Skip to content

Commit

Permalink
Update Win Logsource Mapping
Browse files Browse the repository at this point in the history
  • Loading branch information
@nasbench
nasbench committed Oct 19, 2022
1 parent 04955c5 commit a4338e0
Showing 1 changed file with 5 additions and 2 deletions.
7 changes: 5 additions & 2 deletions sigma/pipelines/common.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
"application": "Application",
"system": "System",
"sysmon": "Microsoft-Windows-Sysmon/Operational",
"powershell": "Microsoft-Windows-PowerShell/Operational",
"powershell": ["Microsoft-Windows-PowerShell/Operational", "PowerShellCore/Operational"],
"powershell-classic": "Windows PowerShell",
"taskscheduler": "Microsoft-Windows-TaskScheduler/Operational",
"wmi": "Microsoft-Windows-WMI-Activity/Operational",
Expand All @@ -15,7 +15,7 @@
"ntlm": "Microsoft-Windows-NTLM/Operational",
"dhcp": "Microsoft-Windows-DHCP-Server/Operational",
"msexchange-management": "MSExchange Management",
"applocker": "Microsoft-Windows-AppLocker/EXE and DLL Management",
"applocker": ["Microsoft-Windows-AppLocker/MSI and Script", "Microsoft-Windows-AppLocker/EXE and DLL", "Microsoft-Windows-AppLocker/Packaged app-Deployment", "Microsoft-Windows-AppLocker/Packaged app-Execution"],
"printservice-admin": "Microsoft-Windows-PrintService/Admin",
"printservice-operational": "Microsoft-Windows-PrintService/Operational",
"codeintegrity-operational": "Microsoft-Windows-CodeIntegrity/Operational",
Expand All @@ -26,6 +26,9 @@
"terminalservices-localsessionmanager": "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational",
"microsoft-servicebus-client": "Microsoft-ServiceBus-Client",
"ldap_debug": "Microsoft-Windows-LDAP-Client/Debug",
"security-mitigations": ["Microsoft-Windows-Security-Mitigations/Kernel Mode", "Microsoft-Windows-Security-Mitigations/User Mode"],
"diagnosis-scripted": "Microsoft-Windows-Diagnosis-Scripted/Operational",
"shell-core": "Microsoft-Windows-Shell-Core/Operational",
}

def logsource_windows(service : str) -> LogsourceCondition:
Expand Down

1 comment on commit a4338e0

@thomaspatzke
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had to revert this commit because introduction of lists in this dict values causes that backends break. Cherrypicked it to the plugin branch which will be the new 0.9 release that contains breaking changes anyways and can't be installed accidentially by relocking the dependencies. @nasbench FYI.

Please sign in to comment.