PowerShellMonitorSiEM/SecurityMonitor-Config.json at main · trigerman/PowerShellMonitorSiEM · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
{
  "EventIDs": {
    "Logon": [4624, 4625, 4648, 4672, 4627, 4634, 4647, 4768, 4769, 4771, 4776],
    "Process": [4688, 4689, 4696],
    "File": [4660, 4661, 4663, 4656, 4658, 4699, 4654, 4670],
    "Account": [4720, 4722, 4724, 4726, 4728, 4732, 4733, 4756, 4735, 4737, 4740, 4767, 4782],
    "Service": [7045, 4697, 7034, 7035, 7036, 7040],
    "Policy": [4719, 4738, 4904, 4905, 4907, 4912],
    "Network": [5156, 5157, 5158, 5159],
    "ScheduledTask": [4698, 4700, 4701, 4702],
    "ScheduledTaskOperational": [106, 140, 141, 200, 201],
    "PowerShell": [4103, 4104, 4105, 4106],
    "ObjectAccess": [4654, 4670, 4907],
    "Registry": [4657],
    "AD": [4662, 4742, 4780, 4781, 5136, 5137, 5138, 5139, 5141],
    "Kerberos": [4768, 4769, 4771, 4776],
    "LogClearing": [1102, 104],
    "Defender": [5001, 5004, 5007, 5010, 5012, 1116, 1117]
  },
  "SysmonEventIDs": [1, 3, 5, 7, 8, 10, 11, 12, 13, 15, 17, 18, 22, 23, 25],
  "SuspiciousProcesses": [
    "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe",
    "bitsadmin.exe", "wmic.exe", "schtasks.exe", "at.exe",
    "msiexec.exe", "installutil.exe", "regasm.exe", "regsvcs.exe",
    "msbuild.exe", "cmstp.exe", "msxsl.exe", "nltest.exe",
    "esentutl.exe", "expand.exe", "extrac32.exe",
    "net.exe", "net1.exe", "whoami.exe", "hostname.exe",
    "systeminfo.exe", "tasklist.exe", "sc.exe", "reg.exe",
    "bcdedit.exe", "vssadmin.exe", "wbadmin.exe", "ntdsutil.exe",
    "procdump.exe", "procdump64.exe", "mimikatz.exe",
    "psexec.exe", "psexec64.exe", "rubeus.exe", "sharphound.exe",
    "bloodhound.exe", "lazagne.exe", "sekurlsa.exe", "covenant.exe",
    "chisel.exe", "plink.exe", "ncat.exe", "socat.exe"
  ],
  "SuspiciousDNSPatterns": [
    "\\.xyz$", "\\.top$", "\\.tk$", "\\.ml$", "\\.ga$", "\\.cf$",
    "\\.onion\\.", "pastebin\\.com", "raw\\.githubusercontent\\.com",
    "ngrok\\.io", "dnslog\\.cn", "burpcollaborator\\.net",
    "interact\\.sh", "requestbin\\.net", "webhook\\.site"
  ],
  "WMIWhitelist": ["SCM Event Log Filter", "SCM Event Log Consumer", "BVTFilter"],
  "NoiseFilters": {
    "Users": ["SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE", "SERVICE"],
    "Paths": ["SRU.chk", "LogFiles", "wbem", "Microsoft\\\\Windows\\\\PowerShell", "Microsoft\\\\Windows\\\\AppReadiness"],
    "ProcessPaths": [],
    "EventIDExclusions": []
  },
  "BruteForceThreshold": 5,
  "LookbackMinutes": 5,
  "MinSeverity": 4,
  "SystemName": "AUTO",
  "Domain": "YOURORG.COM"
}