local_rules.xml

<group name="sysmon,sysmon_process-anomalies,">
    <rule id="255000" level="12" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.image">\\powershell.exe||\\.ps1||\\.ps2</field>
        <description>Alert - Event 1: Process Creation CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon: $(win.eventdata.image)</description>
    </rule>

    <rule id="255001" level="0" overwrite="yes">
        <field name="win.eventdata.Image">\\rundll32.exe</field>
        <description>Alert - rundll32.exe CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255002" level="12" overwrite="yes">
        <if_sid>255001</if_sid>
        <field name="win.eventdata.ImageLoaded">\\vaultcli.dll</field>
        <description>Vault Fuckery Detected on vaultcli.dll Possible Mimikatz Running In-Memory Detection</description>
    </rule>

    <rule id="255003" level="12" overwrite="yes">
        <if_sid>255001</if_sid>
        <field name="win.eventdata.ImageLoaded">\\wlanapi.dll</field>
        <description>wlanAPI Access Possible Mimikatz In-Memory Detection</description>
    </rule>

    <rule id="255004" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.parentImage">\\mshta.exe</field>
        <description>Alert - mshta.exe CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255005" level="12" overwrite="yes">
        <if_sid>255004</if_sid>
        <field name="win.eventdata.Image">\\cmd.exe||\\powershell.exe||\\wscript.exe||\\cscript.exe||\\sh.exe||\\bash.exe||\\reg.exe||\\regsvr32.exe||\\BITSADMIN*</field>
        <description>Detection a Windows command line executable started from MSHTA CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255006" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.ParentImage">\\WINWORD.EXE||\\EXCEL.EXE||\\POWERPNT.exe||\\MSPUB.exe||\\VISIO.exe</field>
        <description>Alert - MS Word - Ms EXCEL run CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255007" level="12" overwrite="yes">
        <if_sid>255006</if_sid>
        <field name="win.eventdata.Image">\\cmd.exe</field>
        <description>cmdline or shell Started CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon: $(win.eventdata.image)</description>
    </rule>

    <rule id="255008" level="12" overwrite="yes">
        <if_sid>255006</if_sid>
        <field name="win.eventdata.Image">\\cmd.exe||\\powershell.exe||\\wscript.exe||\\cscript.exe||\\sh.exe||\\bash.exe||\\scrcons.exe||\\schtasks.exe||\\regsvr32.exe||\\hh.exe</field>
        <description>Potential Spawning of Windows Shell</description>
    </rule>

<rule id="255010" level="12" overwrite="yes">
        <if_sid>255009</if_sid>
        <field name="win.eventdata.startModule">null</field>
        <description>Password Dump Remote Thread in LSASS</description>
    </rule>

    <rule id="255011" level="12" overwrite="yes">
        <if_sid>255000</if_sid>
        <field name="win.eventdata.commandline">DownloadString||downloadfile</field>
        <description>PowerShell scripts that download content from the Internet</description>
    </rule>

    <rule id="255016" level="12" overwrite="yes">
        <if_sid>255000</if_sid>
        <field name="win.eventdata.commandline">EncodedCommand||-w hidden||-window hidden||-windowstyle hidden||-enc||-noni||noninteractive || iwr</field>
        <description>Suspicious PowerShell invocation command parameters</description>
    </rule>

    <rule id="255017" level="0" overwrite="yes">
        <if_group>sysmon_event3</if_group>
        <field name="win.eventdata.image">rundll32.exe</field>
        <description>Rundll32 Internet Connection</description>
    </rule>

    <rule id="255018" level="12" overwrite="yes">
        <if_sid>255017</if_sid>
        <match>!192.</match>
        <description>Rundll32 communicating with public IP addresses</description>
    </rule>

    <rule id="255020" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.image">certutil.exe</field>
        <description>certutil execution with sub commands</description>
    </rule>

    <rule id="255021" level="12" overwrite="yes">
        <if_sid>255020</if_sid>
        <field name="win.eventdata.commandline">URL||decode||decodehex||urlcache||ping</field>
        <description>certutil execution with sub commands</description>
    </rule>

    <rule id="255023" level="12" overwrite="yes">
        <if_sid>255000</if_sid>
        <field name="win.eventdata.currentDirectory">AppData</field>
        <description>suspicious command line execution that includes an URL and AppData</description>
    </rule>

    <rule id="255024" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.parentImage">\\System32\\control.exe</field>
        <description>Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255025" level="12" overwrite="yes">
        <if_sid>255024</if_sid>
        <field name="win.eventdata.commandline">\\rundll32.exe</field>
        <description>Suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255026" level="12" overwrite="yes">
        <if_group>sysmon_event6</if_group>
        <field name="win.eventdata.imageLoaded">\\Temp</field>
        <description>driver loaded from a temp dir NtMapViewOfSection,LoadLibrary,PsCreateProcessNotifyRoutine</description>
    </rule>

    <rule id="255027" level="12" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.image">C:\\PerfLogs\\||C:\$Recycle.bin\\||C:\\Intel\\Logs\\||C:\\Users\\Default\\||C:\\Users\\Public\\||C:\\Users\\NetworkService\\||C:\\Windows\\Fonts\\C:\\Windows\\Debug\\||C:\\Windows\\Media\\||C:\\Windows\\Help\\||C:\\Windows\\addins\\||C:\\Windows\\repair\\||C:\\Windows\\security\\||\\RSA\\MachineKeys\\||C:\\Windows\\system32\\config\\systemprofile</field>
        <description>Process Creation by binaries from a suspicious folder CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255028" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.parentImage">\\mmc.exe</field>
        <description>Processes started by MMC.exe could by a sign of lateral movement using MMC application COM object CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255029" level="12" overwrite="yes">
        <if_sid>255028</if_sid>
        <field name="win.eventdata.image">\\cmd.exe</field>
        <description>Processes started by MMC could by a sign of lateral movement using MMC application COM object CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <!-- https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/-->
    <rule id="255030" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.parentImage">\\net.exe||\\net1.exe</field>
        <description>Detects execution of Net.exe, whether suspicious or benign CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255031" level="12" overwrite="yes">
        <if_sid>255030</if_sid>
        <field name="win.eventdata.commandline">group||localgroup||user||view||share||accounts||use</field>
        <description>Detects execution of Net.exe, whether suspicious or benign CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255032" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.parentImage">\\wscript.exe||\\cscript.exe</field>
        <description>Alert - wscript/cscript.exe process creation CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255033" level="12" overwrite="yes">
        <if_sid>255032</if_sid>
        <field name="win.eventdata.Image">\\powershell.exe</field>
        <description>Detects suspicious powershell invocations from interpreters or unusual programs CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255034" level="12" overwrite="yes">
        <if_sid>255030</if_sid>
        <field name="win.eventdata.commandline">net group "domain admins" /domain||net localgroup administrators||net1 group "domain admins" /domain||net1 localgroup administrators</field>
        <description>Suspicious command line activity on Windows systems group Enum</description>
    </rule>

    <rule id="255035" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.image">\\regsvr32.exe</field>
        <description>Detects various anomalies in relation to regsvr32.exe CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255036" level="12" overwrite="yes">
        <if_sid>255035</if_sid>
        <field name="win.eventdata.commandline">\\Temp</field>
        <description>Detects various anomalies in relation to regsvr32.exe</description>
    </rule>

    <rule id="255037" level="12" overwrite="yes">
        <if_sid>255035</if_sid>
        <field name="win.eventdata.parentImage">powershell.exe</field>
        <description>anomaly in relation to regsvr32.exe</description>
    </rule>

    <rule id="255038" level="12" overwrite="yes">
        <if_sid>255035</if_sid>
        <field name="win.eventdata.commandline">scrobj.dll</field>
        <description>anomalies in relation to regsvr32.exe</description>
    </rule>

    <rule id="255039" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.image">\\schtasks.exe</field>
        <description>Detects the creation of scheduled tasks in user session CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255040" level="12" overwrite="yes">
        <if_sid>255039</if_sid>
        <field name="win.eventdata.commandline">/create</field>
        <description>Creation of scheduled tasks in user session CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255041" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.image">\\wscript.exe||\\cscript.exe</field>
        <description>anomaly in relation to wscript cscript CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255042" level="12" overwrite="yes"> 
        <if_sid>255041</if_sid>
        <field name="win.eventdata.commandline">jse||vbe||js||vba</field>
        <description>Detects suspicious file execution by wscript and cscript CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255043" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.parentImage">\\svchost.exe</field>
        <description>Suspicious Svchost Process CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255044" level="12" overwrite="yes">
        <if_sid>255041</if_sid>
        <field name="win.eventdata.image">\\services.exe</field>
        <description>Suspicious scvhost process start</description>
    </rule>

    <rule id="255045" level="12" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.commandline">vssadmin.exe Delete Shadows||vssadmin create shadow||GLOBALROOT||vssadmin delete shadows||reg SAVE HKLM\\SYSTEM||\\windows\\ntds\\ntds.dit</field>
        <description>use of volume shadow copy ntds ntds.dit</description>
    </rule>

    <rule id="255046" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.image">\\wmic.exe</field>
        <description>WMI executing suspicious commands CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255047" level="12" overwrite="yes">
        <if_sid>255046</if_sid>
        <field name="win.eventdata.commandline">process call create||AntiVirusProduct get||FirewallProduct get||shadowcopy delete</field>
        <description>WMI executing suspicious commands CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255049" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.ParentImage">\\WINWORD.EXE</field>
        <description>Alert - MS Word Fuckery CreateProcess,CreateProcessAsUser,CreateProcessWithToken,Create ProcessWthLogon</description>
    </rule>

    <rule id="255050" level="12" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.image">\\csc.exe</field>
        <description>Detects Winword starting uncommon sub process csc.exe as used in exploits</description>
    </rule>

    <rule id="255051" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.ParentImage">\\apache||\\tomcat||\\w3wp.exe||\\php-cgi.exe||\\nginx.exe||\\httpd.exe</field>
        <description>Alert - Webshell detection</description>
    </rule>

    <rule id="255052" level="0" overwrite="yes">
        <if_sid>255051</if_sid>
        <field name="win.eventdata.commandline">whoami||net user||ping -n||systeminfo</field>
        <description>Situational Awareness Attempt</description>
    </rule>

    <rule id="255053" level="0" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.image">bitsadmin.exe</field>
        <description>Alert Bitsadmin.exe detection</description>
    </rule>

    <rule id="255054" level="12" overwrite="yes">
        <if_sid>255053</if_sid>
        <field name="win.eventdata.commandline">/transfer</field>
        <description>Detects usage of bitsadmin downloading a file</description>
    </rule>

    <rule id="254056" level="12" overwrite="yes">
        <if_sid>255000</if_sid>
        <field name="win.eventdata.commandline">AppData</field>
        <description>suspicious command line execution that includes an URL and AppData</description>
    </rule>

    <rule id="255057" level="12" overwrite="yes">
        <if_sid>255028</if_sid>
        <field name="win.eventdata.image">\\powershell.exe</field>
        <description>Processes started by MMC, lateral movement using MMC application COM object</description>
    </rule>

    <rule id="255058" level="12" overwrite="yes">
        <if_sid>255032</if_sid>
        <field name="win.eventdata.Image">\\cmd.exe</field>
        <description>suspicious powershell invocations from interpreters or unusual programs</description>
</rule>

    <rule id="255059" level="0" overwrite="yes">
        <if_sid>184666</if_sid>
        <match>MsMpEng.exe</match>
        <description>Exclude</description>
    </rule>

    <rule id="254060" level="0" overwrite="yes">
        <if_sid>254056</if_sid>
        <match>WindowsVersionTempFile.txt</match>
        <description>Exclude</description>
    </rule>

    <rule id="255061" level="0" overwrite="yes">
        <if_sid>255025</if_sid>
        <match>timedate.cpl</match>
        <description>Exclude</description>
    </rule>
    <rule id="255062" level="0" overwrite="yes">
        <if_sid>255033</if_sid>
        <match>getfilecounts.vbs</match>
        <description>Exclude</description>
    </rule>
   <rule id="255063" level="0" overwrite="yes">
        <if_sid>255050</if_sid>
        <match>xj6r_ru4.cmdline</match>
        <description>Exclude</description>
    </rule>

    <rule id="255072" level="12" overwrite="yes">
        <if_group>sysmon_event1</if_group>
        <field name="win.eventdata.Image">\\mshta.exe</field>
        <description>Alert - mshta.exe</description>
    </rule>
<rule id="100201" level="12" overwrite="yes">
    <if_sid>61600</if_sid>
    <description>Process injection activity detected: "$(win.eventdata.Image)" has been tampered with</description>
    <mitre>
      <id>T1055.012</id>
    </mitre>
  </rule>

  <rule id="100200" level="12" overwrite="yes">
    <if_sid>61610</if_sid>
    <description>Possible process injection activity detected from "$(win.eventdata.sourceImage)" on "$(win.eventdata.targetImage)"</description>
    <mitre>
      <id>T1055.001</id>
    </mitre>
  </rule>
 
  <rule id="100100" level="0" overwrite="yes">
    <if_sid>100200</if_sid>
    <field name="win.eventdata.sourceImage" type="pcre2">(C:\\\\Windows\\\\system32)|chrome.exe</field>
    <description>Ignore Windows binaries and Chrome</description>
  </rule>
  
<rule id="102134" level="3" overwrite="yes">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1047,technique_name=Windows Management Instrumentation$</field>
<description>WMI Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1047</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>

<rule id="102127" level="3" overwrite="yes">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1003,technique_name=Credential Dumping$</field>
<description>Credential Dumping: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1003</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>

<rule id="109101" level="3" overwrite="yes">
<if_sid>61612</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1003,technique_name=Credential Dumping$</field>
<description>Credential Dumping: ProcessAccess by $(win.eventdata.sourceimage)</description>
<mitre>
<id>T1003</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_10,</group>
</rule>

<rule id="109102" level="3" overwrite="yes">
<if_sid>61612</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1055.001,technique_name=Dynamic-link Library Injection$</field>
<description>Dll Injection: ProcessAccess by $(win.eventdata.sourceimage)</description>
<mitre>
<id>T1055</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_10,</group>
</rule>
<rule id="109103" level="3" overwrite="yes">
<if_sid>61612</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1036,technique_name=Masquerading$</field>
<description>Sysmon - Event 10: ProcessAccess by $(win.eventdata.sourceimage)</description>
<mitre>
<id>T1036</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_10,</group>
</rule>

<rule id="109104" level="3" overwrite="yes">
<if_sid>61612</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell$</field>
<description>Sysmon - Event 10: ProcessAccess by $(win.eventdata.sourceimage)</description>
<mitre>
<id>T1059</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_10,</group>
</rule>

<rule id="109105" level="3" overwrite="yes">
<if_sid>61612</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1055,technique_name=Process Injection$</field>
<description>Process Injection by $(win.eventdata.sourceimage)</description>
<mitre>
<id>T1055</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_10,</group>
</rule>
<rule id="102139" level="3" overwrite="yes">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1021.006,technique_name=Windows Remote Management$</field>
<description>Winrm  Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1021</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>


<rule id="109106" level="3" overwrite="yes">
<if_sid>61612</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Modify Registry$</field>
<description>Registry modified by $(win.eventdata.sourceimage)</description>
<mitre>
<id>T1112</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_10,</group>
</rule>

<rule id="109107" level="3" overwrite="yes">
<if_sid>61612</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1003.004,technique_name=LSASS Memory$</field>
<description>Something has touched lsass by $(win.eventdata.sourceimage)</description>
<mitre>
<id>T1003</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_10,</group>
</rule>
   
<rule id="109108" level="3" overwrite="yes">
<if_sid>61612</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1053,technique_name=Scheduled Task$</field>
<description>Persistence Scheduled Tasks by $(win.eventdata.sourceimage)</description>
<mitre>
<id>T1053</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_10,</group>
</rule>

<rule id="109109" level="3" overwrite="yes">
<if_sid>61612</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218.010,technique_name=Regsvr32$</field>
<description>Regsrv32 Access by $(win.eventdata.sourceimage)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_10,</group>
</rule>

<rule id="109110" level="3" overwrite="yes">
<if_sid>61612</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1073,technique_name=DLL Side-Loading$</field>
<description>Potential dll Sideloading Detected ProcessAccess by $(win.eventdata.sourceimage)</description>
<mitre>
<id>T1073</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_10,</group>
</rule>

<rule id="109112" level="3" overwrite="yes">
<if_sid>61612</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1137,technique_name=Office Application Startup$</field>
<description>Office App Loaded by $(win.eventdata.sourceimage)</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_10,</group>
</rule>
   <!-- louds/--
<rule id="112104" level="3" overwrite="yes">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1037,technique_name=Boot or Logon Initialization Scripts$</field>
<description>Persistence startup or logon script: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1037</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>

<rule id="112107" level="3" overwrite="yes">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1548.002,technique_name=Bypass User Access Control$</field>
<description>Potential UAC Bypass RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1548</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>

<rule id="112108" level="3" overwrite="yes">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1546.015,technique_name=Component Object Model Hijacking$</field>
<description>Potential COM Hijack: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1546</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>

<rule id="112109" level="3" overwrite="yes">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1003.002,technique_name=Security Account Manager$</field>
<description>Messing with SAM in reg: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1003</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>

<rule id="112122" level="3" overwrite="yes">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1543,technique_name=Service Creation$</field>
<description>Service Creation: RegistryEvent by $(win.eventdata.image)</description>
<mitre>
<id>T1543</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>


<rule id="112124" level="3" overwrite="yes">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1569.002,technique_name=Service Execution$</field>
<description>Service execution: RegistryEvent by $(win.eventdata.image)</description>
<mitre>
<id>T1569</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>

<rule id="112127" level="3" overwrite="yes">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1057,technique_name=Process Discovery$</field>
<description>Process Disco: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1057</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
   <!-- loud/-->
<rule id="112136" level="3" overwrite="yes">
<if_sid>61615</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1003,technique_name=Credential Dumping$</field>
<description>Credential Dumping via Registry: RegistryEvent (Value Set) by $(win.eventdata.image)</description>
<mitre>
<id>T1003</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>

<rule id="112141" level="13" overwrite="yes">
<if_sid>61615</if_sid>
<field name="win.eventdata.TargetObject">\\\\PsExec\\\\EulaAccepted$</field>
<description>PsExec EulaAccepted Detected</description>
<mitre>
<id>T1047</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_13,</group>
</rule>
   <!-- loud/--
<rule id="113122" level="3" overwrite="yes">
  <if_sid>61616</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1543,technique_name=Service Creation$</field>
  <description>Service creation: Registry (Key and Value Rename) by $(win.eventdata.image)</description>
  <mitre>
  <id>T1543</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_14,</group>
  </rule>

<rule id="113124" level="3" overwrite="yes">
  <if_sid>61616</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1569.002,technique_name=Service Execution$</field>
  <description>Service Execution: Registry (Key and Value Rename) by $(win.eventdata.image)</description>
  <mitre>
  <id>T1569</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_14,</group>
  </rule>

<rule id="113126" level="3" overwrite="yes">
  <if_sid>61616</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1033,technique_name=System Owner/User Discovery$</field>
  <description>User Disco via RegistryEvent (Key and Value Rename) by $(win.eventdata.image)</description>
  <mitre>
  <id>T1033</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_14,</group>
  </rule>

<rule id="113127" level="3" overwrite="yes">
  <if_sid>61616</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1057,technique_name=Process Discovery$</field>
  <description>Process disco: Registry (Key and Value Rename) by $(win.eventdata.image)</description>
  <mitre>
  <id>T1057</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_14,</group>
  </rule>

<rule id="114101" level="3" overwrite="yes">
  <if_sid>61617</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1089,technique_name=Drive-by Compromise$</field>
  <description>FileCreateStreamHash by $(win.eventdata.image)</description>
  <mitre>
  <id>T1089</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_15,</group>
  </rule>
   <!-- https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/-->
  <rule id="114102" level="3" overwrite="yes">
  <if_sid>61617</if_sid>
  <field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell$</field>
  <description>FileCreateStreamHash by $(win.eventdata.image)</description>
  <mitre>
  <id>T1059</id>
  </mitre>
  <options>no_full_log</options>
  <group>sysmon_event_15,</group>
  </rule>

<rule id="116101" level="3" overwrite="yes">
<if_sid>61646</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1021.002,technique_name=SMB/Windows Admin Shares$</field>
<description> Pipe Created to admin shares by $(win.eventdata.image)</description>
<mitre>
<id>T1021</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_17,</group>
</rule>

<rule id="116102" level="3" overwrite="yes">
<if_sid>61646</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1055; Possible Cobalt Strike post-exploitation jobs.$</field>
<description>Cobalt strike IOC PipeEvent (Pipe Created) by $(win.eventdata.image)</description>
<mitre>
<id>T1055</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_17,</group>
</rule>

<rule id="116104" level="3" overwrite="yes">
<if_sid>61646</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell$</field>
<description>Powershell PipeEvent (Pipe Created) by $(win.eventdata.image)</description>
<mitre>
<id>T1059</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_17,</group>
</rule>

<rule id="116106" level="3" overwrite="yes">
<if_sid>61646</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1033,technique_name=System Owner/User Discovery$</field>
<description>User Disco via PipeEvent (Pipe Created) by $(win.eventdata.image)</description>
<mitre>
<id>T1033</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event_17,</group>
</rule>

<rule id="106118" level="10" overwrite="yes">
<if_sid>61609</if_sid>
<field name="win.eventdata.signed">^false$</field>
<description>Unsigned Image loaded NtMapViewofSection,ImageLoad,LoadLibrary by $(win.eventdata.image)</description>
<group>sysmon_event7,sysmon_anomaly</group>
<mitre>
<id>T1547</id>
</mitre>
<options>no_full_log</options>
</rule>

<rule id="106116" level="3" overwrite="yes">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218.010,technique_name=Regsvr32$</field>
<description>Image loaded NtMapViewofSection,ImageLoad,LoadLibrary Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>


<rule id="106119" level="3" overwrite="yes">
<if_sid>106118</if_sid>
<field name="win.eventdata.company">^Microsoft Corporation$</field>
<description>Unsigned Image Exception for Microsoft DLLs: Image loaded NtMapViewofSection,ImageLoad,LoadLibrary by $(win.eventdata.image)</description>
<group>sysmon_event7</group>
<mitre>
<id>T1059</id>
</mitre>
<options>no_full_log</options>
</rule>

<rule id="106117" level="3" overwrite="yes">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1073,technique_name=DLL Side-Loading$</field>
<description>DLL SideLoading potential NtMapViewofSection,ImageLoad,LoadLibrary usage: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1073</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<rule id="106115" level="3" overwrite="yes">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1053,technique_name=Scheduled Task$</field>
<description>Scheduled Task Image loaded NtMapViewofSection,ImageLoad,LoadLibrary Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1053</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>

<rule id="106104" level="3" overwrite="yes">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1055,technique_name=Process Injection$</field>
<description>Process Injection NtMapViewofSection,ImageLoad,LoadLibrary: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1055</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<rule id="100013" level="5" overwrite="yes">
  <if_sid>18107,18119</if_sid>
 <id>^4769$</id>
 <description>Kerberos ticket request from account $(account_name)</description>
  <options>no_full_log</options>
 </rule>
</group>