Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Lookups & Windows EventLog Macros #3303

Open
wants to merge 3 commits into
base: develop
Choose a base branch
from
Open

Conversation

nasbench
Copy link
Contributor

@nasbench nasbench commented Jan 30, 2025

This PR updates the windows event log macros for better consistency and coverage, as well as some lookups with additional data. Below are details of the updates:

Lookup Updates

asr_rules

Added 2 additional rules that are in preview to the list, based on https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#asr-rule-to-guid-matrix

builtin_groups_lookup

Added additional groups based on our research on SDDL - https://github.com/MHaggis/SDDLMaker/tree/main/MindMap

dynamic_dns_providers_default

Re-ordered the list alphabetically, and added a couple more entries

security_services_lookup

Added multiple entries to other AV and EDR vendors based on https://github.com/Pennyw0rth/NetExec/blob/c904f3aa813f36f56b61d1021d32f6b527b20d0a/nxc/modules/enum_av.py and https://github.com/netwrix/pingcastle/blob/3e377c62f143ddf4db8c871a10bdf7c8b4605406/Scanners/AntivirusScanner.cs
and make the lookup search a case-insensitive search.

Macro Updates

  • All windows event log macros have been updated to use both WinEventLog and XmlWinEventLog .
  • Added PowerShellCore/Operational to the PowerShell macro.
  • Fixed the WMI macro from using sourcetype to using the source (similar to all other macros).
  • Added channel logic to the built-in event logs (Application, System, Security).

@nasbench nasbench marked this pull request as ready for review January 31, 2025 14:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant