mthcht
commented
7 months ago for the real telemetry logs that is continuously logged (they have a similar format but we only have 3 categories: process, network and authentication):
process sample:
Windows
```
{
"parent_integrity_level": "Medium",
"tenant": "[REDACTED]",
"fake_ppid": 0,
"signed": true,
"ancestors": "C:\\Program Files
(x86)\\Microsoft\\Edge\\Application\\msedge.exe|C:\\Windows\\explorer.exe|C:\\Windows\\System32\\userinit.exe|C:\\Windows\\System32\\winlogon.exe",
"pe_timestamp": "2023-12-07T03:32:10.000Z",
"process_name": "msedge.exe",
"parent_image": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
"groups": [
{
"id": "[REDACTED]",
"name": "[REDACTED]_Workstations_Windows"
}
],
"grandparent_integrity_level": "Medium",
"size": 3788736,
"@version": "1",
"session": 1,
"usersid": "[REDACTED]",
"process_unique_id": "[REDACTED]",
"grandparent_image": "C:\\Windows\\explorer.exe",
"pe_imphash": "EA4CA1F8E3B3D9373D39C13FD1348A63",
"fake_parent_commandline": "",
"image_name": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
"logonid": 1620357,
"ppid": 15836,
"fake_parent_image": "",
"agent": {
"domain": null,
"distroid": null,
"dnsdomainname": "lab.thunting.io",
"agentid": "[REDACTED]",
"osversion": "10.0.19045",
"ostype": "windows",
"hostname": "PKYRLAB01278",
"domainname": "thunting",
"additional_info": null,
"version": "3.2.5",
"osproducttype": "Windows 10 Pro"
},
"pe_info": {
"file_version": "120.0.2210.61",
"product_version": "120.0.2210.61",
"file_description": "Microsoft Edge",
"product_name": "Microsoft Edge",
"company_name": "Microsoft Corporation",
"legal_copyright": "Copyright Microsoft Corporation. All rights reserved.",
"pe_timestamp": "2023-12-07T03:32:10.000Z",
"internal_name": "msedge_exe",
"original_filename": "msedge.exe"
},
"signature_info": {
"signed_catalog": false,
"root_info": {
"thumbprint_sha256": "847df6a78497943f27fc72eb93f9a637320a02b561d0a91b09e87a7807ed7c61",
"display_name": "Microsoft Root Certificate Authority 2011",
"thumbprint": "8f43288ad272f3103b6fb1428485ea3014c0bcfe",
"issuer_name": "Microsoft Root Certificate Authority 2011",
"serial_number": "3f8bc8b5fc9fb29643b569d66c42e144"
},
"signer_info": {
"thumbprint_sha256": "36305d4ddfd4756d17fcdfb742fd2031a3d5133bce34bd8e3080bc803ae44d0b",
"display_name": "Microsoft Corporation",
"thumbprint": "05a822642cf64464460cb4684ff11c7f476873ca",
"issuer_name": "Microsoft Code Signing PCA 2011",
"serial_number": "33000003a54111e8f07fbe0b750000000003a5"
},
"signed_authenticode": true
},
"@event_create_date": "2023-12-15T08:04:10.672Z",
"parent_commandline": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --no-startup-window
--win-session-start",
"integrity_level": "Medium",
"commandline": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --flag-switches-begin
--flag-switches-end --no-startup-window",
"hashes": {
"md5": "47fc8f5fb47abf51cd14cf9c83c6e019",
"sha1": "564af8862fdf147d43c0b6dd02d1c2f7dac40ed2",
"sha256": "1448d70a502e2a605f25751bb0b73f35667ce374393f87a1871b7ed733768899"
},
"grandparent_commandline": "C:\\WINDOWS\\Explorer.EXE",
"current_directory": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\",
"@timestamp": "2023-12-15T08:04:17.393736Z",
"pe_timestamp_int": 1701919930,
"log_type": "process",
"pid": 8816,
"parent_unique_id": "[REDACTED]",
"log_platform_flag": 0,
"username": "LAB\\mthcht"
}
```
Linux
```
{
"ppid": 768,
"process_name": "ps",
"grandparent_image": "/opt/gitlab/embedded/bin/ruby",
"group": "git",
"@timestamp": "2023-12-15T08:35:34.287697Z",
"process_unique_id": "[REDACTED]",
"log_platform_flag": 0,
"log_type": "process",
"commandline": "ps -o rss= -p 768",
"uid": 997,
"suid": 997,
"size": 133432,
"@event_create_date": "2023-12-15T08:35:15.000Z",
"pid": 172951,
"sgroup": "git",
"hashes": {
"md5": "76b16779348e260bf0e41c84f9b37e6a",
"sha256": "f7bcd10b455d762ec803fab47031f38ebe3042ea5a91a0d655a98d7a83d6c466",
"sha1": "206dcc1b639d79278ca32560f2d906fabff41f09"
},
"egid": 997,
"groups": [
{
"id": "[REDACTED]",
"name": "[REDACTED]_Workstation_Linux_Prod"
}
],
"image_name": "/usr/bin/ps",
"gid": 997,
"euid": 997,
"username": "git",
"eusername": "git",
"parent_unique_id": "[REDACTED]",
"agent": {
"distroid": "debian",
"osproducttype": "Debian GNU/Linux 10 (buster)",
"hostname": "abfgioappli",
"osversion": "4.19.0-18-amd64",
"additional_info": null,
"domainname": null,
"dnsdomainname": null,
"domain": null,
"ostype": "linux",
"version": "3.2.5",
"agentid": "[REDACTED]"
},
"current_directory": "/opt/gitlab/embedded/service/gitlab-rails/",
"susername": "git",
"tenant": "[REDACTED]",
"grandparent_commandline": "ruby /opt/gitlab/embedded/service/gitlab-rails/bin/sidekiq-cluster -e production -r /opt/gitlab/embedded/service/gitlab-rails -m 50 --timeout 25 *",
"sgid": 997,
"egroup": "git",
"ancestors": "/opt/gitlab/embedded/bin/ruby|/opt/gitlab/embedded/bin/ruby|/opt/gitlab/embedded/bin/runsv|/opt/gitlab/embedded/bin/runsvdir|/usr/lib/systemd/systemd",
"parent_commandline": "sidekiq 6.2.2 queues:authorized_project_update:authorized_project_update_project_create,authorized_project_update:authorized_project_update_project_group_link_create,authorized_project_update:authorized_project_update_project_recalculate,authorized_project_update:authorized_project_update_project_recalculate_per_user,authorized_project_update:authorized_project_update_user_refresh_from_replica,authorized_project_update:authorized_project_update_user_refresh_over_user_range,authorized_project_update:authorized_project_update_user_refresh_with_low_urgency,auto_devops:auto_devops_disable,auto_merge:auto_merge_process,chaos:chaos_cpu_spin,chaos:chaos_db_spin,chaos:chaos_kill,chaos:chaos_leak_mem,chaos:chaos_sleep,container_repository:cleanup_container_repository,container_repository:container_expiration_policies_cleanup_container_repository,container_repository:delete_container_repository,cronjob:admin_email,cronjob:analytics_usage_trends_count_job_trigger,cronjob:authorized_project_update_periodic_recalculate...",
"@version": "1",
"parent_image": "/opt/gitlab/embedded/bin/ruby"
}
```
network samples:
IP
```
{
"agent": {
"distroid": null,
"osproducttype": "Windows 10 Pro",
"hostname": "PKYRLAB01378",
"osversion": "10.0.19045",
"additional_info": null,
"domainname": "thunting",
"dnsdomainname": "lab.thunting.io",
"domain": null,
"ostype": "windows",
"version": "3.2.5",
"agentid": "[REDACTED]"
},
"image_name": "C:\\Users\\mthcht\\AppData\\Local\\CiscoSparkLauncher\\CiscoCollabHost.exe",
"@timestamp": "2023-12-15T08:35:52.205452Z",
"username": "LAB\\mthcht",
"process_unique_id": "[REDACTED]",
"initiated": true,
"tenant": "[REDACTED]",
"log_type": "network",
"event_id": [
3,
3
],
"direction": "out",
"conn_type": 0,
"saddr": "192.168.12.19",
"dport": 443,
"sport": 62026,
"pid": 16568,
"is_ipv6": false,
"@version": "1",
"@event_create_date": "2023-12-15T08:35:15.829Z",
"daddr": "170.72.238.121",
"groups": [
{
"id": "[REDACTED]",
"name": "[REDACTED]_Workstations_Windows"
}
]
}
```
DNS
```
{
"agent": {
"domain": null,
"distroid": null,
"dnsdomainname": "lab.thunting.io",
"agentid": "[REDACTED]",
"osversion": "10.0.22621",
"ostype": "windows",
"hostname": "PKYRLAB01478",
"domainname": "thunting",
"additional_info": null,
"version": "3.2.5",
"osproducttype": "Windows 11 Pro"
},
"@event_create_date": "2023-12-15T08:35:15.718000+00:00",
"status": "success",
"tenant": "[REDACTED]",
"raw_windows_resolver_results": "::ffff:172.217.20.170;",
"query_type": "AAAA",
"groups": [
{
"id": "[REDACTED]",
"name": "[REDACTED]_Workstations_Windows"
}
],
"requested_name": "signaler-pa.clients6.google.com",
"@version": "1",
"process_image_path": "C:\\Program Files\\Mozilla Firefox\\firefox.exe",
"process_unique_id": "[REDACTED]",
"@timestamp": "2023-12-15T08:36:02.423041Z",
"ip_addresses": [
"172.217.20.170"
],
"log_type": "dns_resolution",
"pid": 16000,
"username": "LAB\\mthcht"
}
```
authentication samples:
```
{
"destination": "syslog",
"@timestamp": "2023-12-15T08:35:18.404738Z",
"log_name": "Security",
"thread_id": 49060,
"log_type": "eventlog",
"event_id": 4624,
"@event_create_date": "2023-12-15T08:35:14.637Z",
"computer_name": "SRVCXWIN2P1.lab.thunting.io",
"groups": [
{
"id": "[REDACTED]",
"name": "[REDACTED]_Workstations_Windows"
}
],
"agent": {
"distroid": null,
"osproducttype": "Windows Server 2019 Standard",
"hostname": "SRVCXWIN2P1",
"osversion": "10.0.17763",
"additional_info": null,
"domainname": "thunting",
"dnsdomainname": "lab.thunting.io",
"domain": null,
"ostype": "windows",
"version": "3.2.5",
"agentid": "[REDACTED]"
},
"source_name": "Microsoft-Windows-Security-Auditing",
"keywords": [
"AuditSuccess",
"ReservedKeyword63"
],
"process_id": 1760,
"provider_guid": "54849625-5478-4994-a5ba-3e3b0328c30d",
"user_data": {},
"tenant": "[REDACTED]",
"@version": "1",
"record_number": 159433927,
"type": "wineventlog",
"level": "log_always",
"event_data": {
"LmPackageName": "NTLM V1",
"KeyLength": "128",
"LogonType": "3",
"SubjectUserSid": "S-1-0-0",
"AuthenticationPackageName": "NTLM",
"TransmittedServices": "-",
"TargetDomainName": "thunting",
"ElevatedToken": "%%1842",
"SubjectUserName": "-",
"SubjectDomainName": "-",
"TargetOutboundUserName": "-",
"TargetUserSid": "[REDACTED]",
"VirtualAccount": "%%1843",
"IpPort": "63481",
"SubjectLogonId": "0x0",
"LogonProcessName": "NtLmSsp",
"LogonGuid": "{00000000-0000-0000-0000-000000000000}",
"TargetLogonId": "0x6d0fec05",
"ProcessId": "0x0",
"ProcessName": "-",
"ImpersonationLevel": "%%1833",
"IpAddress": "10.0.0.62",
"TargetUserName": "mthcht",
"WorkstationName": "SRVCXWIN2P1",
"TargetLinkedLogonId": "0x0",
"TargetOutboundDomainName": "-",
"RestrictedAdminMode": "-"
},
"user": {
"domain": "",
"name": "",
"identifier": "",
"type": "unknown"
}
}
```
@tsale I changed the PR, when an alert is triggered for a specific event, but there are no available telemetry logs to support it (for instance, an 'image loaded' event is only logged as an alert when a threat is identified, without continuous telemetry tracking for image loading), I categorize the telemetry as 'No'.
tsale
HarfangLab
Description
Please provide the below information so we can validate before merging:
sanitized logs samples:
Process Creation
alert_subtype=process alert_type=sigma log_type=alert
signature="Discovery: Ipconfig"
Process Access
alert_subtype=process alert_type=sigma log_type=alert
signature="LSASS process memory access from unknown module"
Image\/Library Loaded + Driver Loaded
alert_subtype=process alert_type=sigma log_type=alert
signature="LSASS.exe Loads Unsigned DLL"
signature="IOC driver check"
File Manipulation + File Modification + File Creation
signature="File Added/Modified In Startup Directory"
signature="Kerberos Ticket File Exported to Disk"
Local Account Creation + Script-Block Activity
signature="Local User Created via PowerShell"
signature="Powershell: Local User Creation"
Registry Activity
signature="Registry Autorun Key" and other signatures
Key\/Value Modification
signature=Windows Defender Exclusion List Modified
Scheduled Task Creation
signature="Scheduled Task Created in Temporary Directory"
Type of change
Please delete options that are not relevant.
How Has This Been Tested?
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration.
Test Configuration: default
Checklist:
Don't stress yourself out, just answer the above to the best of your ability and we can discuss in the comments 🙂