTaskCreation.DS	Any	Public
	SecurityMonitoringMP.SuspiciousUserContext.DS	SecurityMonitoringMP.SuspiciousUserContext.DS	Any	Internal
	SecurityMonitoringMP.WriteableDirectories.DS	SecurityMonitoringMP.WriteableDirectories.DS	Any	Internal
	SecurityMonitoringMP.WriteableDirectoriesExtended.DS	SecurityMonitoringMP.WriteableDirectoriesExtended.DS	Any	Internal

ProbeAction Modules (4)

	ID	Isolation	Accessibility
	Security.Monitoring.AuditPol.PowerShell	Any	Internal
	Security.Monitoring.MultiStringRegistry.PowerShell	Any	Internal
	Security.Monitoring.SMBv1Connections.PowerShell	Any	Internal
	SecurityMonitoringMP.GPOMonitoring.ProbeActionModule.GPOCorrelationScript	Any	Public

Unit Monitor Types (7)

	DisplayName	ID	Accessibility	Support Monitor Recalculate
	Check Existence of RegKey Monitor Type	SecurityMonitoringMP.RegValueExistsMonitorType	Internal	False
	Check value of registry key	SecurityMonitoringMP.RegValueMonitorType	Internal	False
	CheckRegValue	CheckRegValue	Internal	False
	CheckRegValueString	CheckRegValueString	Internal	False
	MultiStringRegMonitorType	MultiStringRegMonitorType	Internal	False
	Security.Monitoring.AuditPolMonitorType	Security.Monitoring.AuditPolMonitorType	Public	False
	SecurityMonitoringMP.CommandLineAuditSetting	SecurityMonitoringMP.CommandLineAuditSetting	Internal	False

Discoveries (6)

	DisplayName	ID	Target	Enabled
	Security Monitoring: Discover Admin Accounts	Security.Monitoring.AdminAccountDiscovery	Microsoft.Windows.Computer	False
	Security Monitoring: Distributed App DC Discovery	Security.Monitoring.DA.DCDiscovery	Microsoft.Windows.Server.DC.Computer	True
	Security Monitoring: Distributed App MemberServer Discovery	Security.Monitoring.DA.MSDiscovery	Microsoft.Windows.Computer	True
	Security Monitoring: User Writeable Directories Seed Class	Security.Monitoring.Discoveries.UserWriteableLocationSeed	Microsoft.Windows.Computer	True
	Security Monitoring: Discover Writeable File Locations	Security.Monitoring.DiscoverWriteableFileLocations	Security.Monitoring.WriteableLocationsSeedClass	True
	Security Monitoring: Populate Extended Writeable Directory Monitoring Group	Security.Monitoring.PopulateExtendedWriteableDirectoryComputerGroup	Security.Monitoring.WindowsComputersExtendedWriteableDirectoryMonitoring	True

Aggregate Monitors (2)

	DisplayName	ID	Target	Algorithm	Category	Enabled	Alert Generate	Accessibility
	Security Monitoring Domain Controller Auditing Settings	Security.Monitoring.DCAuditSettings	Security.Monitoring.SecurityMonitoringDA.DomainControllers	WorstOf	ConfigurationHealth	True	False	Public
	Security Monitoring Member Server Auditing Settings	Security.Monitoring.MemberServerAuditSettings	Security.Monitoring.SecurityMonitoringDA.MemberServers	WorstOf	AvailabilityHealth	True	False	Public

Dependency Monitors (11)

	DisplayName	ID	Target	Algorithm	Source Monitor	Relationship	Category	Enabled	Alert Generate	Accessibility
	Security Monitoring: Logon/Logoff Setting on Domain Controllers	Security.Monitoring.AccountLogonForDC	Security.Monitoring.SecurityMonitoringDA.DomainControllers	WorstOf	Security.Monitoring.AuditAccountLogonDC	Security.Monitoring.SecurityMonitoringDARelationshipsForDCs	AvailabilityHealth	True	False	Internal
	Security Monitoring: Logon/Logoff Setting on Member Serverss	Security.Monitoring.AccountLogonForMS	Security.Monitoring.SecurityMonitoringDA.MemberServers	WorstOf	Security.Monitoring.AuditAccountLogonMS	Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers	AvailabilityHealth	True	False	Internal
	Security Monitoring: Process Auditing Setting on Domain Controllers	Security.Monitoring.DCConfigGroupRollup	Security.Monitoring.SecurityMonitoringDA.DomainControllers	WorstOf	Security.Monitoring.SecurityAudit.ProcessCreationDC	Security.Monitoring.SecurityMonitoringDARelationshipsForDCs	ConfigurationHealth	True	False	Public
	Security Monitoring: Directory Service Changes Setting on Domain Controllers	Security.Monitoring.DCDirectoryServicesAudit	Security.Monitoring.SecurityMonitoringDA.DomainControllers	WorstOf	Security.Monitoring.DirectoryServiceChangeAuditing	Security.Monitoring.SecurityMonitoringDARelationshipsForDCs	AvailabilityHealth	True	False	Internal
	Security Monitoring: Include Command Line in Audit Process Set on DC	Security.Monitoring.IncludeCommandLineonDCs	Security.Monitoring.SecurityMonitoringDA.DomainControllers	WorstOf	Security.Monitoring.IncludeCommandLineProcessCreationonDCs	Security.Monitoring.SecurityMonitoringDARelationshipsForDCs	ConfigurationHealth	True	False	Internal
	Security Monitoring: Include Command Line in Audit Process Set on Member Servers	Security.Monitoring.IncludeCommandLineonMS	Security.Monitoring.SecurityMonitoringDA.MemberServers	WorstOf	Security.Monitoring.IncludeCommandLineProcessCreationonMS	Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers	ConfigurationHealth	True	False	Internal
	Security Monitoring: Process Auditing Setting on Member Servers	Security.Monitoring.MemberServerProcessCreation	Security.Monitoring.SecurityMonitoringDA.MemberServers	WorstOf	Security.Monitoring.ProcessCreationMemberServer	Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers	AvailabilityHealth	True	False	Internal
	Security Monitoring: Security Group Management Audit Setting on Domain Controllers	Security.Monitoring.SecurityGroupManagementforDC	Security.Monitoring.SecurityMonitoringDA.DomainControllers	WorstOf	Security.Monitoring.SGManagementDC	Security.Monitoring.SecurityMonitoringDARelationshipsForDCs	AvailabilityHealth	True	False	Internal
	Security Monitoring: Special Group Logon Setting on Domain Controllers	Security.Monitoring.SpecialGroupLogonDC	Security.Monitoring.SecurityMonitoringDA.DomainControllers	WorstOf	Security.Monitoring.SpecialGroupLogonAuditingEnabledonDC	Security.Monitoring.SecurityMonitoringDARelationshipsForDCs	AvailabilityHealth	True	False	Internal
	Security Monitoring: Special Group Logon Setting on Member Servers	Security.Monitoring.SpecialGroupLogonMS	Security.Monitoring.SecurityMonitoringDA.MemberServers	WorstOf	Security.Monitoring.SpecialGroupLogonEnabledOnMemberServers	Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers	AvailabilityHealth	True	False	Internal
	Security Monitoring: User Account Management Audit Setting on Member Servers	Security.Monitoring.UserAcctforMS	Security.Monitoring.SecurityMonitoringDA.MemberServers	WorstOf	Security.Monitoring.UserAccountMgmtMS	Security.Monitoring.SecurityMonitoringDARelationshipsForMemberServers	AvailabilityHealth	True	False	Internal

Unit Monitors (17)

	DisplayName	ID	Target	Category	Enabled	Alert Generate	Accessibility
	Security Monitoring: Account Logon Monitoring not Set on DCs	Security.Monitoring.AuditAccountLogonDC	Microsoft.Windows.Server.DC.Computer	AvailabilityHealth	True	False	Internal
	Security Monitoring: Account Logon Monitoring not Set on Member Servers	Security.Monitoring.AuditAccountLogonMS	Microsoft.Windows.Computer	AvailabilityHealth	False	False	Internal
	Security Monitoring: Directory Service Change Monitoring not Set on DCs	Security.Monitoring.DirectoryServiceChangeAuditing	Microsoft.Windows.Server.DC.Computer	ConfigurationHealth	True	False	Internal
	Security Monitoring: Include Command Line for Process Auditing Setting on DCs	Security.Monitoring.IncludeCommandLineProcessCreationonDCs	Microsoft.Windows.Server.DC.Computer	AvailabilityHealth	True	False	Internal
	Security Monitoring: Include Command Line for Process Auditing Setting on Member Servers	Security.Monitoring.IncludeCommandLineProcessCreationonMS	Microsoft.Windows.Computer	AvailabilityHealth	False	False	Internal
	Security Monitoring: Check Authentication Packages Registry Key	Security.Monitoring.Monitors.AuthenticationPackages	Microsoft.Windows.Server.OperatingSystem	AvailabilityHealth	True	True	Internal
	Security Monitoring: Process Creation Setting for Member Servers	Security.Monitoring.ProcessCreationMemberServer	Microsoft.Windows.Computer	AvailabilityHealth	False	False	Public
	Security Monitoring: Audit Process Creation Set on DC	Security.Monitoring.SecurityAudit.ProcessCreationDC	Microsoft.Windows.Server.DC.Computer	ConfigurationHealth	True	False	Public
	Security Monitoring: Security Group Management Audit not Set on DCs	Security.Monitoring.SGManagementDC	Microsoft.Windows.Server.DC.Computer	AvailabilityHealth	True	False	Internal
	Security Monitoring: Domain Controller Special Group Logon	Security.Monitoring.SpecialGroupLogonAuditingEnabledonDC	Microsoft.Windows.Server.DC.Computer	AvailabilityHealth	True	False	Internal
	Security Monitoring: Member Server Special Group Logon	Security.Monitoring.SpecialGroupLogonEnabledOnMemberServers	Microsoft.Windows.Computer	AvailabilityHealth	False	False	Internal
	Security Monitoring: User Account Management Audit Setting not Set on Member Servers	Security.Monitoring.UserAccountMgmtMS	Microsoft.Windows.Computer	AvailabilityHealth	False	False	Internal
	Security Monitoring: Repeated RDP Logon Failures	SecurityMonitoringMP.Event.RepeatedLogonMonitor	Microsoft.Windows.Server.OperatingSystem	Custom	True	False	Public
	A System - Is Pending Restart	SecurityMonitoringMP.Event.SystemPendingRestart	Microsoft.Windows.Server.OperatingSystem	Custom	False	True	Public
	Security Monitoring: Event Log Collector Service is stopped	SecurityMonitoringMP.Health.EventCollectorMonitor	WindowsEventCollectorDiscovery.EventLogCollectorServer	Custom	True	True	Public
	Security Monitoring: UseLogonCredential key does not exist	SecurityMonitoringMP.UseLogonCredentialExistsMonitor	Microsoft.Windows.Server.OperatingSystem	Custom	False	True	Internal
	Security Monitoring: Wdigest passwords stored in clear text	SecurityMonitoringMP.WDigestRegConfiguredMonitor	Microsoft.Windows.Server.OperatingSystem	Custom	True	True	Internal

Rules (111)

	DisplayName	ID	Target	Category	Enabled	Alert Generate
	Security Monitoring: Collect SMBv1 Connections	Security.Monitoring.Collect.SMBv1Connections	Microsoft.Windows.Server.OperatingSystem	None	True	False
	Security Monitoring: Collect LAPS Events	Security.Monitoring.CollectionRule.CollectLAPSEvents	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring: Collect Legacy TLS Events	Security.Monitoring.CollectLegacyTLSEvents	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring: Possible Crypto-Ransomware Installed on Computer	Security.Monitoring.Event.4688.GenericCryptoRansomWare	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: PowerShell script run natively to bypass existing execution policy	Security.Monitoring.Event.ByPassExecutionPolicy	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: PowerShell used to Invoke an Encoded Command	Security.Monitoring.Event.InvokeEncodedCommand	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: PowerShell used to Invoke a Remote Expression	Security.Monitoring.Event.InvokeRemoteExpression	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: An attempt was made to kill Windows Defender	Security.Monitoring.Event.KillWindowsDefender	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: PowerShell Running Only in Memory	Security.Monitoring.Event.PowerShellRuninMemoryOnly	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: RegSvr32 used to load a DLL that is not located on this machine	Security.Monitoring.Event.RemoteRegSvr32	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: SeDebugPrivilege Escalation Detected	Security.Monitoring.Event.SeDebugPrivilegeEscalation	Microsoft.Windows.OperatingSystem	Alert	False	True
	Security Monitoring: Possible WMI Persistence Event Detected	Security.Monitoring.Event.WMIPersistence	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Possible WMI Remote Attempt Made To this System	Security.Monitoring.Event.WMIRemote.Destination	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Possible WMI Remote Attempt Made From this System	Security.Monitoring.Event.WMIRemote.Source	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Collect LANMAN Authentication	Security.Monitoring.EventCollection.LanMan	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring: Collect NTLMV1 Events	Security.Monitoring.EventCollection.NTLMV1	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring: Collect WDigest Authentication Events	Security.Monitoring.EventCollection.WdigestAuthentication	Microsoft.Windows.Server.DC.Computer	EventCollection	True	False
	Security Monitoring: Executable Run from User Writeable Windows Directory	Security.Monitoring.ExecutableRunFromUserWriteableDirectory	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Executable Run from User Writeable Windows Directory Extended	Security.Monitoring.ExecutableRuninWriteableDirectoriesExtended	Security.Monitoring.WriteableLocations	Alert	True	True
	Security Monitoring Forwarded Events: Possible Crypto-Ransomware Installed on Computer	Security.Monitoring.ForwardedEvents.4688.GenericCryptoRansomWare	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: PowerShell script run natively to bypass existing execution policy	Security.Monitoring.ForwardedEvents.ByPassExecutionPolicy	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Collect LAPS Events	Security.Monitoring.ForwardedEvents.CollectLAPSEvents	WindowsEventCollectorDiscovery.EventLogCollectorServer	EventCollection	True	False
	Security Monitoring Forwarded Events: SeDebug Privilege Escalation Detected	Security.Monitoring.ForwardedEvents.DebugEscalation	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Executable Run from User Writeable Windows Directory	Security.Monitoring.ForwardedEvents.ExecutableRunFromUserWriteableDirectory	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Secuity Monitoring Forwarded Events: PowerSploit FindAV Signature Tool is in Use	Security.Monitoring.ForwardedEvents.FindAVSignature	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring ForwardedEvents: Powersploit Get DLL Load Path is in Use	Security.Monitoring.ForwardedEvents.GetDLLLoadPath	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: PowerSploit HTTP Path Discovery Tool is in Use	Security.Monitoring.ForwardedEvents.GetHTTPStatus	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: PowerSploit Key Stroke Logger in Use	Security.Monitoring.ForwardedEvents.GetKeystroke	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: PowerSploit Invoke DLL Injection Command in Use	Security.Monitoring.ForwardedEvents.InvokeDLLInjection	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: PowerShell used to Invoke an Encoded Command	Security.Monitoring.ForwardedEvents.InvokeEncodedCommand	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Invoke-Mimikatz Detected in Tier 0 Environment	Security.Monitoring.ForwardedEvents.InvokeMimikatz	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Invoke Ninja Copy is in Use	Security.Monitoring.ForwardedEvents.InvokeNinjaCopy	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Invoke Portscan is in Use	Security.Monitoring.ForwardedEvents.InvokePortScan	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: PowerShell used to Invoke a Remote Expression	Security.Monitoring.ForwardedEvents.InvokeRemoteExpression	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring: Invoke ShellCode is in Use	Security.Monitoring.ForwardedEvents.InvokeShellCodeInUse	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: An attempt was made to kill Windows Defender	Security.Monitoring.ForwardedEvents.KillWindowsDefender	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: PowerShell Running Only in Memory	Security.Monitoring.ForwardedEvents.PowerShellRuninMemoryOnly	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Hidden Process Starting Using PowerShell	Security.Monitoring.ForwardedEvents.PowerShellStartHiddenProcess	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: RegSvr32 used to load a DLL that is not located on this machine	Security.Monitoring.ForwardedEvents.RemoteRegSvr32	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Secuity Monitoring: PowerSploit FindAV Signature Tool is in Use	Security.Monitoring.PowerShellLog.FindAVSignature	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Powersploit Get DLL Load Path is in Use	Security.Monitoring.PowerShellLog.GetDLLLoadPath	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: PowerSploit HTTP Path Discovery Tool is in Use	Security.Monitoring.PowerShellLog.GetHTTPStatus	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: PowerSploit Key Stroke Logger in Use	Security.Monitoring.PowerShellLog.GetKeystroke	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: PowerSploit Invoke DLL Injection Command in Use	Security.Monitoring.PowerShellLog.InvokeDLLInjection	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Invoke-Mimikatz is in Use.	Security.Monitoring.PowerShellLog.InvokeMimikatzInUse	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Invoke Ninja Copy is in Use	Security.Monitoring.PowerShellLog.InvokeNinjaCopy	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Invoke Portscan is in Use	Security.Monitoring.PowerShellLog.InvokePortScan	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Invoke ShellCode in Use	Security.Monitoring.PowerShellLog.InvokeShellCodeInUse	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Hidden Process Starting Using PowerShell	Security.Monitoring.PowerShellLog.PowerShellStartHiddenProcess	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Security Event Log was Cleared.	Security.Monitoring.SecurityLogClearedv2	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Modification has been made to the DC OU	Security.Monitoring.SecurityMonitoring.Event.DCOUModify	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: A GPO was Created	Security.Monitoring.SecurityMonitoring.Event.GPOCreation	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: A GPO was Deleted	Security.Monitoring.SecurityMonitoring.Event.GPODeletionRule	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: A Scheduled Task Was Created On Server	Security.Monitoring.SecurityMonitoring.Event.ScheduledTaskCreatedOnServer	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A service was Created on a Domain Controller	Security.Monitoring.SecurityMonitoring.Event.ServiceCreatedonDC	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	New Alert Rule	Security.Monitoring.SuspiciousUserContext	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: System Event Log was Cleared.	Security.Monitoring.SystemLogClearedv2	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Failed RDP Logon	SecurityMonitoring.Event.FailedLogin	Microsoft.Windows.Server.OperatingSystem	Custom	False	True
	Collect Failed Login Attemts	SecurityMonitoring.Failed.Login.Attempts.Collection	Microsoft.Windows.Computer	EventCollection	True	False
	Security Monitoring: Domain Admins membership has changed	SecurityMonitoringMP.Accounts.DomainAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: Enterprise Admins membership has changed	SecurityMonitoringMP.Accounts.EnterpriseAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: Local Administrators Group was Modified	SecurityMonitoringMP.Accounts.LocalAdminChange	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Schema Admins membership has changed	SecurityMonitoringMP.Accounts.SchemaAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: Mimikatz in use	SecurityMonitoringMP.APPLocker.Mimikatz	Microsoft.Windows.Computer	Alert	False	True
	Security Monitoring: Prohibited App in Use	SecurityMonitoringMP.APPLocker.ProhibitedApp	Microsoft.Windows.Computer	Alert	True	True
	Security Monitoring: PSEXEC in Use	SecurityMonitoringMP.APPLocker.PSExec	Microsoft.Windows.Computer	Alert	False	True
	Security Monitoring: WCE in Use	SecurityMonitoringMP.APPLocker.WCE	Microsoft.Windows.Computer	Alert	False	True
	Security Monitoring: WinRar in use	SecurityMonitoringMP.APPLocker.WinRar	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: A suspicious process creation (AppLocker bypass) was executed	SecurityMonitoringMP.Event.4688.SuspiciousApplockerJava	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A suspicious process creation (AppLocker bypass using regsvr32) was execuited	SecurityMonitoringMP.Event.4688.SuspiciousApplockerRegsvr	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A suspicious process creation (cmd) was executed	SecurityMonitoringMP.Event.4688.SuspiciousCMD	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A suspicious process creation (FTP script execution via echo command) was executed	SecurityMonitoringMP.Event.4688.SuspiciousFTPCommand	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A suspicious process creation (registry) was executed	SecurityMonitoringMP.Event.4688.SuspiciousReg	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring; A suspicious process creation (malicious use of WindowPosition with PowerShell) was executed	SecurityMonitoringMP.Event.4688.SuspiciousWindowsPosition	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Possible Golden Ticket in Use	SecurityMonitoringMP.Event.GoldenTicketDetection	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: Local account created on a member server	SecurityMonitoringMP.Event.LocalAccountCreatedonServer	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Security Log was cleared	SecurityMonitoringMP.Event.SecurityLogCleared	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: A service was created on a member server	SecurityMonitoringMP.Event.ServiceCreatedonMemberServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: Service associated with a known threat was created on a member server	SecurityMonitoringMP.Event.ServiceKnownThreat	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: A Smart Card has been Disabled to Allow for Interactive Logon	SecurityMonitoringMP.Event.SmartCardDisabled	Microsoft.Windows.Server.DC.Computer	Alert	True	True
	Security Monitoring: Software was Installed on a Server	SecurityMonitoringMP.Event.SoftwareInstallOnServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: Software was Removed from a Server	SecurityMonitoringMP.Event.SoftwareRemovedFromServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: The system Log was cleared	SecurityMonitoringMP.Event.SystemLogCleared	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: A system has been powered off	SecurityMonitoringMP.Event.SystemPoweredOff	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: A system was restarted	SecurityMonitoringMP.Event.SystemRestarted	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring: Unexpected System Shutdown	SecurityMonitoringMP.Event.UnexpectedShutdown	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring Collection: Event ID 4672	SecurityMonitoringMP.EventCollection.4672	Microsoft.Windows.Server.OperatingSystem	EventCollection	False	False
	Security Monitoring Collection: Event ID 4624 Logon Type 4	SecurityMonitoringMP.EventCollection.BatchLogon	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring Event Collection: Event ID 4769 result 0x1F	SecurityMonitoringMP.EventCollection.GoldenTicket	Microsoft.Windows.Server.DC.Computer	EventCollection	True	False
	Security Monitoring Collection: Event ID 4694	SecurityMonitoringMP.EventCollection.SpecialGroupLogon	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	False
	Security Monitoring Forwarded Events: A suspicious process creation (AppLocker bypass) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousApplockerJava	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: A suspicious process creation (AppLocker bypass using regsvr32) was execuited	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousApplockerRegsvr	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: A suspicious process creation (cmd) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousCMD	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: A suspicious process creation (FTP script execution via echo command) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousFTPCommand	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: A suspicious process creation (registry) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousReg	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: A suspicious process creation (malicious use of WindowPosition with PowerShell) was executed	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousWindowsPosition	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Potential Credential Swap in Progress	SecurityMonitoringMP.ForwardedEvents.CredentialSwap	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Local User Created or Deleted in Administrator Security Group	SecurityMonitoringMP.ForwardedEvents.LocalUserCreatedDeleted	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Prohibited App in Use	SecurityMonitoringMP.ForwardedEvents.ProhibitedApp	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Possible PtH Attack in Progress Against Tier 2	SecurityMonitoringMP.ForwardedEvents.PtHTier2	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	False	True
	Security Monitoring Forwarded Events: Security log cleared on a server configured to forward events	SecurityMonitoringMP.ForwardedEvents.SecurityLogCleared	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Service Created on system	SecurityMonitoringMP.ForwardedEvents.ServiceCreation	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	False	True
	Security Monitoring Forwarded Events: Service associated with a known threat was created on a forwarding computer	SecurityMonitoringMP.ForwardedEvents.ServiceCreationKnownThreats	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: Special Group logon event	SecurityMonitoringMP.ForwardedEvents.SpecialGroupLogon	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	Security Monitoring Forwarded Events: System Log was Cleared	SecurityMonitoringMP.ForwardedEvents.SystemLogCleared	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	True
	GPO Change Event then run correlation script Rule	SecurityMonitoringMP.GPOMonitoring.EventAndScript.Rule	Microsoft.Windows.Server.DC.Computer	Custom	True	True
	Security Monitoring: Potential Credential Swap in Progress	SecurityMonitoringMP.Pth.CredentialSwap	Microsoft.Windows.Server.OperatingSystem	Alert	True	True
	Security Monitoring: Possible PtH attack in progress (successful) against DC	SecurityMonitoringMP.Pth.PtHAgainstDC	Microsoft.Windows.Server.DC.Computer	Alert	False	True
	Security Monitoring: Possible PtH Attack in Progress against tier 1	SecurityMonitoringMP.Pth.PtHAgainstTier1	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring Threat Hunting: Batch Logon in use	SecurityMonitoringMP.ThreatHunt.BatchLogonInUse	Microsoft.Windows.Server.OperatingSystem	Alert	False	True
	Security Monitoring Threat Hunting: Special Group logon event	SecurityMonitoringMP.ThreatHunt.SpecialGroupLogon	Microsoft.Windows.Server.OperatingSystem	Alert	True	True

Recoveries (2)

	DisplayName	ID	Target	Monitor	Reset Monitor	Category	Enabled	Accessibility
	Modify Windows Firewall	SecurityMonitoringMP.Recovery.BlockPortWindowsFW	Microsoft.Windows.Server.OperatingSystem	SecurityMonitoringMP.Event.RepeatedLogonMonitor	False	Custom	false	Public
	Restart Service	SecurityMonitoringMP.Recovery.RestartWecSVC	WindowsEventCollectorDiscovery.EventLogCollectorServer	SecurityMonitoringMP.Health.EventCollectorMonitor	True	Custom	true	Public

Agent Tasks (2)

	DisplayName	ID	Target	Accessibility	Category	Enabled
	Security Monitoring: Create Registry Key to Discover Writeable Locations	SecurityMonitoring.PowerShell.Task.CreateUserWriteableRegKey	Microsoft.Windows.Computer	Internal	Maintenance	True
	Security Monitoring: Remove Registry Key to Discover Writeable Locations	SecurityMonitoring.PowerShell.Task.RemoveUserWriteableRegKey	Microsoft.Windows.Computer	Internal	Maintenance	True

Monitor Property Overrides (8)

	ID	Context	Target
	OverrideForMonitorSecurityMonitoringAccountLogonAuditingMemberServerForContextMicrosoftSystemCenterManagementServerComputersGroup	Microsoft.SystemCenter.ManagementServerComputersGroup	Security.Monitoring.AuditAccountLogonMS
	OverrideForMonitorSecurityMonitoringCommandLineAuditingMemberServerForContextMicrosoftSystemCenterManagementServerComputersGroup	Microsoft.SystemCenter.ManagementServerComputersGroup	Security.Monitoring.IncludeCommandLineProcessCreationonMS
	OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2012Full	Microsoft.Windows.Server.6.2.Full.OperatingSystem	SecurityMonitoringMP.UseLogonCredentialExistsMonitor
	OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2012OS	Microsoft.Windows.Server.6.2.OperatingSystem	SecurityMonitoringMP.UseLogonCredentialExistsMonitor
	OverrideForMonitorSecurityMonitoringMPUseLogonCredentialExistsMonitor.Server2016	Microsoft.Windows.Server.10.0.OperatingSystem	SecurityMonitoringMP.UseLogonCredentialExistsMonitor
	OverrideForMonitorSecurityMonitoringProcessCreationMemberServerForContextMicrosoftSystemCenterManagementServerComputersGroup	Microsoft.SystemCenter.ManagementServerComputersGroup	Security.Monitoring.ProcessCreationMemberServer
	OverrideForMonitorSecurityMonitoringSpecialGroupLogonMemberServerForContextMicrosoftSystemCenterManagementServerComputersGroup	Microsoft.SystemCenter.ManagementServerComputersGroup	Security.Monitoring.SpecialGroupLogonEnabledOnMemberServers
	OverrideForMonitorSecurityMonitoringUserAccountManagementAuditingMemberServerForContextMicrosoftSystemCenterManagementServerComputersGroup	Microsoft.SystemCenter.ManagementServerComputersGroup	Security.Monitoring.UserAccountMgmtMS

Rule Property Overrides (4)

	ID	Context	Target
	OverrideForRuleSecurityMonitoringEventSeDebugPrivilegeEscalation	Microsoft.SystemCenter.ManagementServer	Security.Monitoring.Event.SeDebugPrivilegeEscalation
	OverrideForRuleSecurityMonitoringExecutableRunFromUserWriteableDirectory	Security.Monitoring.WindowsComputersExtendedWriteableDirectoryMonitoring	Security.Monitoring.ExecutableRunFromUserWriteableDirectory
	OverrideForRuleSecurityMonitoringMPEventLocalAccountCreatedonServer.DomainControllers	Microsoft.Windows.Server.DC.Computer	SecurityMonitoringMP.Event.LocalAccountCreatedonServer
	OverrideForRuleSecurityMonitoringMPEventLocalAdminChange.DomainControllers	Microsoft.Windows.Server.DC.Computer	SecurityMonitoringMP.Accounts.LocalAdminChange

Folder Items (8)

	ID	FolderName	ElementID
	i08b0d1b442c04c8daf4574e19f39c3c9	SecurityMonitoringMP.Folder.SecurityMonitoring	SecurityMonitoringMP.View.SecurityMonitoringAlerts
	i23e6b51216814447b3b73c5124fae3d3	SecurityMonitoringMP.Folder.Administration	SecurityMonitoringMP.View.DCDistributedApp
	i2465151f071a4563af2090f8f6f734ce	SecurityMonitoringMP.Folder.Administration	SecurityMonitoringMP.View.MemberServerDistributedApp
	i3691038e88044516a67ac5bbc79422c0	SecurityMonitoringMP.Folder.EventCollectors	SecurityMonitoringMP.View.EventCollectorState
	i74a5ba1881174da89a4041962320a070	SecurityMonitoringMP.Folder.SecurityMonitoring	SecurityMonitoringMP.View.ThreatHuntingAlert
	ibbd540dc68af4043bfdb9f75cf03ae00	SecurityMonitoringMP.Folder.SecurityMonitoring	SecurityMonitoringMP.View.OnlineDocumentation
	if3e38fad5d3547168a4bca954c52cecb	SecurityMonitoringMP.Folder.EventCollectors	SecurityMonitoringMP.View.EventCollectorAlerts
	if879997c69ee482abc74aca8ebbe4367	SecurityMonitoringMP.Folder.Administration	SecurityMonitoringMP.View.DADocumentation

Folders (3)

	DisplayName	ID	ParentFolder	Accessibility
	Administration	SecurityMonitoringMP.Folder.Administration	SecurityMonitoringMP.Folder.SecurityMonitoring	Public
	Event Collectors	SecurityMonitoringMP.Folder.EventCollectors	SecurityMonitoringMP.Folder.SecurityMonitoring	Public
	Security Monitoring	SecurityMonitoringMP.Folder.SecurityMonitoring	Microsoft.SystemCenter.Monitoring.ViewFolder.Root	Public

Views (8)

	DisplayName	ID	Target	Type	Accessibility	Visible
	Distributed Application Documentation	SecurityMonitoringMP.View.DADocumentation	System.Entity	Microsoft.SystemCenter.UrlViewType	Public	True
	Domain Controller Audit Settings	SecurityMonitoringMP.View.DCDistributedApp	Security.Monitoring.SecurityMonitoringDA.DomainControllers	Microsoft.SystemCenter.StateViewType	Public	True
	Event Collector Alerts	SecurityMonitoringMP.View.EventCollectorAlerts	WindowsEventCollectorDiscovery.EventLogCollectorServer	Microsoft.SystemCenter.AlertViewType	Public	True
	Event Collector State	SecurityMonitoringMP.View.EventCollectorState	WindowsEventCollectorDiscovery.EventLogCollectorServer	Microsoft.SystemCenter.StateViewType	Public	True
	Member Server Audit Settings	SecurityMonitoringMP.View.MemberServerDistributedApp	Security.Monitoring.SecurityMonitoringDA.MemberServers	Microsoft.SystemCenter.StateViewType	Public	True
	Online Documentation	SecurityMonitoringMP.View.OnlineDocumentation	System.Entity	Microsoft.SystemCenter.UrlViewType	Public	True
	Security Monitoring MP Alerts	SecurityMonitoringMP.View.SecurityMonitoringAlerts	System.Entity	Microsoft.SystemCenter.AlertViewType	Public	True
	Threat Hunting	SecurityMonitoringMP.View.ThreatHuntingAlert	System.Entity	Microsoft.SystemCenter.AlertViewType	Public	True

Report Resources (11)

	ID	File Name	Accessibility
	AlertSummary.ID	Alert Summary_v1.rdl	Internal
	BatchLogonReport.ID	Batch Logon Report_v1.2.rdl	Internal
	EventCollectionSummary.ID	Event Collection Report_v1.rdl	Internal
	FailedLoginDetails.ID	Failed Login Details_v1.rdl	Internal
	FailedLoginSummary.ID	Failed Login Summary_v1.rdl	Internal
	FailedLoginSummary24.ID	Failed Login Summary (24 hours)_v1.rdl	Internal
	LanManConnectionReport.ID	LanMan.rdl	Internal
	LegacyTLSConnectionReport.ID	LegacyTLS.rdl	Internal
	NTLMv1ConnectionReport.ID	NTLMV1.rdl	Internal
	SMBv1ConnectionReport.ID	SMBv1 Connections Report_v1.rdl	Internal
	WDigestConnectionReport.ID	Wdigest.rdl	Internal

Reports (11)

	DisplayName	ID	Accessibility	Visible
	Alert Summary	Security.Monitoring.AlertSummary	Public	True
	Batch Logon Report	Security.Monitoring.BatchLogonReport	Public	True
	Event Colleciton Summary	Security.Monitoring.EventCollectionSummary	Public	True
	Failed Login Details	Security.Monitoring.FailedLoginDetails	Public	True
	Failed Login Summary	Security.Monitoring.FailedLoginSummary	Public	True
	Failed Login Summary (24 Hours)	Security.Monitoring.FailedLoginSummary24Hours	Public	True
	LanMan Connection Report	Security.Monitoring.LanManConnectionReport	Public	True
	Legacy TLS Protocols Connection Report	Security.Monitoring.LegacyTLSConnectionReport	Public	True
	NTLM Version 1 Connection Report	Security.Monitoring.NTLMv1ConnectionReport	Public	True
	SMBv1 Connections Report	Security.Monitoring.SMBv1ConnectionReport	Public	True
	WDigest Connection Report	Security.Monitoring.WDigestConnectionReport	Public	True