Samirbous

sequence by host.id with maxspan=5m
[authentication where

 /* event 4624 need to be logged */
 event.action == "logged-in" and event.outcome == "success" and

 /* authenticate locally using relayed kerberos TGS */
 winlog.event_data.AuthenticationPackageName :"Kerberos" and winlog.logon.type == "Network" and
 source.ip == "127.0.0.1" and source.port > 0 and

Samirbous

sequence by host.id with maxspan=5s
 [process where event.code : "10" and winlog.event_data.GrantedAccess:"0x1"] by winlog.event_data.TargetProcessGUID
 [process where event.code : "5" /* you can add process.name : ("seecurity-proc1", "security-proc2") */] by process.entity_id

Samirbous

sequence by host.id with maxspan=5s
 [any where event.code : "4703" and winlog.event_data.EnabledPrivilegeList:"SeDebugPrivilege"] by winlog.event_data.ProcessName
 [process where event.code : "10" and not process.name in ("Procmon64.exe", "procexp64.exe")] by process.executable

Samirbous

process where event.code : "10" and not process.executable : "?:\\Windows\\Explorer.exe" and 
 winlog.event_data.CallTrace : "?:\\WINDOWS\\System32\\win32u.dll*" and not winlog.event_data.GrantedAccess : ("0x*00", "0x*10", "0x*01")

Samirbous

sequence by host.id, process.entity_id with maxspan=1s
 [process where event.code : "10" and process.name : "sihost.exe" and 
  winlog.event_data.CallTrace : "*CoreShellExtFramework*" and  winlog.event_data.GrantedAccess : "0x40"]
 [process where event.code : "10" and process.name : "sihost.exe" and 
  not winlog.event_data.GrantedAccess : ("0x*00", "0x1010", "0x1410", "0x40")]

Samirbous

event.code:4688 and winlog.event_data.TargetUserSid :"S-1-0-0" and not winlog.event_data.TargetUserName:*$ and 
not winlog.event_data.TargetUserName:- and not winlog.event_data.TargetUserName:"defaultuser100000" and 
not winlog.event_data.TargetUserName : ("LOCAL SERVICE" or "NETWORK SERVICE") and 
not winlog.event_data.TargetDomainName : ("NT Service" or "Font Driver Host")

Samirbous

type=PROCTITLE msg=audit(12/13/2021 01:49:50.838:66) : proctitle=/bin/bash 
type=PATH msg=audit(12/13/2021 01:49:50.838:66) : item=2 name=/lib64/ld-linux-x86-64.so.2 inode=4194344 dev=08:01 mode=file,755 ouid=root ogid=root rdev=00:00 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(12/13/2021 01:49:50.838:66) : item=1 name=/usr/bin/clear inode=4194578 dev=08:01 mode=file,755 ouid=root ogid=root rdev=00:00 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(12/13/2021 01:49:50.838:66) : item=0 name=/usr/bin/clear inode=4194578 dev=08:01 mode=file,755 ouid=root ogid=root rdev=00:00 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(12/13/2021 01:49:50.838:66) : cwd=/home/kali 
type=EXECVE msg=audit(12/13/2021 01:49:50.838:66) : argc=1 a0=clear 
type=SYSCALL msg=audit(12/13/2021 01:49:50.838:66) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x5613225618a0 a1=0x56132257a310 a2=

Samirbous

sequence by host.id with maxspan=1s
   [process where event.action : "creation_event" and 
    process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe") and 
    not (process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\WINDOWS\\splwow64.exe") and 
            process.args_count >= 2)
    ] by process.parent.entity_id
   [process where event.action : "termination_event" and 
    process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and 
    process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe", "explorer.exe", "outlook.exe", "thunderbird.exe")
    ] by process.entity_id

Samirbous

process where event.action : "start" and 
  process.executable : "?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" and 
  process.args_count <= 2 and process.args_count > 1 and
  not process.args : "?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"

Samirbous

sequence by host.hostname with maxspan=1m
  [network where network.direction : ("egress", "outgoing") and 
   process.name != "spoolsv.exe" and not network.protocol == "dns" and not user.name : "SYSTEM" and
   source.port >= 49152 and destination.port >= 49152] by destination.address,source.address, destination.port, source.port
  [network where process.name : "spoolsv.exe" and user.name : "SYSTEM" and
   network.direction : ("ingress", "incoming") and
   not network.protocol == "dns" and
   source.port >= 49152 and destination.port >= 49152] by source.address, destination.address, destination.port, source.port