Update Lookups & Windows EventLog Macros #3303
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR updates the windows event log macros for better consistency and coverage, as well as some lookups with additional data. Below are details of the updates:
Lookup Updates
asr_rules
Added 2 additional rules that are in preview to the list, based on https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#asr-rule-to-guid-matrix
builtin_groups_lookup
Added additional groups based on our research on SDDL - https://github.com/MHaggis/SDDLMaker/tree/main/MindMap
dynamic_dns_providers_default
Re-ordered the list alphabetically, and added a couple more entries
security_services_lookup
Added multiple entries to other AV and EDR vendors based on https://github.com/Pennyw0rth/NetExec/blob/c904f3aa813f36f56b61d1021d32f6b527b20d0a/nxc/modules/enum_av.py and https://github.com/netwrix/pingcastle/blob/3e377c62f143ddf4db8c871a10bdf7c8b4605406/Scanners/AntivirusScanner.cs
and make the lookup search a case-insensitive search.
Macro Updates
WinEventLog
andXmlWinEventLog
.PowerShellCore/Operational
to the PowerShell macro.sourcetype
to using thesource
(similar to all other macros).channel
logic to the built-in event logs (Application, System, Security).