add wse to security_event

2021-05-27 12:49:22 +03:00 · 2021-05-27 12:49:22 +03:00 · 9c0fc8fd7d
--- a/Detections/SecurityEvent/ADFSKeyExportSysmon.yaml
+++ b/Detections/SecurityEvent/ADFSKeyExportSysmon.yaml
@ -10,6 +10,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 7d
 triggerOperator: gt
--- a/Detections/SecurityEvent/ExcessiveLogonFailures.yaml
+++ b/Detections/SecurityEvent/ExcessiveLogonFailures.yaml
@ -7,6 +7,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 8d
 triggerOperator: gt
--- a/Detections/SecurityEvent/ExchangeOABVirtualDirectoryAttributeContainingPotentialWebshell.yaml
+++ b/Detections/SecurityEvent/ExchangeOABVirtualDirectoryAttributeContainingPotentialWebshell.yaml
@ -9,6 +9,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvents
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1h
 queryPeriod: 1h
 triggerOperator: gt
--- a/Detections/SecurityEvent/GainCodeExecutionADFSViaSMB.yaml
+++ b/Detections/SecurityEvent/GainCodeExecutionADFSViaSMB.yaml
@ -7,6 +7,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 7d
 triggerOperator: gt
--- a/Detections/SecurityEvent/GroupCreatedAddedToPrivlegeGroup_1h.yaml
+++ b/Detections/SecurityEvent/GroupCreatedAddedToPrivlegeGroup_1h.yaml
@ -9,6 +9,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1h
 queryPeriod: 1h
 triggerOperator: gt
--- a/Detections/SecurityEvent/HAFNIUMNewUMServiceChildProcess.yaml
+++ b/Detections/SecurityEvent/HAFNIUMNewUMServiceChildProcess.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 14d
 triggerOperator: gt
--- a/Detections/SecurityEvent/MultipleFailedFollowedBySuccess.yaml
+++ b/Detections/SecurityEvent/MultipleFailedFollowedBySuccess.yaml
@ -11,6 +11,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 6h
 queryPeriod: 6h
 triggerOperator: gt
--- a/Detections/SecurityEvent/NOBELIUM_SuspiciousRundll32Exec.yaml
+++ b/Detections/SecurityEvent/NOBELIUM_SuspiciousRundll32Exec.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/NOBELIUM_SuspiciousScriptRegistryWrite.yaml
+++ b/Detections/SecurityEvent/NOBELIUM_SuspiciousScriptRegistryWrite.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/PotentialBuildProcessCompromise.yaml
+++ b/Detections/SecurityEvent/PotentialBuildProcessCompromise.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/PotentialKerberoast.yaml
+++ b/Detections/SecurityEvent/PotentialKerberoast.yaml
@ -12,6 +12,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1h
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/RDP_MultipleConnectionsFromSingleSystem.yaml
+++ b/Detections/SecurityEvent/RDP_MultipleConnectionsFromSingleSystem.yaml
@ -9,6 +9,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 8d
 triggerOperator: gt
--- a/Detections/SecurityEvent/RDP_Nesting.yaml
+++ b/Detections/SecurityEvent/RDP_Nesting.yaml
@ -9,6 +9,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 8d
 triggerOperator: gt
--- a/Detections/SecurityEvent/RDP_RareConnection.yaml
+++ b/Detections/SecurityEvent/RDP_RareConnection.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 14d
 triggerOperator: gt
--- a/Detections/SecurityEvent/SecurityEventLogCleared.yaml
+++ b/Detections/SecurityEvent/SecurityEventLogCleared.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/StartStopHealthService.yaml
+++ b/Detections/SecurityEvent/StartStopHealthService.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/TimeSeriesAnomaly-ProcessExecutions.yaml
+++ b/Detections/SecurityEvent/TimeSeriesAnomaly-ProcessExecutions.yaml
@ -10,6 +10,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1h
 queryPeriod: 14d
 triggerOperator: gt
--- a/Detections/SecurityEvent/UserAccountAdd-Removed.yaml
+++ b/Detections/SecurityEvent/UserAccountAdd-Removed.yaml
@ -7,6 +7,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/UserAccountAddedToPrivlegeGroup_1h.yaml
+++ b/Detections/SecurityEvent/UserAccountAddedToPrivlegeGroup_1h.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/UserAccountCreatedDeleted_10m.yaml
+++ b/Detections/SecurityEvent/UserAccountCreatedDeleted_10m.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 2d
 triggerOperator: gt
--- a/Detections/SecurityEvent/UserAccountEnabledDisabled_10m.yaml
+++ b/Detections/SecurityEvent/UserAccountEnabledDisabled_10m.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 2d
 triggerOperator: gt
--- a/Detections/SecurityEvent/UserCreatedAddedToBuiltinAdmins_1d.yaml
+++ b/Detections/SecurityEvent/UserCreatedAddedToBuiltinAdmins_1d.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
     - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/base64_encoded_pefile.yaml
+++ b/Detections/SecurityEvent/base64_encoded_pefile.yaml
@ -7,6 +7,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/execute_base64_decodedpayload.yaml
+++ b/Detections/SecurityEvent/execute_base64_decodedpayload.yaml
@ -10,6 +10,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/gte_6_FailedLogons_10m.yaml
+++ b/Detections/SecurityEvent/gte_6_FailedLogons_10m.yaml
@ -7,6 +7,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 10m
 queryPeriod: 10m
 triggerOperator: gt
--- a/Detections/SecurityEvent/malware_in_recyclebin.yaml
+++ b/Detections/SecurityEvent/malware_in_recyclebin.yaml
@ -8,6 +8,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/password_never_expires.yaml
+++ b/Detections/SecurityEvent/password_never_expires.yaml
@ -9,6 +9,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt
--- a/Detections/SecurityEvent/password_not_set.yaml
+++ b/Detections/SecurityEvent/password_not_set.yaml
@ -11,6 +11,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 3d
 triggerOperator: gt
--- a/Detections/SecurityEvent/powershell_empire.yaml
+++ b/Detections/SecurityEvent/powershell_empire.yaml
@ -7,6 +7,9 @@ requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
+  - connectorId: WindowsSecurityEvents
+    dataTypes:
+      - SecurityEvent
 queryFrequency: 1d
 queryPeriod: 1d
 triggerOperator: gt