velociraptor_windows_event_monitoring.yaml

Preamble: |
  name: Windows.Sigma.CuratedMonitoring
  type: CLIENT_EVENT
  parameters:
    - name: ROOT
      description: The Event Log Directory we use to read all logs
      default: C:/Windows/System32/WinEvt/Logs/
    - name: Debug
      type: bool
      description: Enable full debug trace
    - name: RuleLevel
      type: choices
      default: Critical
      choices:
        - Critical
        - Critical and High
        - All

    - name: RuleStatus
      type: choices
      default: Stable
      choices:
        - Stable
        - Stable and Experimental
        - Stable and Test
        - All Rules

    - name: RuleTitleFilter
      type: regex
      default: .
      description: Use this to filter only some rules to match

    - name: SigmaRules
      description: If provided we use these rules instead of the built in set.

    - name: SleepCounter
      type: int
      default: 1
      description: How long to sleep between queries.

  sources:
  - query: |
      LET RuleStatusRegex <= get(item=dict(
         `Stable`="stable",
         `Stable and Experimental`="stable|experimental",
         `Stable and Test`="stable|test",
         `All Rules`="."), member=RuleStatus)

      LET RuleLevelRegex <= get(item=dict(
         Critical="critical",
         `Critical and High`="critical|high",
         `All`="."), member=RuleLevel)

      LET MandatoryLabelLookup <= dict(
        `S-1-16-0`= 'UNTRUSTED',
        `S-1-16-4096`= 'LOW_INTEGRITY',
        `S-1-16-8192`= 'MEDIUM_INTEGRITY',
        `S-1-16-8448`= 'MEDIUM_HIGH_INTEGRITY',
        `S-1-16-12288`= 'HIGH_INTEGRITY',
        `S-1-16-16384`= 'SYSTEM_INTEGRITY',
        `S-1-16-20480`= 'PROTECTED_PROCESS')

      LET TokenElevationTypeLookup <= dict(
        `%%1936`= 'FULL_TOKEN',
        `%%1937`= 'ELEVATED_TOKEN',
        `%%1938`= 'LIMITED_TOKEN')

FieldMappings:
  MandatoryLabel: |
    x=>get(item=MandatoryLabelLookup, member=x.EventData.MandatoryLabel || "-")

  TokenElevationType:
    x=>get(item=TokenElevationTypeLookup, member=x.EventData.TokenElevationType || "-")

  AccessList: "x=>x.EventData.AccessList"
  AccessMask: "x=>x.EventData.AccessMask"
  Accesses: "x=>x.EventData.Accesses"
  AccountDomain: "x=>x.EventData.AccountDomain"
  AccountName: "x=>x.EventData.AccountName"
  Account_Name: "x=>x.EventData.Account_Name"
  Action: "x=>x.EventData.Action"
  AllowedToDelegateTo: "x=>x.EventData.AllowedToDelegateTo"
  ApplicationPath: "x=>x.EventData.ApplicationPath"
  AppName: "x=>x.EventData.AppName"
  Arguments: "x=>x.Arguments"
  AttributeLDAPDisplayName: "x=>x.EventData.AttributeLDAPDisplayName"
  AttributeValue: "x=>x.EventData.AttributeValue"
  AuditPolicyChanges: "x=>x.EventData.AuditPolicyChanges"
  AuditSourceName: "x=>x.EventData.AuditSourceName"
  AuthenticationPackageName: "x=>x.EventData.AuthenticationPackageName"
  CallTrace: "x=>x.EventData.CallTrace"
  CallerProcessName: "x=>x.EventData.CallerProcessName"
  Caller_Process_Name: "x=>x.EventData.Caller_Process_Name"
  CallingProcessName: "x=>x.EventData.CallingProcessName"
  CategoryName: "x=>x.EventData.`Category Name`"
  CertThumbprint: "x=>x.EventData.CertThumbprint"
  Channel: "x=>x.System.Channel"
  ClassName: "x=>x.EventData.ClassName"
  ClientAddress: "x=>x.EventData.ClientAddress"
  Client_Address: "x=>x.EventData.Client_Address"
  ClientName: "x=>x.EventData.ClientName"
  CommandLine: "x=>if(condition=x.EventData.CommandLine, then=x.EventData.CommandLine, else=x.CommandLine)"
  Command: "x=>x.Command"
  Company: "x=>x.EventData.Company"
  Computer: "x=>x.System.Computer"
  ComputerName: "x=>x.System.Computer"
  ContextInfo: "x=>x.EventData.ContextInfo"
  CurrentDirectory: "x=>x.EventData.CurrentDirectory"
  Data: "x=>serialize(item=x.EventData)"
  Description: "x=>x.EventData.Description"
  DestAddress: "x=>x.EventData.DestAddress"
  DestPort: "x=>x.EventData.DestPort"
  Destination: "x=>x.EventData.Destination"
  DestinationAddress: "x=>x.EventData.DestinationAddress"
  DestinationHostname: "x=>x.EventData.DestinationHostname"
  DestinationIp: "x=>x.EventData.DestinationIp"
  DestinationIsIpv6: "x=>x.EventData.DestinationIsIpv6"
  DestinationPort: "x=>x.EventData.DestinationPort"
  Details: "x=>x.EventData.Details"
  DetectionSource: "x=>x.EventData.DetectionSource"
  DetectionUser: "x=>x.EventData.`Detection User`"
  Device: "x=>x.EventData.Device"
  DeviceClassName: "x=>x.EventData.DeviceClassName"
  DeviceDescription: "x=>x.EventData.DeviceDescription"
  DeviceInstanceID: "x=>x.UserData.InstallDeviceID.DeviceInstanceID"
  DeviceName: "x=>x.EventData.DeviceName"
  DomainName: "x=>x.EventData.SubjectDomainName"
  DriverDescription: "x=>x.UserData.InstallDeviceID.DriverDescription"
  DriverProvider: "x=>x.UserData.InstallDeviceID.DriverProvider"
  InstallStatus: "x=>x.UserData.InstallDeviceID.InstallStatus"
  EngineVersion: "x=>x.EventData.EngineVersion"
  ErrorCode: "x=>x.EventData.ErrorCode"
  EventID: "x=>x.System.EventID.Value"
  EventType: "x=>x.EventData.EventType"
  ExecutionProcessID: "x=>x.System.Execution.ProcessID"
  FailureCode: "x=>x.EventData.FailureCode"
  FilePath: "x=>x.EventData.FilePath"
  FileVersion: "x=>x.EventData.FileVersion"
  Filename: "x=>x.EventData.Filename"
  GrandParentImage: "x=>x.GrandParentImage"
  GrantedAccess: "x=>x.EventData.GrantedAccess"
  GroupName: "x=>x.EventData.GroupName"
  GroupSid: "x=>x.EventData.GroupSid"
  Hashes: "x=>x.EventData.Hashes"
  HiveName: "x=>x.EventData.HiveName"
  HostApplication: "x=>x.EventData.HostApplication"
  HostName: "x=>x.EventData.HostName"
  HostVersion: "x=>x.EventData.HostVersion"
  Image: "x=>if(condition=x.EventData.Image, then=x.EventData.Image, else=x.Image)"
  ImageLoaded: "x=>if(condition=x.EventData.ImageLoaded, then=x.EventData.ImageLoaded, else=x.ModulePath"
  ImagePath: "x=>if(condition=x.EventData.ImagePath, then=x.EventData.ImagePath, else=x.Image)"
  Imphash: "x=>x.EventData.Hashes"
  Initiated: "x=>x.EventData.Initiated"
  InstanceID: "x=>x.UserData.UMDFHostDeviceArrivalBegin.InstanceId"
  IntegrityLevel: "x=>x.EventData.IntegrityLevel"
  IpAddress: "x=>x.EventData.IpAddress"
  IpPort: "x=>x.EventData.IpPort"
  JobTitle: "x=>x.EventData.name"
  KeyLength: "x=>x.EventData.KeyLength"
  Keywords: "x=>x.System.Keywords"
  LDAPDisplayName: "x=>x.EventData.LDAPDisplayName"
  LayerRTID: "x=>x.EventData.LayerRTID"
  Level: "x=>x.System.Level"
  LocalIP: "x=>x.LocalIP"
  LocalPort: "x=>x.LocalPort"
  LogFileClearedChannel: "x=>x.UserData.LogFileCleared.Channel"
  LogFileClearedSubjectUserName: "x=>x.UserData.LogFileCleared.SubjectUserName"
  LogonId: "x=>x.EventData.LogonId"
  LogonID: "x=>x.EventData.LogonID"
  LogonProcessName: "x=>x.EventData.LogonProcessName"
  LogonType: "x=>x.EventData.LogonType"
  Logon_Account: "x=>x.EventData.Logon_Account"
  MachineName: "x=>x.EventData.MachineName"
  MD5: "x=>x.MD5"
  md5: "x=>x.MD5"
  MemberName: "x=>x.EventData.MemberName"
  MemberSid: "x=>x.EventData.MemberSid"
  Message: "x=>x.EventData"
  ModifyingApplication: "x=>x.EventData.ModifyingApplication"
  ModuleName: "x=>x.ModuleName"
  ModulePath: "x=>x.ModulePath"
  Name: "x=>x.Name"
  NewName: "x=>x.EventData.NewName"
  NewTemplateContent: "x=> x.EventData.NewTemplateContent"
  NewUacValue: "x=>x.EventData.NewUacValue"
  NewValue: "x=>x.EventData.NewValue"
  New_Value: "x=>x.EventData.`New Value`"
  NewProcessName: "ifx=>if(condition=x.EventData.NewProcessName, then=x.EventData.NewProcessName, else=x.ProcessName)"
  NewProcessId: "x=>x.EventData.NewProcessId"
  ObjectClass: "x=>x.EventData.ObjectClass"
  ObjectName: "x=>x.EventData.ObjectName"
  ObjectServer: "x=>x.EventData.ObjectServer"
  ObjectType: "x=>x.EventData.ObjectType"
  ObjectValueName: "x=>x.EventData.ObjectValueName"
  OldUacValue: "x=>x.EventData.OldUacValue"
  Origin: "x=>x.EventData.Origin"
  OriginalFileName: "x=>x.EventData.OriginalFileName"
  OriginalFilename: "x=>x.EventData.OriginalFileName"
  OSPath: "x=>x.OSPath"
  param1: "x=>x.EventData.param1"
  param2: "x=>x.EventData.param2"
  param3: "x=>x.EventData.param3"
  param4: "x=>x.EventData.param4"
  param5: "x=>x.EventData.param5"
  ParentCommandLine: "x=>if(condition=x.EventData.ParentCommandLine, then=x.EventData.ParentCommandLine, else=x.CommandLine)"
  ParentImage: "x=>x.EventData.ParentImage"
  ParentIntegrityLevel: "x=>x.EventData.ParentIntegrityLevel"
  ParentProcessName: "x=>x.EventData.ParentProcessName"
  ParentUser: "x=>x.EventData.ParentUser"
  PasswordLastSet: "x=>x.EventData.PasswordLastSet"
  Path: "x=>x.EventData.Path"
  PathName: "x=>x.PathName"
  Payload: "x=>x.EventData.Payload"
  PipeName: "x=>x.EventData.PipeName"
  PossibleCause: "x=>x.UserData.PossibleCause"
  PreAuthType: "x=>x.EventData.PreAuthType"
  PrivilegeList: "x=>x.EventData.PrivilegeList"
  ProcessCommandLine: "x=>x.EventData.ProcessCommandLine"
  ProcessGuid: "x=>x.EventData.ProcessGuid"
  ProcessId: "x=>x.EventData.ProcessId"
  ProcessName: "x=>x.EventData.ProcessName"
  Product: "x=>x.EventData.Product"
  Properties: "x=>x.EventData.Properties"
  Provider: "x=>x.UserData.Provider"
  ProviderName: "x=>x.System.Provider.Name"
  Provider_Name: "x=>x.System.Provider.Name"
  QNAME: "x=>x.EventData.QNAME"
  query: "x=>x.EventData.Query"
  Query: "x=>x.UserData.Query"
  QueryName: "x=>x.EventData.QueryName"
  QueryResults: "x=>x.EventData.QueryResults"
  QueryStatus: "x=>x.EventData.QueryStatus"
  RelativeTargetName: "x=>x.EventData.RelativeTargetName"
  RemoteIP: "x=>x.RemoteIP"
  RemotePort: "x=>x.RemotePort"
  RuleName: "x=>x.EventData.RuleName"
  SAMAccountName: "x=>x.EventData.SamAccountName"
  SamAccountName: "x=>x.EventData.SamAccountName"
  ScriptBlockText: "x=>x.EventData.ScriptBlockText"
  SearchFilter: "x=>x.System.SearchFilter"
  SecurityUserID: "x=>x.System.Security.UserID"
  ServerName: "x=>x.System.ServerName"
  Service: "x=>x.EventData.Service"
  ServiceFileName: "x=>x.EventData.ServiceFileName"
  ServiceName: "x=>x.EventData.ServiceName"
  ServicePrincipalNames: "x=>x.EventData.ServicePrincipalNames"
  ServiceStartType: "x=>x.EventData.ServiceStartType"
  ServiceType: "x=>x.EventData.ServiceType"
  SeverityID: "x=>x.EventData.`Severity ID`"
  SeverityName: "x=>x.EventData.`Severity Name`"
  ShareLocalPath: "x=>x.EventData.ShareLocalPath"
  ShareName: "x=>x.EventData.ShareName"
  SHA1: "x=>x.SHA1"
  sha1: "x=>x.SHA1"
  SHA256: "x=>x.SHA256"
  sha256: "x=>x.SHA256"
  SidHistory: "x=>x.EventData.SidHistory"
  Signature: "x=>x.EventData.Signature"
  SignatureStatus: "x=>x.EventData.SignatureStatus"
  Signed: "x=>x.EventData.Signed"
  Source: "x=>x.System.Provider_Name"
  SourceAddress: "x=>x.EventData.SourceAddress"
  SourceImage: "x=>x.EventData.SourceImage"
  SourceNetworkAddress: "x=>x.EventData.SourceNetworkAddress"
  SourcePort: "x=>x.EventData.SourcePort"
  Source_Name: "x=>x.EventData.`Source Name`"
  Source_Network_Address: "x=>x.EventData.Source_Network_Address"
  Source_WorkStation: "x=>x.EventData.Source_WorkStation"
  StartAddress: "x=>x.EventData.StartAddress"
  StartFunction: "x=>x.EventData.StartFunction"
  StartModule: "x=>x.EventData.StartModule"
  StartType: "x=>x.EventData.StartType"
  State: "x=>x.EventData.State"
  Status: "x=>x.EventData.Status"
  SubcategoryGuid: "x=>x.EventData.SubcategoryGuid"
  SubStatus: "x=>x.EventData.SubStatus"
  service_Name: "x=>x.Name"
  service_DisplayName: "x=>x.DisplayName"
  service_AbsoluteExePath: "x=>x.AbsoluteExePath"
  service_PathName: "x=>x.PathName"
  service_UserAccount: "x=>x.UserAccount"
  SubjectDomainName: "x=>x.EventData.SubjectDomainName"
  SubjectLogonId: "x=>x.EventData.SubjectLogonId"
  SubjectUserName: "x=>x.EventData.SubjectUserName"
  SubjectUserSid: "x=>x.EventData.SubjectUserSid"
  TaskContent: "x=>x.EventData.TaskContent"
  TargetDomainName: "x=>x.EventData.TargetDomainName"
  TargetFilename: "x=>x.EventData.TargetFilename"
  TargetInfo: "x=>x.EventData.TargetInfo"
  TargetImage: "x=>x.EventData.TargetImage"
  TargetLogonId: "x=>x.EventData.TargetLogonId"
  TargetObject: "x=>x.EventData.TargetObject"
  TargetParentProcessId: "x=>x.EventData.TargetParentProcessId"
  TargetProcessAddress: "x=>x.EventData.TargetProcessAddress"
  TargetOutboundUserName: "x=>x.EventData.TargetOutboundUserName"
  TargetServerName: "x=>x.EventData.TargetServerName"
  TargetSid: "x=>x.EventData.TargetSid"
  TargetUserName: "x=>x.EventData.TargetUserName"
  TaskDate: "x=>x.EventData.TaskContent"
  TaskName: "x=>x.EventData.TaskName"
  TemplateContent: "x=>x.EventData.TemplateContent"
  Timestamp: "x=>x.System.TimeCreated.SystemTime"
  ThreatName: "x=>x.EventData.`Threat Name`"
  TicketEncryptionType: "x=>x.EventData.TicketEncryptionType"
  TicketOptions: "x=>x.EventData.TicketOptions"
  Url: "x=>x.EventData.url"
  User: "x=>x.EventData.User"
  UserName: "x=>x.EventData.UserName"
  Value: "x=>x.EventData.Value"
  Version: "x=>x.System.Version"
  WindowsDefenderProcessName: "x=>x.EventData.`Process Name`"
  Workstation: "x=>x.EventData.Workstation"
  WorkstationName: "x=>x.EventData.WorkstationName"
  param1: "x=>x.EventData.param1"
  param2: "x=>x.EventData.param2"
  service: "x=>x.EventData.Service"
  sha1: "x=>x.EventData.Hashes_sha1"
  User: "x=>if(condition=x.EventData.User, then=x.EventData.User, else=x.User)"
  UserDataProviderName: "x=>x.UserData.Operation_StartedOperational.ProviderName"
  UserDataCode: "x=>x.UserData.Operation_StartedOperational.Code"
  UserDataHostProcess: "x=>x.UserData.Operation_StartedOperational.HostProcess"
  UserDataProviderPath: "x=>x.UserData.Operation_StartedOperational.ProviderPath"
  UserDataProcessID: "x=>x.UserData.Operation_StartedOperational.ProcessID"
  UserDataNamespace: "x=>x.UserData.Operation_ESStoConsumerBinding.Namespace"
  UserDataNamespaceName: "x=>x.UserData.Operation_TemporaryEssStarted.NamespaceName"
  UserDataQuery: "x=>x.UserData.Operation_TemporaryEssStarted.Query"
  UserDataUser: "x=>x.UserData.Operation_TemporaryEssStarted.User"
  UserDataProcessid: "x=>x.UserData.Operation_TemporaryEssStarted.Processid"
  UserDataConsumer: "x=>x.UserData.Operation_ESStoConsumerBinding.CONSUMER"
  UserDataESS: "x=>x.UserData.Operation_ESStoConsumerBinding.ESS"
  UserDataPossibleCause: "x=>x.UserData.Operation_ESStoConsumerBinding.PossibleCause"
  UserDataParam1: "x=>x.UserData.EventXML.Param1"
  UserDataParam2: "x=>x.UserData.EventXML.Param2"
  UserDataParam3: "x=>x.UserData.EventXML.Param3"
  UserDataUser: "x=>x.UserData.EventXML.User"
  UserDataSessionID: "x=>x.UserData.EventXML.SessionID"
  UserDataAddress: "x=>x.UserData.EventXML.Address"
  Username: "x=>if(condition=x.EventData.Username, then=x.EventData.Username, else=x.Username)"
  SysmonVersion: "x=>x.EventData.SysmonVersion"
  OperationEssStartedNamespaceName: "x=>x.UserData.Operation_EssStarted.NamespaceName"
  OperationEssStartedQuery: "x=>x.UserData.Operation_EssStarted.Query"
  OperationEssStartedUser: "x=>x.UserData.Operation_EssStarted.User"
  OperationEssStartedProcessid: "x=>x.UserData.Operation_EssStarted.Processid"
  OperationEssStartedProvider: "x=>x.UserData.Operation_EssStarted.Provider"
  OperationEssStartedPossibleCause: "x=>x.UserData.Operation_EssStarted.PossibleCause"
  DvrFmwkInstanceId: "x=>x.UserData.UMDFHostDeviceRequest.InstanceId"
  DvrFmwk2003InstanceId: "x=>x.UserData.UMDFHostDeviceArrivalBegin.InstanceId"
  PackageFullName: "x=>x.UserData.PackageFullName"

DefaultDetails:
  Query: |
    x=>get(item=DefaultDetails,
           member=format(format="%v/%v",
              args=[x.System.Provider.Name, x.System.EventID.Value])
          ) || x.Message || x.UserData || x.EventData || x
  Lookup:
    Microsoft-Windows-Bits-Client/3: "JobTitle: %jobTitle% ¦ JobID: %jobId% ¦ JobOwner: %jobOwner% ¦ Proc: %processPath% ¦ PID: %ProcessId%"
    PowerShellCore/4103: "Payload: %Payload%"
    PowerShellCore/4104: "ScriptBlock: %ScriptBlockText%"
    Microsoft-Windows-PowerShell/4103: "Payload: %Payload%"
    Microsoft-Windows-PowerShell/4104: "ScriptBlock: %ScriptBlockText%"
    Microsoft-Windows-Security-Auditing/1102: "User: %LogFileClearedSubjectUserName%"
    Microsoft-Windows-Security-Auditing/4624: "Type: %LogonType% ¦ TgtUser: %TargetUserName% ¦ SrcComp: %WorkstationName% ¦ SrcIP: %IpAddress% ¦ LID: %TargetLogonId%"
    Microsoft-Windows-Security-Auditing/4625: "Type: %LogonType% ¦ TgtUser: %TargetUserName% ¦ SrcComp: %WorkstationName% ¦ SrcIP: %IpAddress% ¦ AuthPkg: %AuthenticationPackageName% ¦ Proc: %ProcessName%"
    Microsoft-Windows-Security-Auditing/4648: "TgtUser: %TargetUserName% ¦ SrcUser: %SubjectUserName% ¦ SrcIP: %IpAddress% ¦ Proc: %ProcessName% ¦ TgtSvr: %TargetInfo%"
    Microsoft-Windows-Security-Auditing/4672: "TgtUser: %SubjectUserName% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4673: "Proc: %ProcessName% ¦ User: %SubjectUserName% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4674: "Svc: %ObjectName% ¦ User: %SubjectUserName% ¦ AccessMask: %AccessMask% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4688: "Cmdline: %CommandLine% ¦ Proc: %NewProcessName% ¦ PID: %NewProcessId% ¦ User: %SubjectUserName% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4698: "Name: %TaskName% ¦ Content: %TaskContent% ¦ User: %SubjectUserName% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4699: "Name: %TaskName% ¦ User: %SubjectUserName% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4720: "TgtUser: %TargetUserName% ¦ TgtSID: %TargetSid%"
    Microsoft-Windows-Security-Auditing/4728: "SrcSID: %MemberSid% ¦ TgtGrp: %TargetUserName% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4732: "SrcSID: %MemberSid% ¦ TgtGrp: %TargetUserName% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4768: "TgtUser: %TargetUserName% ¦ Svc: %ServiceName% ¦ SrcIP: %IpAddress% ¦ Status: %Status% ¦ PreAuthType: %PreAuthType%"
    Microsoft-Windows-Security-Auditing/4769: "TgtUser: %TargetUserName% ¦ Svc: %ServiceName% ¦ SrcIP: %IpAddress% ¦ Status: %Status%"
    Microsoft-Windows-Security-Auditing/4776: "TgtUser: %TargetUserName% ¦ SrcComp: %Workstation% ¦ Status: %Status%"
    Microsoft-Windows-Security-Auditing/4778: "SrcUser: %AccountName% ¦ Domain: %AccountDomain% ¦ SrcIP: %ClientAddress% ¦ SrcComp: %ClientName% ¦ LID: %LogonID%"
    Microsoft-Windows-Security-Auditing/4779: "SrcUser: %AccountName% ¦ Domain: %AccountDomain% ¦ SrcIP: %ClientAddress% ¦ SrcComp: %ClientName% ¦ LID: %LogonID%"
    Microsoft-Windows-Security-Auditing/5136: "User: %SubjectUserName% ¦ SID: %SubjectUserSid% ¦ ObjDN: %ObjectDN% ¦ AttrLDAPName: %AttributeLDAPDisplayName% ¦ OpType: %OperationType% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/5140: "SrcUser: %SubjectUserName% ¦ ShareName: %ShareName% ¦ SharePath: %ShareLocalPath% ¦ SrcIP: %IpAddress% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/5145: "SrcUser: %SubjectUserName% ¦ ShareName: %ShareName% ¦ SharePath: %ShareLocalPath% ¦ Path: %RelativeTargetName% ¦ SrcIP: %IpAddress% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4616: "PrevTime: %PreviousTime% ¦ NewTime: %NewTime% ¦ User: %SubjectUserName% ¦ Proc: %ProcessName% ¦ PID: %ProcessId% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4697: "Svc: %ServiceName% ¦ Path: %ServiceFileName% ¦ User: %SubjectUserName% ¦ SvcAcct: %ServiceAccount% ¦ SvcType: %ServiceType% ¦ SvcStartType: %ServiceStartType% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4661: "User: %SubjectUserName% ¦ ObjSvr: %ObjectServer% ¦ ObjType: %ObjectType% ¦ ObjName: %ObjectName% ¦ Proc: %ProcessName% ¦ PID: %ProcessId% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4662: "User: %SubjectUserName% ¦ ObjSvr: %ObjectServer% ¦ ObjName: %ObjectName% ¦ OpType: %OperationType% ¦ HID: %HandleId% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4663: "User: %SubjectUserName% ¦ ObjSvr: %ObjectServer% ¦ ObjName: %ObjectName% ¦ ObjType: %ObjectType% ¦ Proc: %ProcessName% ¦ PID: %ProcessId% ¦ HID: %HandleId% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4656: "User: %SubjectUserName% ¦ ObjSvr: %ObjectServer% ¦ ObjName: %ObjectName% ¦ ObjType: %ObjectType% ¦ AccessReason: %AccessReason% ¦ Proc: %ProcessName% ¦ PID: %ProcessId% ¦ HID: %HandleId% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4738: "User: %SubjectUserName% ¦ SID: %SubjectUserSid% ¦ TgtUser: %TargetUserName% ¦ TgtSID: %TargetSid% ¦ Domain: %SubjectDomainName% ¦ TgtDomain: %TargetDomainName% ¦ SamUser: %SamAccountName% ¦ DisplayName: %DisplayName% ¦ UAC: %UserAccountControl% ¦ OldUAC: %OldUacValue% ¦ NewUAC: %NewUacValue% ¦ AcctExpires: %AccountExpires% ¦ AllowedToDelegateTo: %AllowedToDelegateTo% ¦ HomeDir: %HomeDirectory% ¦ HomePath: %HomePath% ¦ LogonHours: %LogonHours% ¦  PwLastSet: %PasswordLastSet% ¦ PrimaryGrpID: %PrimaryGroupId% ¦ PrivList: %PrivilegeList% ¦ ProfilePath: %ProfilePath% ¦ ScriptPath: %ScriptPath% ¦ SidHistory: %SidHistory% ¦ UserParams: %UserParameters% ¦ UPN: %UserPrincipalName% ¦ SrcComp: %UserWorkstations% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4825: "Domain: %AccountDomain% ¦ User: %AccountName% ¦ SrcIP: %ClientAddress% ¦ LID: %LogonID%"
    Microsoft-Windows-Security-Auditing/4904: "AuditSrcName: %AuditSourceName% ¦ EventSrcID: %EventSourceId% ¦ User: %SubjectUserName% ¦ SID: %SubjectUserSid% ¦ Domain: %SubjectDomainName% ¦ Proc: %ProcessName% ¦ PID: %ProcessId% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4905: "AuditSrcName: %AuditSourceName% ¦ User: %SubjectUserName% ¦ SID: %SubjectUserSid% ¦ Proc: %ProcessName% ¦ PID: %ProcessId% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4719: "User: %SubjectUserName% ¦ AuditPolicyChanges: %AuditPolicyChanges% ¦ CategoryId: %CategoryId% ¦ SubcategoryGuid: %SubcategoryGuid% ¦ SubcategoryId: %SubcategoryId% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4742: "SPN: %ServicePrincipalNames% ¦ User: %SubjectUserName% ¦ SID: %SubjectUserSid% ¦ TgtUser: %TargetUserName% ¦ TgtSID: %TargetSid% ¦ Domain: %SubjectDomainName% ¦ TgtDomain: %TargetDomainName% ¦ SamUser: %SamAccountName% ¦ DisplayName: %DisplayName% ¦ UAC: %UserAccountControl% ¦ OldUAC: %OldUacValue% ¦ NewUAC: %NewUacValue% ¦ AcctExpires: %AccountExpires% ¦ AllowedToDelegateTo: %AllowedToDelegateTo% ¦ HomeDir: %HomeDirectory% ¦ HomePath: %HomePath% ¦ LogonHours: %LogonHours% ¦  PwLastSet: %PasswordLastSet% ¦ PrimaryGrpID: %PrimaryGroupId% ¦ PrivList: %PrivilegeList% ¦ ProfilePath: %ProfilePath% ¦ ScriptPath: %ScriptPath% ¦ SidHistory: %SidHistory% ¦ UserParams: %UserParameters% ¦ UPN: %UserPrincipalName% ¦ SrcComp: %UserWorkstations% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4765: "User: %SubjectUserName% ¦ SID: %SubjectUserSid% ¦ SrcUser: %SourceUserName% ¦ SrcSID: %SourceSid% ¦ TgtUser: %TargetUserName% ¦ TgtSID: %TargetSid% ¦ Domain: %SubjectDomainName% ¦ TgtDomain: %TargetDomainName% ¦ PrivList: %PrivilegeList% ¦ SidList: %SidList% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4781: "OldTgtUser: %OldTargetUserName% ¦ NewTgtUser: %NewTargetUserName% ¦ TgtSID: %TargetSid% ¦ User: %SubjectUserName% ¦ SID: %SubjectUserSid% ¦ Domain: %SubjectDomainName% ¦ TgtDomain: %TargetDomainName% ¦ PrivList: %PrivilegeList% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/4794: "User: %SubjectUserName% ¦ SID: %SubjectUserSid% ¦ Domain: %SubjectDomainName% ¦ Status: %Status% ¦ SrcComp: %Workstation% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/5156: "Proc: %Application% ¦ SrcIP: %SourceAddress% ¦ SrcPort: %SourcePort% ¦ TgtIP: %DestAddress% ¦ TgtPort: %DestPort% ¦ Protocol: %Protocol% ¦ TgtMachineID: %RemoteMachineID% ¦ TgtSID: %RemoteUserID% ¦ PID: %ProcessID%"
    Microsoft-Windows-Security-Auditing/5157: "Proc: %Application% ¦ SrcIP: %SourceAddress% ¦ SrcPort: %SourcePort% ¦ TgtIP: %DestAddress% ¦ TgtPort: %DestPort% ¦ Protocol: %Protocol% ¦ TgtMachineID: %RemoteMachineID% ¦ TgtSID: %RemoteUserID% ¦ PID: %ProcessID%"
    Microsoft-Windows-Security-Auditing/5379: "PID: %ClientProcessId% ¦ SrcUser: %SubjectUserName% ¦ Tgt: %TargetName% ¦ CredsReturned: %CountOfCredentialsReturned% ¦ ReturnCode: %ReturnCode% ¦ LID: %SubjectLogonId% ¦ SrcSID: %SubjectUserSid%"
    Microsoft-Windows-Security-Auditing/6416: "DeviceDescrip: %DeviceDescription% ¦ DeviceID: %DeviceId% ¦ LocInfo: %LocationInformation% ¦ CompatibleIDs: %CompatibleIds% ¦ User: %SubjectUserName% ¦ SID: %SubjectUserSid% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/5142: "User: %SubjectUserName% ¦ ShareName: %ShareName% ¦ ShareLocalPath: %ShareLocalPath% ¦ LID: %SubjectLogonId%"
    Microsoft-Windows-Security-Auditing/6281: "Path: %param1%"
    Microsoft-Windows-Security-Auditing/4692: "User: %SubjectUserName% ¦ SID: %SubjectUserSid% ¦ Domain: %SubjectDomainName% ¦ MasterKeyId: %MasterKeyId% ¦ RecoveryServer: %RecoveryServer% ¦ RecoveryKeyId: %RecoveryKeyId% ¦ FailureReason: %FailureReason%"
    Microsoft-Windows-Security-Auditing/5038: "Path: %param1%"
    Microsoft-Windows-Sysmon/1: "Cmdline: %CommandLine% ¦ Proc: %Image% ¦ User: %User% ¦ ParentCmdline: %ParentCommandLine% ¦ LID: %LogonId% ¦ LGUID: %LogonGuid% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid% ¦ ParentPID: %ParentProcessId% ¦ ParentPGUID: %ParentProcessGuid% ¦ Description: %Description% ¦ Product: %Product% ¦ Company: %Company% ¦ Hashes: %Hashes%"
    Microsoft-Windows-Sysmon/2: "Path: %TargetFilename% ¦ Proc: %Image% ¦ User: %User% ¦ CreationTime: %CreationUtcTime% ¦ PreviousTime: %PreviousCreationUtcTime% ¦ PID: %PID% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/3: "Initiated: %Initiated% ¦ Proto: %Protocol% ¦ SrcIP: %SourceIp% ¦ SrcPort: %SourcePort% ¦ SrcHost: %SourceHostname% ¦ TgtIP: %DestinationIp% ¦ TgtPort: %DestinationPort% ¦ TgtHost: %DestinationHostname% ¦ User: %User% ¦ Proc: %Image% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/4: "State: %State% ¦ SysmonVer: %SysmonVersion% ¦ SchemaVer: %SchemaVersion%"
    Microsoft-Windows-Sysmon/5: "Proc: %Image% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/6: "Path: %ImageLoaded% ¦ Sig: %Signature% ¦ Signed: %Signed% ¦ SigStatus: %SignatureStatus% ¦ Hashes: %Hashes%"
    Microsoft-Windows-Sysmon/7: "Image: %ImageLoaded% ¦ Proc: %Image% ¦ Description: %Description% ¦ Product: %Product% ¦ Company: %Company% ¦ Signed: %Signed% ¦ Sig: %SignatureStatus% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid% ¦ Hash: %Hashes% ¦ OrigFilename: %OriginalFilename%"
    Microsoft-Windows-Sysmon/8: "SrcProc: %SourceImage% ¦ TgtProc: %TargetImage% ¦ SrcPID: %SourceProcessId% ¦ SrcPGUID: %SourceProcessGuid% ¦ TgtPID: %TargetProcessId% ¦ TgtPGUID: %TargetProcessGuid%"
    Microsoft-Windows-Sysmon/9: "Proc: %Image% ¦ Device: %Device% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/10: "SrcProc: %SourceImage% ¦ TgtProc: %TargetImage% ¦ SrcUser: %SourceUser% ¦ TgtUser: %TargetUser% ¦ Access: %GrantedAccess% ¦ SrcPID: %SourceProcessId% ¦ SrcPGUID: %SourceProcessGUID% ¦ TgtPID: %TargetProcessId% ¦ TgtPGUID: %TargetProcessGUID%"
    Microsoft-Windows-Sysmon/11: "Path: %TargetFilename% ¦ Proc: %Image% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/12: "EventType: %EventType% ¦ TgtObj: %TargetObject% ¦ Proc: %Image% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/13: "EventType: %EventType% ¦ TgtObj: %TargetObject%: %Details% ¦ Proc: %Image% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/14: "EventType: %EventType% ¦ TgtObj: %TargetObject%: %Details% ¦ Proc: %Image% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/15: "Path: %TargetFilename% ¦ Proc: %Image% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid% ¦ Hash: %Hash%"
    Microsoft-Windows-Sysmon/16: "Config: %Configuration%"
    Microsoft-Windows-Sysmon/17: "Pipe: %PipeName% ¦ Proc: %Image% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/18: "Pipe: %PipeName% ¦ Proc: %Image% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/19: "Op: %Operation% ¦ Namespace: %EventNamespace% ¦ Name: %Name% ¦ Query: %query% ¦ User: %User%"
    Microsoft-Windows-Sysmon/20: "Op: %Operation% ¦ Type: %Type% ¦ Name: %Name% ¦ Tgt: %Destination% ¦ User: %User%"
    Microsoft-Windows-Sysmon/21: "Op: %Operation% ¦ Consumer: %Consumer% ¦ Filter: %Filter%"
    Microsoft-Windows-Sysmon/22: "Query: %QueryName% ¦ Result: %QueryResults% ¦ Proc: %Image% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/23: "Path: %TargetFilename% ¦ Proc: %Image% ¦ User: %User% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/24: "Proc: %Image% ¦ User: %User% ¦ CliInfo: %ClientInfo% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/25: "Proc: %Image% ¦ Type: %Type% ¦ User: %User% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/26: "Path: %TargetFilename% ¦ Proc: %Image% ¦ User: %User% ¦ PID: %ProcessId% ¦ PGUID: %ProcessGuid%"
    Microsoft-Windows-Sysmon/255: "ID: %ID% ¦ Description: %Description%"
    Service Control Manager/7031: "Svc: %param1% ¦ CrashCount: %param2% ¦ Action: %param5%"
    Service Control Manager/7045: "Svc: %ServiceName% ¦ Path: %ImagePath% ¦ Acct: %AccountName% ¦ StartType: %StartType%"
    Microsoft-Windows-Windows Firewall With Advanced Security/2003: "Profile: %Profiles% ¦ Type: %SettingType% ¦ Value: %SettingValueString% ¦ User: %ModifyingUser% ¦ App: %ModifyingApplication%"
    Microsoft-Windows-Windows Firewall With Advanced Security/2004: "RuleName: %RuleName% ¦ App: %ApplicationPath% ¦ ModifyingApp: %ModifyingApplication% ¦ User: %ModifyingUser% ¦ Svc: %ServiceName% ¦ Protocol: %Protocol% ¦ LocalAddr: %LocalAddresses% ¦ LocalPort: %LocalPorts% ¦ RemoteAddr: %RemoteAddresses% ¦ RemotePort: %RemotePorts% ¦ Action: %Action%"
    Microsoft-Windows-DNS-Server-Service/150: "DLL: %param1%"
    Microsoft-Windows-DNS-Server-Service/770: "Path: %param1% ¦ SrcComp: %param2%"
    MSExchange CmdletLogs/6: "Data: %Data%"
    Microsoft-Windows-Windows Defender/1013: "Time: %Timestamp% ¦ User: %User%"
    Microsoft-Windows-Windows Defender/1116: "Threat: %ThreatName% ¦ Severity: %SeverityName% ¦ Type: %CategoryName% ¦ User: %DetectionUser% ¦ Path: %Path% ¦ Proc: %WindowsDefenderProcessName%"
    Microsoft-Windows-PrintService/301: "DeletedPrinter: %Param1%"
    Microsoft-Windows-PrintService/302: "PrinterDeletionPending: %PrinterDeletionPending%"
    Microsoft-Windows-PrintService/823: "OldDefaultPrinter: %OldDefaultPrinter% ¦ NewDefaultPrinter: %NewDefaultPrinter% ¦ Status: %Status% ¦ Module: %Module%"
    Microsoft-Windows-PrintService/848: "PrinterName: %PrinterName% ¦ ShareName: %ShareName%"
    Microsoft-Windows-PrintService/849: "PrinterName: %PrinterName% ¦ ShareName: %ShareName%"
    Microsoft-Windows-PrintService/354: "Printer: %Param1% ¦ DLL: %Param2% ¦ Error: %Param3%"
    Microsoft-Windows-PrintService/300: "PrinterCreated: %PrinterCreated%"
    Microsoft-Windows-WMI-Activity/5859: "Namespace: %OperationEssStartedNamespaceName% ¦ Query: %UserDataQuery% ¦ SID: %OperationEssStartedUser% ¦ PID: %OperationEssStartedProcessid% ¦ Provider: %OperationEssStartedProvider% ¦ PossibleCause: %OperationEssStartedPossibleCause%"
    Microsoft-Windows-DriverFrameworks-UserMode/2003: "Device: %DvrFmwk2003InstanceId%"
    Microsoft-Windows-DriverFrameworks-UserMode/2102: "Device: %DvrFmwkInstanceId%"
    Microsoft-Windows-DriverFrameworks-UserMode/2100: "Device: %DvrFmwkInstanceId%"
    MsiInstaller/1034: "Product: %Data[1]% ¦ Ver: %Data[2]% ¦ Vendor: %Data[5]% ¦ Status: %Data[4]%"
    MsiInstaller/11724: "Product: %Data[1]%"
    Microsoft-Windows-Ntfs/98: "Drive: %DriveName% ¦ Device: %DeviceName%"

Sources:
# Evtx
  '*/windows/evtx/application':
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Application.evtx")
    channel:
      - Application

  dns_query_windows/evtx:
    query: |
      SELECT * FROM watch_evtx(filename=[
        ROOT + "/Microsoft-Windows-DNS-Client.evtx",
        ROOT + "/Microsoft-Windows-DNSServer.evtx"
      ])
    channel:
      - Microsoft-Windows-DNS Client/Operational

  dns_query/windows/evtx/dns_client:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-DNS Client Events%4Operational.evtx")
    channel:
      - Microsoft-Windows-DNS Client Events/Operational

  dns_query/windows/evtx/dns_server:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-DNSServer.evtx")
    channel:
      - DNS Server

  process_creation/windows/evtx/execution:
    query: |
      SELECT * FROM watch_evtx(filename=[
         ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx",
         ROOT + "/Security.evtx"
      ])
      WHERE System.EventID.Value = 1 OR System.EventID.Value = 4688

  '*/windows/evtx/msexchange-management':
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/MSExchange Management.evtx")
    channel:
      - MSExchange Management

  '*/windows/evtx/openssh':
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/OpenSSH%4Operational.evtx")
    channel:
      - OpenSSH/Operational

  '*/windows/evtx/powershell':
    query: |
      SELECT * FROM watch_evtx(filename=[
         ROOT + "/Microsoft-Windows-PowerShell%4Operational.evtx",
         ROOT + "/PowerShellCore%4Operational.evtx",
      ])
    channel:
      - Microsoft-Windows-PowerShell/Operational
      - PowerShellCore/Operational

  ps_classic_start/windows/evtx/powershell:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Windows PowerShell.evtx")
      WHERE System.EventID.Value = 400

  ps_classic_provider_start/windows/evtx/powershell:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Windows PowerShell.evtx")
      WHERE System.EventID.Value = 600

  '*/windows/evtx/powershell_classic':
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Windows PowerShell.evtx")
    channel:
      - Windows PowerShell

  ps_module/windows/evtx/powershell:
    query: |
      SELECT * FROM watch_evtx(filename=[
         ROOT + "/Microsoft-Windows-PowerShell%4Operational.evtx",
         ROOT + "/PowerShellCore%4Operational.evtx"
      ])
      WHERE System.EventID.Value = 4103

  ps_module/windows/*:
    query: |
      SELECT * FROM watch_evtx(filename=[
         ROOT + "/Microsoft-Windows-PowerShell%4Operational.evtx",
         ROOT + "/PowerShellCore%4Operational.evtx"
      ])
      WHERE System.EventID.Value = 4103

  ps_script/windows/evtx/powershell:
    query: |
      SELECT * FROM watch_evtx(filename=[
         ROOT + "/Microsoft-Windows-PowerShell%4Operational.evtx",
         ROOT + "/PowerShellCore%4Operational.evtx"
      ])
      WHERE System.EventID.Value = 4104

  ps_script/windows/*:
    query: |
      SELECT * FROM watch_evtx(filename=[
         ROOT + "/Microsoft-Windows-PowerShell%4Operational.evtx",
         ROOT + "/PowerShellCore%4Operational.evtx"
      ])
      WHERE System.EventID.Value = 4104

  '*/windows/evtx/security':
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Security.evtx")
    channel:
      - Security

  process_creation/windows/evtx/security:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Security.evtx")
      WHERE System.EventID.Value = 4688

  registry_set/windows/evtx/security:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Security.evtx")
      WHERE System.EventID.Value in (4657)

  '*/windows/evtx/sysmon':
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx")

  process_creation/windows/evtx/sysmon:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx")
      WHERE System.EventID.Value = 1

  create_remote_thread/windows/evtx/sysmon:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx")
      WHERE System.EventID.Value = 8

  registry_set/windows/evtx/sysmon:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx")
      WHERE System.EventID.Value in (12, 13, 14)

  pipe_created/windows/evtx/sysmon:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx")
      WHERE System.EventID.Value in (17, 18)

  file_event/windows/evtx/sysmon:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx")
      WHERE System.EventID.Value in (9, 11, 23, 26)

  dns_query/windows/evtx/sysmon:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx")
      WHERE System.EventID.Value = 22

  driver_load/windows/evtx/sysmon:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx")
      WHERE System.EventID.Value = 6

  image_load/windows/evtx/sysmon:
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx")
      WHERE System.EventID.Value = 7

  '*/windows/evtx/system':
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/System.evtx")
    channel:
      - System

  '*/windows/evtx/task_scheduler':
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-TaskScheduler%4Operational.evtx")
    channel:
      - Microsoft-Windows-TaskScheduler/Operational

  '*/windows/evtx/windefend':
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-Windows Defender%4Operational.evtx")
    channel:
      - Microsoft-Windows-Windows Defender/Operational

  'antivirus/windows/evtx/windefend':
    query: |
      SELECT * FROM watch_evtx(filename=ROOT + "/Microsoft-Windows-Windows Defender%4Operational.evtx")
    channel:
      - Microsoft-Windows-Windows Defender/Operational

# System Artifacts
  '*/windows/schtasks':
    query: |
      SELECT * FROM foreach(
        row={SELECT * FROM clock(period=SleepCounter)},
        query={SELECT * FROM Artifact.Windows.System.TaskScheduler()}
      )

  '*/windows/services':
    query: |
      SELECT * FROM foreach(
        row={SELECT * FROM clock(period=SleepCounter)},
        query={SELECT * FROM Artifact.Windows.System.Services()}
      )

  persistence/windows/services:
    query: |
      SELECT * FROM foreach(
        row={SELECT * FROM clock(period=SleepCounter)},
        query={SELECT * FROM Artifact.Windows.System.Services()}
      )

  process_creation/windows/execution:
    query: |
      SELECT * FROM foreach(
        row={SELECT * FROM clock(period=SleepCounter)},
        query={SELECT * FROM Artifact.Windows.Analysis.EvidenceOfExecution()}
      )


  webserver/windows/*:
    query: |
      SELECT * FROM foreach(
        row={SELECT * FROM clock(period=SleepCounter)},
        query={SELECT * FROM Artifact.Windows.Applications.IISLogs()}
      )


# Volatile Artifacts

  process_creation/windows/pslist:
    query: |
      LET P = SELECT *, process_tracker_get(id=Ppid).Data AS Data, hash(path=Exe) AS Hash FROM pslist()

      SELECT
          Name, CommandLine, Exe AS Image, Data.Exe AS ParentImage,
          process_tracker_get(id=Data.Ppid).Data.Exe AS GrandParentImage,
          Hash.MD5 AS MD5, Hash.SHA1 AS SHA1, Hash.SHA256 AS SHA256, Username
      FROM P

  image_load/windows/pslist:
    query: |
      LET q = SELECT *, process_tracker_get(id=GPPid).Data.Exe AS GrandParentImage FROM foreach(
        row={
            SELECT Pid, CommandLine, Exe AS Image,
                process_tracker_get(id=Ppid).Data AS P
            FROM pslist()},
        query={
            SELECT Image, CommandLine, P.Exe AS ParentImage,
                P.Ppid AS GPPid,
                ModuleName, ExePath AS ModulePath
            FROM modules(pid=Pid)}
      )

      SELECT * FROM foreach(
        row={SELECT * FROM clock(period=SleepCounter)},
        query=q
      )

  network_connection/windows/netstat:
    query: |
      LET nt = SELECT
          * , process_tracker_get(id=Pid) AS pt
      FROM netstat()

      LEt q = SELECT
          Laddr.IP as LocalIP, Laddr.Port AS LocalPort,
          Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort,
          Pid, TypeString AS Protocol, pt.Data.Exe AS Image,
          pt.Data.CommandLine as CommandLine,
          process_tracker_get(id=pt.Data.Ppid).Data.Exe AS ParentImage
      FROM nt

      SELECT * FROM foreach(
        row={SELECT * FROM clock(period=SleepCounter)},
        query=q
      )


QueryTemplate: |
   LET Rules <= SigmaRules || gunzip(string=base64decode(string="{{.Base64CompressedRules}}"))
   LET FieldMapping <= parse_json(data=gunzip(string=base64decode(string="{{.Base64FieldMapping}}")))
   LET DefaultDetails <= parse_json(data=gunzip(string=base64decode(string="{{.Base64DefaultDetailsLookup}}")))
   LET X = scope()

   SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp,
          System.Computer AS Computer,
          System.Channel AS Channel,
          System.EventID.Value AS EID,
          _Rule.Level AS Level,
          _Rule.Title AS Title,
          System.EventRecordID AS RecordID,
          Details,
          dict(System=System, EventData=X.EventData || X.UserData, Message=X.Message) AS _Event
    FROM sigma(
      rules=split(string= Rules, sep_string="\n---\n"),
      log_sources= LogSources, debug=Debug,
      default_details='''{{.Base64DefaultDetailsQuery}}''',
      rule_filter="x=>x.Level =~ RuleLevelRegex AND x.Status =~ RuleStatusRegex AND x.Title =~ RuleTitleFilter",
      field_mapping= FieldMapping)

BaseReferenceURL:
  https://github.com/Yamato-Security/hayabusa-rules/tree/main/

RuleDirectories:
  - hayabusa/hayabusa/builtin/
  - hayabusa/hayabusa/sysmon/
  - hayabusa/sigma/builtin/
  - hayabusa/sigma/builtin/sysmon