Cyber Security: Windows Source
Source Description
This source combines event logs from Windows workstations and servers. Its rules detect suspicious process execution and behavior, registry and service changes, malicious PowerShell scripts, host network activity, account activity, known malicious behavior patterns, and vulnerability exploitation.
The source covers workstations and servers, including Windows DNS servers. Its rules analyze Security, Sysmon, PowerShell, system, and Windows Defender log events. They correlate process starts with command lines and parent processes, and account for network activity and changes to the registry, services, and host configuration.
Collection Requirements
- Windows audit policy with command lines in event 4688; see Configuring Infrastructure Sources
- PowerShell logging (events 4103 and 4104)
- Sysmon configured according to the module requirements; see Configuring Infrastructure Sources
Security,Sysmon,PowerShell,Windows Events, andDNS Servercollection configurations; see Connecting and Configuring Data Collection
MITRE ATT&CK Coverage
The source rules cover the following tactics.
- reconnaissance
- initial access
- execution
- persistence
- privilege escalation
- stealth
- defense impairment
- credential access
- discovery
- lateral movement
- collection
- command and control
- exfiltration
- impact
Lookups
The source rules enrich incidents with context from infrastructure and account lookups, while exclusion lookups filter out legitimate activity. See Lookups for population requirements.
The "Cyber Security Expertise Description" document included with the module lists the source rules, their MITRE ATT&CK tactics and techniques, identifiers, and lookups.