From 2f9fc763599826bc84b0cc172817049b8a88e681 Mon Sep 17 00:00:00 2001 From: JocLRojas Date: Wed, 5 Aug 2026 17:34:43 +0300 Subject: [PATCH] feat(rules/windows): update adfs, certificate services, sid history and smbv1 rules --- rules/windows/adfs_authentication_anomalies.yml | 2 +- rules/windows/certificate_services_abuse.yml | 2 +- rules/windows/sid_history_injection.yml | 2 +- rules/windows/smbv1_usage_detection.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/rules/windows/adfs_authentication_anomalies.yml b/rules/windows/adfs_authentication_anomalies.yml index 822ee3a08..e0c052b9d 100644 --- a/rules/windows/adfs_authentication_anomalies.yml +++ b/rules/windows/adfs_authentication_anomalies.yml @@ -24,7 +24,7 @@ description: | 5. Consider implementing IP-based blocking if malicious activity is confirmed 6. Review ADFS configuration for security hardening opportunities 7. Correlate with other authentication events across the domain -where: equals("log.providerName", "AD FS") && (equals("log.eventId", "411") || equals("log.eventId", "342") || equals("log.eventId", "516")) && contains("log.message", "token validation failed") +where: equals("log.providerName", "AD FS") && (equals("log.eventCode", "342") || equals("log.eventCode", "516")) && contains("log.message", "token validation failed") afterEvents: - indexPattern: v11-log-wineventlog-* with: diff --git a/rules/windows/certificate_services_abuse.yml b/rules/windows/certificate_services_abuse.yml index a4a2ac6b8..b5e1f4ae3 100644 --- a/rules/windows/certificate_services_abuse.yml +++ b/rules/windows/certificate_services_abuse.yml @@ -24,7 +24,7 @@ description: | 5. Examine the requesting host for signs of compromise 6. Consider revoking any suspicious certificates issued 7. Validate Certificate Authority security configurations and access controls -where: (equals("log.eventId", "4886") || equals("log.eventId", "4887")) && equals("log.providerName", "Microsoft-Windows-Security-Auditing") && (contains("log.eventDataSubjectUserName", "$") || equals("log.eventDataSubjectUserName", "ANONYMOUS LOGON")) +where: (equals("log.eventCode", "4886") || equals("log.eventCode", "4887")) && equals("log.providerName", "Microsoft-Windows-Security-Auditing") && (contains("log.eventDataSubjectUserName", "$") || equals("log.eventDataSubjectUserName", "ANONYMOUS LOGON")) groupBy: - lastEvent.log.eventDataSubjectUserName - origin.host diff --git a/rules/windows/sid_history_injection.yml b/rules/windows/sid_history_injection.yml index 2fda3769b..bcebcc1f6 100644 --- a/rules/windows/sid_history_injection.yml +++ b/rules/windows/sid_history_injection.yml @@ -27,7 +27,7 @@ description: | 6. Consider resetting the target account password and removing unauthorized SID History entries 7. Review domain administrator accounts and privileged group memberships for anomalies where: | - oneOf("log.eventId", ["4765", "4766"]) && + oneOf("log.eventCode", ["4765", "4766"]) && equals("log.channel", "Security") groupBy: - origin.host diff --git a/rules/windows/smbv1_usage_detection.yml b/rules/windows/smbv1_usage_detection.yml index c3627cbcb..4ebfcf5ff 100644 --- a/rules/windows/smbv1_usage_detection.yml +++ b/rules/windows/smbv1_usage_detection.yml @@ -24,7 +24,7 @@ description: | 5. Plan migration to SMBv2/SMBv3 and disable SMBv1 on all systems where possible 6. Monitor for any lateral movement patterns that may indicate ongoing compromise 7. Consider implementing network segmentation to limit exposure if SMBv1 cannot be immediately disabled -where: equals("log.eventId", "3000") && equals("log.providerName", "Microsoft-Windows-SMBServer") && contains("log.message", "SMB1") +where: equals("log.eventCode", "3000") && equals("log.providerName", "Microsoft-Windows-SMBServer") && contains("log.message", "SMB1") groupBy: - origin.host - origin.ip