X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?p=ossec-hids.git;a=blobdiff_plain;f=etc%2Frules%2Fsysmon_rules.xml;fp=etc%2Frules%2Fsysmon_rules.xml;h=32714984b9611f615ce79a39bc6b29e46f94758e;hp=0000000000000000000000000000000000000000;hb=3f728675941dc69d4e544d3a880a56240a6e394a;hpb=927951d1c1ad45ba9e7325f07d996154a91c911b diff --git a/etc/rules/sysmon_rules.xml b/etc/rules/sysmon_rules.xml new file mode 100644 index 0000000..3271498 --- /dev/null +++ b/etc/rules/sysmon_rules.xml @@ -0,0 +1,173 @@ + + + + + + + + + 18100 + svchost.exe + Sysmon - Suspicious Process - svchost.exe + + + + 18501 + \services.exe + Sysmon - Legitimate Parent Image - svchost.exe + + + + + 18100 + lsm.exe + Sysmon - Suspicious Process - lsm.exe + + + + 18511 + wininit.exe + Sysmon - Legitimate Parent Image - lsm.exe + + + + 18100 + lsm.exe + Sysmon - Suspicious Process - lsm.exe is a Parent Image + + + + + 18100 + csrss.exe + Sysmon - Suspicious Process - csrss.exe + + + + 18521 + smss.exe + Sysmon - Legitimate Parent Image - csrss.exe + + + + + 18100 + lsass.exe + Sysmon - Suspicious Process - lsass + + + + 18531 + wininit.exe + Sysmon - Legitimate Parent Image - lsass.exe + + + + 18100 + lsass.exe + Sysmon - Suspicious Process - lsass.exe is a Parent Image + + + + + 18100 + winlogon.exe + Sysmon - Suspicious Process - winlogon.exe + + + + 18541 + smss.exe + Sysmon - Legitimate Parent Image - winlogon.exe + + + + + 18100 + wininit.exe + Sysmon - Suspicious Process - wininit + + + + 18551 + smss.exe + Sysmon - Legitimate Parent Image - wininit.exe + + + + + 18100 + smss.exe + Sysmon - Suspicious Process - smss.exe + + + + 18561 + system + Sysmon - Legitimate Parent Image - smss.exe + + + + + 18100 + taskhost.exe + Sysmon - Suspicious Process - taskhost.exe + + + + 18571 + services.exe|svchost.exe + Sysmon - Legitimate Parent Image - taskhost.exe + + + + + 18100 + /services.exe + Sysmon - Suspicious Process - services.exe + + + + 18581 + wininit.exe + Sysmon - Legitimate Parent Image - services.exe + + + + + 18100 + dllhost.exe + Sysmon - Suspicious Process - dllhost.exe + + + + 18591 + svchost.exe|services.exe + Sysmon - Legitimate Parent Image - dllhost.exe + + + + + 18100 + \explorer.exe + Sysmon - Suspicious Process - explorer.exe + + + + 18601 + userinit.exe + Sysmon - Legitimate Parent Image - explorer.exe + + + +