attack_relationships.yml

- relationship_id: REL-2022-0001
  name: User attempted to authenticate from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Reid Gilman @reidgilman
  - Olaf Hartong @olafhartong
  attack:
    data_source: user account
    data_component: user account authentication
  behavior:
    source: user
    relationship: attempted to authenticate from
    target: port
  security_events:
  - event_id: '4624'
    name: An account was successfully logged on.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '2'
  - event_id: '4625'
    name: An account failed to log on.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Account Lockout
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4648'
    name: A logon was attempted using explicit credentials.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceLogonEvents
    name: DeviceLogonEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: LogonSuccess
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
  notes: null
- relationship_id: REL-2022-0002
  name: User created User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: user account
    data_component: user account creation
  behavior:
    source: user
    relationship: created
    target: user
  security_events:
  - event_id: '4720'
    name: A user account was created.
    platform: windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4741'
    name: A computer account was created.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Computer Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: UserAccountCreated
    event_version:
    - '0'
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4741
  notes: null
- relationship_id: REL-2022-0003
  name: User modified User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: user account
    data_component: user account modification
  behavior:
    source: user
    relationship: modified
    target: user
  security_events:
  - event_id: '4738'
    name: A user account was changed.
    platform: windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4781'
    name: The name of an account was changed.
    platform: windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4742'
    name: A computer account was changed.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Computer Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: UserAccountModified
    event_version:
    - '0'
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4781
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4742
  notes: null
- relationship_id: REL-2022-0004
  name: User terminated Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: process
    data_component: process termination
  behavior:
    source: user
    relationship: terminated
    target: process
  security_events:
  - event_id: '4689'
    name: A process has exited.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: Process Termination
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '5'
    name: Process terminated.
    platform: windows
    audit_category: ProcessTerminate
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '5'
    name: Process terminated.
    platform: linux
    audit_category: ProcessTerminate
    log_source: sysmon
    event_version:
    - '4.81'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4689
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-5-process-terminated
  notes: null
- relationship_id: REL-2022-0006
  name: User accessed Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Olaf Hartong @olafhartong
  attack:
    data_source: process
    data_component: process access
  behavior:
    source: user
    relationship: accessed
    target: process
  security_events:
  - event_id: '4663'
    name: An attempt was made to access an object.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Kernel Object
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Process
    event_version:
    - '1'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: OpenProcessApiCall
    event_version:
    - '0'
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Potential contribution for ATT&CK - Process / process access
  - Event 4663, this event generates only if object's SACL has required ACE to handle
    specific access right use.
- relationship_id: REL-2022-0007
  name: Process connected from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected from
    target: port
  security_events:
  - event_id: '5156'
    name: The Windows Filtering Platform has permitted a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: InboundConnectionAccepted
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0008
  name: User retrieved information about Firewall
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall metadata
  behavior:
    source: user
    relationship: retrieved information about
    target: firewall
  security_events:
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: DescribeFirewall
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: DescribeFirewallPolicy
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  references: null
  notes: null
- relationship_id: REL-2022-0009
  name: User locked User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: user account
    data_component: user account modification
  behavior:
    source: user
    relationship: locked
    target: user
  security_events:
  - event_id: '4740'
    name: A user account was locked out.
    platform: windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4740
  notes: null
- relationship_id: REL-2022-0046
  name: User created logon from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: logon session
    data_component: logon session creation
  behavior:
    source: user
    relationship: created logon from
    target: ip
  security_events:
  - event_id: '4624'
    name: An account was successfully logged on.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '2'
  - event_id: '4778'
    name: A session was reconnected to a Window Station.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Other Logon/Logoff Events
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceLogonEvents
    name: DeviceLogonEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: LogonSuccess
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4778
  notes: null
- relationship_id: REL-2022-0012
  name: Process attempted connection to Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted connection to
    target: port
  security_events:
  - event_id: '5157'
    name: The Windows Filtering Platform has blocked a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ConnectionAttempt
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
  notes: null
- relationship_id: REL-2022-0048
  name: Process accessed Registry
  contributors:
  - Reid Gilman @reidgilman
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: windows registry
    data_component: windows registry key access
  behavior:
    source: process
    relationship: accessed
    target: registry
  security_events:
  - event_id: '4663'
    name: An attempt was made to access an object.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Key
    event_version:
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Event 4663 includes the following caveat \"This event generates only if object\u2019\s
    SACL has required ACE to handle specific access right use.\"
- relationship_id: REL-2022-0014
  name: User loaded Module
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Olaf Hartong @olafhartong
  attack:
    data_source: module
    data_component: module load
  behavior:
    source: user
    relationship: loaded
    target: module
  security_events:
  - event_id: '7'
    name: Image loaded.
    platform: windows
    audit_category: ImageLoad
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: DeviceImageLoadEvents
    name: DeviceImageLoadEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ImageLoaded
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-7-image-loaded
  notes:
  - Potential contribution for ATT&CK - Module / module load
- relationship_id: REL-2022-0015
  name: User requested access to AD Object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: active directory
    data_component: active directory object access
  behavior:
    source: user
    relationship: requested access to
    target: ad object
  security_events:
  - event_id: '4661'
    name: A handle to an object was requested.
    platform: windows
    audit_category: DS Access
    audit_sub_category: Directory Service Access
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661
  notes: null
- relationship_id: REL-2022-0017
  name: Process connected to Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected to
    target: ip
  security_events:
  - event_id: '5156'
    name: The Windows Filtering Platform has permitted a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ConnectionSuccess
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0102
  name: Process deleted Registry
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: windows registry
    data_component: windows registry key deletion
  behavior:
    source: process
    relationship: deleted
    target: registry
  security_events:
  - event_id: '12'
    name: RegistryEvent (Object create and delete).
    platform: windows
    audit_category: RegistryEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryValueDeleted
    event_version:
    - '0'
    - '1'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryKeyDeleted
    event_version:
    - '0'
    - '1'
  - event_id: '4657'
    name: A registry value was modified.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ActionType: Registry value deleted
    event_version:
    - '0'
  - event_id: '4660'
    name: An object was deleted.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete
  notes:
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=Registry value deleted" to look for deletions.
- relationship_id: REL-2022-0018
  name: User executed Command
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: command
    data_component: command execution
  behavior:
    source: user
    relationship: executed
    target: command
  security_events:
  - event_id: '4688'
    name: A new process has been created.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: Process Creation
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '2'
  - event_id: '1'
    name: Process Creation.
    platform: windows
    audit_category: ProcessCreate
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '4103'
    name: Module logging.
    platform: windows
    channel: Microsoft-Windows-PowerShell/Operational
    log_source: Microsoft-Windows-PowerShell
    event_version:
    - '1'
  - event_id: DeviceProcessEvents
    name: DeviceProcessEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ProcessCreated
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation
  notes: null
- relationship_id: REL-2022-0019
  name: User unlocked User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: user account
    data_component: user account modification
  behavior:
    source: user
    relationship: unlocked
    target: user
  security_events:
  - event_id: '4767'
    name: A user account was unlocked.
    platform: windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4767
  notes: null
- relationship_id: REL-2022-0020
  name: Process deleted File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: file
    data_component: file deletion
  behavior:
    source: process
    relationship: deleted
    target: file
  security_events:
  - event_id: '23'
    name: File Delete archived.
    platform: windows
    audit_category: FileDelete
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '23'
    name: File Delete archived.
    platform: linux
    audit_category: FileDelete
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: '26'
    name: File Delete logged.
    platform: windows
    audit_category: FileDeleteDetected
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '4660'
    name: An object was deleted.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4663'
    name: An attempt was made to access an object.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: DeviceFileEvents
    name: DeviceFileEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FileDeleted
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-23-filedelete-file-delete-archived
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-26-filedeletedetected-file-delete-logged
- relationship_id: REL-2022-0074
  name: Device blocked connection from Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: blocked connection from
    target: process
  security_events:
  - event_id: '5157'
    name: The Windows Filtering Platform has blocked a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
  notes: null
- relationship_id: REL-2022-0024
  name: User enabled User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: user account
    data_component: user account modification
  behavior:
    source: user
    relationship: enabled
    target: user
  security_events:
  - event_id: '4722'
    name: A user account was enabled.
    platform: windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: UserAccountModified
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4722
  notes: null
- relationship_id: REL-2022-0025
  name: Firewall Rule added
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall rule modification
  behavior:
    source: firewall rule
    relationship: modified
    target: null
  security_events:
  - event_id: '4947'
    name: A change has been made to Windows Firewall exception list. A rule was modified.
    platform: windows
    audit_category: Policy Change
    audit_sub_category: MPSSVC Rule-Level Policy Change
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4947
  notes: null
- relationship_id: REL-2022-0026
  name: User modified Cloud service
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: cloud service
    data_component: cloud service modification
  behavior:
    source: user
    relationship: modified
    target: cloud service
  security_events:
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: UpdateTrail
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  references: null
  notes: null
- relationship_id: REL-2022-0029
  name: Process terminated
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: process
    data_component: process metadata
  behavior:
    source: process
    relationship: terminated
    target: null
  security_events:
  - event_id: '5'
    name: Process terminated.
    platform: windows
    audit_category: ProcessTerminate
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '5'
    name: Process terminated.
    platform: linux
    audit_category: ProcessTerminate
    log_source: sysmon
    event_version:
    - '4.81'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-5-process-terminated
  notes: null
- relationship_id: REL-2022-0030
  name: User created Scheduled job
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: scheduled job
    data_component: scheduled job creation
  behavior:
    source: user
    relationship: created
    target: scheduled job
  security_events:
  - event_id: '4698'
    name: A scheduled task was created.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ScheduledTaskCreated
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698
  notes: null
- relationship_id: REL-2022-0032
  name: User listed Firewall rule
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall enumeration
  behavior:
    source: user
    relationship: listed
    target: firewall rule
  security_events:
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: ListRuleGroups
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  references: null
  notes: null
- relationship_id: REL-2022-0034
  name: User deleted Scheduled job
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: scheduled job
    data_component: scheduled job deletion
  behavior:
    source: user
    relationship: deleted
    target: scheduled job
  security_events:
  - event_id: '4699'
    name: A scheduled task was deleted.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ScheduledTaskDeleted
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699
  notes: null
- relationship_id: REL-2022-0035
  name: Firewall disabled
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Ruben Bouman @rubinatorz
  attack:
    data_source: firewall
    data_component: firewall disable
  behavior:
    source: firewall
    relationship: disabled
    target: null
  security_events:
  - event_id: '5025'
    name: The Windows Firewall Service has been stopped.
    platform: windows
    audit_category: System
    audit_sub_category: Other System Events
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '5034'
    name: The Windows Firewall Driver was stopped.
    platform: windows
    audit_category: System
    audit_sub_category: Other System Events
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5025
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5034
  notes: null
- relationship_id: REL-2022-0036
  name: Process requested access to File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: file
    data_component: file access
  behavior:
    source: process
    relationship: requested access to
    target: file
  security_events:
  - event_id: '4656'
    name: A handle to an object was requested.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: File
    event_version:
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
  notes: null
- relationship_id: REL-2022-0037
  name: User created Group
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: group
    data_component: group creation
  behavior:
    source: user
    relationship: created
    target: group
  security_events:
  - event_id: '4727'
    name: A security-enabled global group was created.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4731'
    name: A security-enabled local group was created.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4754'
    name: A security-enabled universal group was created.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-group-management
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4731
  notes: null
- relationship_id: REL-2022-0038
  name: Process removed Firewall rule
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall rule modification
  behavior:
    source: process
    relationship: removed
    target: firewall rule
  security_events:
  - event_id: '2006'
    name: A rule has been deleted in the Windows Defender Firewall exception list
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version:
    - '0'
  references: null
  notes: null
- relationship_id: REL-2022-0041
  name: User modified File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: file
    data_component: file modification
  behavior:
    source: user
    relationship: modified
    target: file
  security_events:
  - event_id: '4670'
    name: Permissions on an object were changed.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceFileEvents
    name: DeviceFileEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FileModified
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670
  notes: null
- relationship_id: REL-2022-0042
  name: User granted acess to User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: user account
    data_component: user account modification
  behavior:
    source: user
    relationship: granted access to
    target: user
  security_events:
  - event_id: '4717'
    name: System security access was granted to an account.
    platform: windows
    audit_category: Policy Change
    audit_sub_category: Authentication Policy Change
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4717
  notes: null
- relationship_id: REL-2022-0043
  name: User created File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Ruben Bouman @rubinatorz
  - Olaf Hartong @olafhartong
  attack:
    data_source: file
    data_component: file creation
  behavior:
    source: user
    relationship: created
    target: file
  security_events:
  - event_id: '11'
    name: FileCreate.
    platform: linux
    audit_category: FileCreate
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceFileEvents
    name: DeviceFileEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FileCreated
    event_version:
    - '0'
    - '1'
  - event_id: '4663'
    name: An attempt was made to access an object.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Event 4663 includes the following caveat "This event generates only if object's
    SACL has required ACE to handle specific access right use".
  - Event ID 4663 logs attempts of accesses to objects. Look for file creations by
    searching for "Accesses=WriteData".
- relationship_id: REL-2022-0044
  name: User enabled Drive
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: drive
    data_component: drive modification
  behavior:
    source: user
    relationship: enabled
    target: drive
  security_events:
  - event_id: '6422'
    name: A device was enabled.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6422
  notes: null
- relationship_id: REL-2022-0045
  name: User deleted Group
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: group
    data_component: group deletion
  behavior:
    source: user
    relationship: deleted
    target: group
  security_events:
  - event_id: '4730'
    name: A security-enabled global group was deleted.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4734'
    name: A security-enabled local group was deleted.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4758'
    name: A security-enabled universal group was deleted.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-group-management
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4734
  notes: null
- relationship_id: REL-2022-0059
  name: User created logon from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: logon session
    data_component: logon session creation
  behavior:
    source: user
    relationship: created logon from
    target: port
  security_events:
  - event_id: '4624'
    name: An account was successfully logged on.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '2'
  - event_id: DeviceLogonEvents
    name: DeviceLogonEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: LogonSuccess
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
  notes: null
- relationship_id: REL-2022-0049
  name: Firewall enabled
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall metadata
  behavior:
    source: firewall
    relationship: enabled
    target: null
  security_events:
  - event_id: '5024'
    name: The Windows Firewall Service has started successfully.
    platform: windows
    audit_category: System
    audit_sub_category: Other System Events
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5024
  notes:
  - Potential contribution for ATT&CK - Firewall / firewall enable
- relationship_id: REL-2022-0077
  name: User accessed Registry
  contributors:
  - Reid Gilman @reidgilman
  attack:
    data_source: windows registry
    data_component: windows registry key access
  behavior:
    source: user
    relationship: accessed
    target: registry
  security_events:
  - event_id: '4663'
    name: An attempt was made to access an object.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Key
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Event 4663 includes the following caveat "This event generates only if object's
    SACL has required ACE to handle specific access right use".
- relationship_id: REL-2022-0051
  name: Process connected from Host
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected from
    target: host
  security_events:
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: InboundConnectionAccepted
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0053
  name: User attempted to disable Drive
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: drive
    data_component: drive modification
  behavior:
    source: user
    relationship: attempted to disable
    target: drive
  security_events:
  - event_id: '6419'
    name: A request was made to disable a device.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6419
  notes: null
- relationship_id: REL-2022-0090
  name: Device permitted listener on Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: permitted listener on
    target: ip
  security_events:
  - event_id: '5154'
    name: The Windows Filtering Platform has permitted an application or service to
      listen on a port for incoming connections.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154
  notes: null
- relationship_id: REL-2022-0056
  name: Process attempted connection to Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted connection to
    target: ip
  security_events:
  - event_id: '5157'
    name: The Windows Filtering Platform has blocked a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ConnectionAttempt
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
  notes: null
- relationship_id: REL-2022-0057
  name: User connected to Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected to
    target: ip
  security_events:
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ConnectionSuccess
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0084
  name: Device blocked port bind on Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: blocked port bind on
    target: process
  security_events:
  - event_id: '5159'
    name: The Windows Filtering Platform has blocked a bind to a local port.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5159
  notes: null
- relationship_id: REL-2022-0060
  name: Process connected to Pipe
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Ruben Bouman @rubinatorz
  attack:
    data_source: named pipe
    data_component: named pipe metadata
  behavior:
    source: process
    relationship: connected to
    target: pipe
  security_events:
  - event_id: '18'
    name: PipeEvent (Pipe Connected).
    platform: windows
    audit_category: PipeEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  references: null
  notes:
  - Potential contribution for ATT&CK - Named Pipe / named pipe connection
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-18-pipeevent-pipe-connected
- relationship_id: REL-2022-0186
  name: User created Logon
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: logon session
    data_component: logon session creation
  behavior:
    source: user
    relationship: created
    target: logon
  security_events:
  - event_id: '4624'
    name: An account was successfully logged on.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '2'
  - event_id: '4778'
    name: A session was reconnected to a Window Station.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Other Logon/Logoff Events
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4964'
    name: Special groups have been assigned to a new logon.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Special Logon
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceLogonEvents
    name: DeviceLogonEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: LogonSuccess
    event_version:
    - '0'
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4778
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964
  notes: null
- relationship_id: REL-2022-0061
  name: Sensor Health changed
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: sensor health
    data_component: host status
  behavior:
    source: sensor health
    relationship: changed
    target: null
  security_events:
  - event_id: '4'
    name: Sysmon service state changed.
    platform: windows
    audit_category: ServiceStateChange
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '1100'
    name: The event logging service has shut down.
    platform: windows
    log_source: Microsoft-Windows-Eventlog
  - event_id: '1101'
    name: Audit events have been dropped by the transport.
    platform: windows
    log_source: Microsoft-Windows-Eventlog
  - event_id: '1102'
    name: The audit log was cleared.
    platform: windows
    log_source: Microsoft-Windows-Eventlog
  - event_id: '1104'
    name: The security Log is now full.
    platform: windows
    log_source: Microsoft-Windows-Eventlog
  - event_id: '6005'
    name: The Event log service was started.
    platform: windows
    channel: System
    log_source: EventLog
  - event_id: '6006'
    name: The Event log service was stopped.
    platform: windows
    channel: System
    log_source: EventLog
  - event_id: '4616'
    name: The system time was changed.
    platform: windows
    audit_category: System
    audit_sub_category: Security State Change
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1104
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1105
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616
  notes: null
- relationship_id: REL-2022-0063
  name: User deleted AD Object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: active directory
    data_component: active directory object deletion
  behavior:
    source: user
    relationship: deleted
    target: ad object
  security_events:
  - event_id: '5141'
    name: A directory service object was deleted.
    platform: windows
    audit_category: DS Access
    audit_sub_category: Directory Service Changes
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5141
  notes: null
- relationship_id: REL-2022-0064
  name: User disabled Drive
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: drive
    data_component: drive modification
  behavior:
    source: user
    relationship: disabled
    target: drive
  security_events:
  - event_id: '6420'
    name: A device was disabled.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6420
  notes: null
- relationship_id: REL-2022-0022
  name: Device blocked listener on Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: blocked listener on
    target: ip
  security_events:
  - event_id: '5155'
    name: The Windows Filtering Platform has blocked an application or service from
      listening on a port for incoming connections.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5155
  notes: null
- relationship_id: REL-2022-0066
  name: Process executed Script
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: script
    data_component: script execution
  behavior:
    source: process
    relationship: executed
    target: script
  security_events:
  - event_id: '4103'
    name: Module logging.
    platform: windows
    channel: Microsoft-Windows-PowerShell/Operational
    log_source: Microsoft-Windows-PowerShell
    event_version:
    - '1'
  - event_id: '4104'
    name: Script Block Logging.
    platform: windows
    channel: Microsoft-Windows-PowerShell/Operational
    log_source: Microsoft-Windows-PowerShell
    event_version:
    - '1'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ScriptContent
    event_version:
    - '0'
    - '1'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: PowerShellCommand
    event_version:
    - '0'
    - '1'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: AmsiScriptDetection
    event_version:
    - '0'
    - '1'
  references: null
- relationship_id: REL-2022-0067
  name: User attempted to enable Drive
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: drive
    data_component: drive modification
  behavior:
    source: user
    relationship: attempted to enable
    target: drive
  security_events:
  - event_id: '6421'
    name: A request was made to enable a device.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6421
  notes: null
- relationship_id: REL-2022-0068
  name: Process listened on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: listened on
    target: port
  security_events:
  - event_id: '5154'
    name: The Windows Filtering Platform has permitted an application or service to
      listen on a port for incoming connections.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ListeningConnectionCreated
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154
  notes: null
- relationship_id: REL-2022-0033
  name: Device blocked connection to Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: Device
    relationship: blocked connection to
    target: process
  security_events:
  - event_id: '5157'
    name: The Windows Filtering Platform has blocked a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: '5031'
    name: The Windows Firewall Service blocked an application from accepting incoming
      connections on the network.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FirewallInboundConnectionToAppBlocked
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5031
  notes: null
- relationship_id: REL-2022-0069
  name: User attempted to install Drive
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: drive
    data_component: drive creation
  behavior:
    source: user
    relationship: attempted to install
    target: drive
  security_events:
  - event_id: '6423'
    name: The installation of this device is forbidden by system policy.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6423
  notes: null
- relationship_id: REL-2022-0149
  name: Logon modified
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: logon session
    data_component: logon session modification
  behavior:
    source: logon
    relationship: modified
    target: null
  security_events:
  - event_id: '4672'
    name: Special privileges assigned to new logon.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Special Logon
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672
  notes: null
- relationship_id: REL-2022-0072
  name: Firewall Rule added
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall rule modification
  behavior:
    source: firewall rule
    relationship: removed
    target: null
  security_events:
  - event_id: '4948'
    name: A change has been made to Windows Firewall exception list. A rule was deleted.
    platform: windows
    audit_category: Policy Change
    audit_sub_category: MPSSVC Rule-Level Policy Change
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4948
  notes: null
- relationship_id: REL-2022-0073
  name: Process searched LDAP
  contributors:
  - Hamza OUADI @Cyb3rSn0rlax
  attack:
    data_source: process
    data_component: process metadata
  behavior:
    source: process
    relationship: searched
    target: ldap
  security_events:
  - event_id: '30'
    name: EventID(30)
    platform: windows
    log_source: Microsoft-Windows-LDAP-Client/Debug
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: LdapSearch
    event_version:
    - '0'
    - '1'
  references:
  - null
  notes:
  - Host-based ETW provieder for LDAP search filter performed by a process. This event
    provides valuable data like PID, search filter and attributes.
- relationship_id: REL-2022-0075
  name: User accessed File
  contributors:
  - Reid Gilman @reidgilman
  - Ruben Bouman @rubinatorz
  attack:
    data_source: file
    data_component: file access
  behavior:
    source: user
    relationship: accessed
    target: file
  security_events:
  - event_id: '4663'
    name: An attempt was made to access an object.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: File
    event_version:
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Event 4663 includes the following caveat "This event generates only if object's
    SACL has required ACE to handle specific access right use".
  - Event ID 4663 logs attempts of accesses to objects. Look for file access by searching
    for "ObjectType=File".
- relationship_id: REL-2022-0076
  name: User modified Network share
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network share
    data_component: network share modification
  behavior:
    source: user
    relationship: modified
    target: network share
  security_events:
  - event_id: '5143'
    name: A network share object was modified.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File Share
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5143
  notes: null
- relationship_id: REL-2022-0078
  name: User attempted to access Network Share
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network share
    data_component: network share access
  behavior:
    source: user
    relationship: attempted to access
    target: network share
  security_events:
  - event_id: '5140'
    name: A network share object was accessed.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File Share
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: '5145'
    name: A network share object was checked to see whether client can be granted
      desired access.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Detailed File Share
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceLogonEvents
    name: DeviceLogonEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: LogonSuccess
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5140
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145
  notes:
  - Potential contribution for ATT&CK - Network Share / network share access
- relationship_id: REL-2022-0079
  name: Process attempted connection from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted connection from
    target: ip
  security_events:
  - event_id: '5157'
    name: The Windows Filtering Platform has blocked a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ConnectionRequest
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
  notes: null
- relationship_id: REL-2022-0080
  name: User created Wmi object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Ruben Bouman @rubinatorz
  attack:
    data_source: wmi
    data_component: wmi creation
  behavior:
    source: user
    relationship: created
    target: wmi object
  security_events:
  - event_id: '19'
    name: WmiEvent (WmiEventFilter activity detected).
    platform: windows
    audit_category: WmiEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '20'
    name: WmiEvent (WmiEventConsumer activity detected).
    platform: windows
    audit_category: WmiEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '21'
    name: WmiEvent (WmiEventConsumerToFilter activity detected).
    platform: windows
    audit_category: WmiEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: WmiBindEventFilterToConsumer
    event_version:
    - '0'
    - '1'
  - event_id: '5860'
    name: WMI temporary event created.
    platform: windows
    log_source: Microsoft-Windows-WMI-Activity
    event_version:
    - '0'
  - event_id: '5861'
    name: WMI permanent event created.
    platform: windows
    log_source: Microsoft-Windows-WMI-Activity
    event_version:
    - '0'
  - event_id: '5857'
    name: WMIProv provider started.
    platform: windows
    log_source: Microsoft-Windows-WMI-Activity
    event_version:
    - '0'
  - event_id: '5858'
    name: WMI Query Error.
    platform: windows
    log_source: Microsoft-Windows-WMI-Activity
    event_version:
    - '0'
  - event_id: '5859'
    name: WMI Event.
    platform: windows
    log_source: Microsoft-Windows-WMI-Activity
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected
  - null
  notes: null
- relationship_id: REL-2022-0081
  name: Firewall Rule added
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall rule modification
  behavior:
    source: firewall rule
    relationship: added
    target: null
  security_events:
  - event_id: '4946'
    name: A change has been made to Windows Firewall exception list. A rule was added.
    platform: windows
    audit_category: Policy Change
    audit_sub_category: MPSSVC Rule-Level Policy Change
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4946
  notes: null
- relationship_id: REL-2022-0082
  name: User deleted Wmi object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: wmi
    data_component: wmi deletion
  behavior:
    source: user
    relationship: deleted
    target: wmi object
  security_events:
  - event_id: '19'
    name: WmiEvent (WmiEventFilter activity detected).
    platform: windows
    audit_category: WmiEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '20'
    name: WmiEvent (WmiEventConsumer activity detected).
    platform: windows
    audit_category: WmiEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '21'
    name: WmiEvent (WmiEventConsumerToFilter activity detected).
    platform: windows
    audit_category: WmiEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected
  notes: null
- relationship_id: REL-2022-0083
  name: User removed acess from User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: user account
    data_component: user account modification
  behavior:
    source: user
    relationship: removed access from
    target: user
  security_events:
  - event_id: '4718'
    name: System security access was removed from an account.
    platform: windows
    audit_category: Policy Change
    audit_sub_category: Authentication Policy Change
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4718
  notes: null
- relationship_id: REL-2022-0085
  name: User accessed AD Object
  contributors:
  - Reid Gilman @reidgilman
  - Ruben Bouman @rubinatorz
  attack:
    data_source: active directory
    data_component: active directory object access
  behavior:
    source: user
    relationship: accessed
    target: ad object
  security_events:
  - event_id: '4662'
    name: An operation was performed on an object.
    platform: windows
    audit_category: DS Access
    audit_sub_category: Directory Service Access
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4932'
    name: Synchronization of a replica of an Active Directory naming context has begun.
    platform: windows
    audit_category: DS Access
    audit_sub_category: Directory Service Replication
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4932
  notes:
  - Events 4661 and 4662 require a SACL (https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists)
    to be for an object or they will not generate
- relationship_id: REL-2022-0125
  name: Process created Registry
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: windows registry
    data_component: windows registry key creation
  behavior:
    source: process
    relationship: created
    target: registry
  security_events:
  - event_id: '12'
    name: RegistryEvent (Object create and delete).
    platform: windows
    audit_category: RegistryEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    filter_in:
    - EventType: CreateKey
    event_version:
    - '4.32'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryValueSet
    event_version:
    - '0'
    - '1'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryKeyCreated
    event_version:
    - '0'
    - '1'
  - event_id: '4657'
    name: A registry value was modified.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete
  notes:
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=New registry value created" to look for creations.
- relationship_id: REL-2022-0086
  name: Application attempted to authenticate User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: user account
    data_component: user account authentication
  behavior:
    source: application
    relationship: attempted to authenticate
    target: user
  security_events:
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: ConsoleLogin
    - eventType: AwsConsoleSignin
    event_version:
    - '1.05'
  references:
  - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
  notes:
  - Potential contribution for ATT&CK - User Account / user account authentication
- relationship_id: REL-2022-0088
  name: Process added Firewall rule
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall rule modification
  behavior:
    source: process
    relationship: added
    target: firewall rule
  security_events:
  - event_id: '2004'
    name: A rule has been added to the Windows Defender Firewall exception list
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version:
    - '0'
  references: null
  notes: null
- relationship_id: REL-2022-0028
  name: Device blocked connection from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: blocked connection from
    target: port
  security_events:
  - event_id: '5157'
    name: The Windows Filtering Platform has blocked a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FirewallInboundConnectionBlocked
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
  notes: null
- relationship_id: REL-2022-0091
  name: Process attempted to listen on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted to listen on
    target: port
  security_events:
  - event_id: '5155'
    name: The Windows Filtering Platform has blocked an application or service from
      listening on a port for incoming connections.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5155
  notes: null
- relationship_id: REL-2022-0092
  name: User requested access to File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: file
    data_component: file access
  behavior:
    source: user
    relationship: requested access to
    target: file
  security_events:
  - event_id: '4656'
    name: A handle to an object was requested.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: File
  - event_id: '4661'
    name: A handle to an object was requested.
    platform: windows
    audit_category: Object Access
    audit_sub_category: SAM
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: SAM
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661
  notes:
  - Event 4656 generates only if object's SACL has required ACE to handle specific
    access right use.
- relationship_id: REL-2022-0093
  name: Process created Pipe
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Ruben Bouman @rubinatorz
  attack:
    data_source: named pipe
    data_component: named pipe metadata
  behavior:
    source: process
    relationship: created
    target: pipe
  security_events:
  - event_id: '17'
    name: PipeEvent (Pipe Created).
    platform: windows
    audit_category: PipeEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '4656'
    name: A handle to an object was requested.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Detailed File Share
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-17-pipeevent-pipe-created
  notes:
  - Potential contribution for ATT&CK - Named Pipe / named pipe creation
  - Event ID 4656 logs handles to objects. Look for named pipe creation by searching
    for "Accesses=CreatePipeInstance".
- relationship_id: REL-2022-0094
  name: Service stopped
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: service
    data_component: service metadata
  behavior:
    source: service
    relationship: stopped
    target: null
  security_events:
  - event_id: '4'
    name: Sysmon service state changed.
    platform: windows
    audit_category: ServiceStateChange
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '6006'
    name: The Event log service was stopped.
    platform: windows
    channel: System
    log_source: EventLog
  references:
  - - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-4-sysmon-service-state-changed
  notes: null
- relationship_id: REL-2022-0095
  name: Process modified Firewall rule
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall rule modification
  behavior:
    source: process
    relationship: modified
    target: firewall rule
  security_events:
  - event_id: '2005'
    name: A rule has been modified in the Windows Defender Firewall exception list.
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version:
    - '0'
  references: null
  notes: null
- relationship_id: REL-2022-0097
  name: User created Service
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: service
    data_component: service creation
  behavior:
    source: user
    relationship: created
    target: service
  security_events:
  - event_id: '4697'
    name: A service was installed in the system.
    platform: windows
    audit_category: System
    audit_sub_category: Security System Extension
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '7045'
    name: A new service was installed in the system.
    platform: windows
    channel: System
    log_source: Service Control Manager
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ServiceInstalled
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697
  notes: null
- relationship_id: REL-2022-0098
  name: User connected to Pipe
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: named pipe
    data_component: named pipe metadata
  behavior:
    source: user
    relationship: connected to
    target: pipe
  security_events:
  - event_id: '18'
    name: PipeEvent (Pipe Connected).
    platform: windows
    audit_category: PipeEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-18-pipeevent-pipe-connected
  notes:
  - Potential contribution for ATT&CK - Named Pipe / named pipe creation
- relationship_id: REL-2022-0100
  name: User requested AD Credential
  contributors:
  - Reid Gilman @reidgilman
  attack:
    data_source: active directory
    data_component: active directory credential request
  behavior:
    source: user
    relationship: requested
    target: ad credential
  security_events:
  - event_id: '4768'
    name: A Kerberos authentication ticket (TGT) was requested.
    platform: windows
    audit_category: Account Logon
    audit_sub_category: Kerberos Authentication Service
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4769'
    name: A Kerberos service ticket was requested.
    platform: windows
    audit_category: Account Logon
    audit_sub_category: Kerberos Service Ticket Operations
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769
  - https://www.cyberark.com/resources/threat-research-blog/detecting-pass-the-hash-with-windows-event-viewer
  - https://stealthbits.com/blog/how-to-detect-pass-the-hash-attacks/
  notes: null
- relationship_id: REL-2022-0103
  name: Process bound to Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: bound to
    target: port
  security_events:
  - event_id: '5158'
    name: The Windows Filtering Platform has permitted a bind to a local port.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ListeningConnectionCreated
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5158
  notes: null
- relationship_id: REL-2022-0115
  name: Device permitted listener on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: permitted listener on
    target: port
  security_events:
  - event_id: '5154'
    name: The Windows Filtering Platform has permitted an application or service to
      listen on a port for incoming connections.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154
  notes: null
- relationship_id: REL-2022-0106
  name: User attempted to authenticate to Application
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: user account
    data_component: user account authentication
  behavior:
    source: user
    relationship: attempted to authenticate to
    target: application
  security_events:
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: ConsoleLogin
    - eventType: AwsConsoleSignin
    event_version:
    - '1.05'
  references: null
- relationship_id: REL-2022-0107
  name: User created Instance
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: instance
    data_component: instance creation
  behavior:
    source: user
    relationship: created
    target: instance
  security_events:
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: RunInstances
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  references: null
  notes: null
- relationship_id: REL-2022-0108
  name: User connected from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected from
    target: port
  security_events:
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: InboundConnectionAccepted
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0109
  name: User disabled User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: user account
    data_component: user account modification
  behavior:
    source: user
    relationship: disabled
    target: user
  security_events:
  - event_id: '4725'
    name: A user account was disabled.
    platform: windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: UserAccountModified
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4725
  notes: null
- relationship_id: REL-2022-0110
  name: User requested access to Service
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: service
    data_component: service access
  behavior:
    source: user
    relationship: requested access to
    target: service
  security_events:
  - event_id: '4656'
    name: A handle to an object was requested.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
  notes: null
- relationship_id: REL-2022-0111
  name: Process requested access to Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: process
    data_component: process access
  behavior:
    source: process
    relationship: requested access to
    target: process
  security_events:
  - event_id: '4656'
    name: A handle to an object was requested.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Kernel Object
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Process
    event_version:
    - '1'
  - event_id: '10'
    name: Process Access.
    platform: windows
    audit_category: ProcessAccess
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: OpenProcessApiCall
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-10-processaccess
  notes: null
- relationship_id: REL-2022-0112
  name: Process attempted connection from Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted connection from
    target: port
  security_events:
  - event_id: '5157'
    name: The Windows Filtering Platform has blocked a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ConnectionRequest
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
  notes: null
- relationship_id: REL-2022-0113
  name: Process connected to Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected to
    target: port
  security_events:
  - event_id: '5156'
    name: The Windows Filtering Platform has permitted a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ConnectionSuccess
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0172
  name: User terminated Logon
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Ruben Bouman @rubinatorz
  attack:
    data_source: logon session
    data_component: logon session termination
  behavior:
    source: user
    relationship: terminated
    target: logon
  security_events:
  - event_id: '4634'
    name: An account was logged off.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Logoff
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4647'
    name: User initiated logoff.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Logoff
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4647
  notes: null
- relationship_id: REL-2022-0114
  name: User installed Drive
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: drive
    data_component: drive creation
  behavior:
    source: user
    relationship: installed
    target: drive
  security_events:
  - event_id: '6416'
    name: A new external device was recognized by the system.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: '6424'
    name: The installation of this device was allowed, after having previously been
      forbidden by policy.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: PNP Activity
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6416
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6424
  notes: null
- relationship_id: REL-2022-0117
  name: User modified Instance
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: instance
    data_component: instance modification
  behavior:
    source: user
    relationship: modified
    target: instance
  security_events:
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: ModifyInstanceAttribute
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  references: null
  notes: null
- relationship_id: REL-2022-0118
  name: User removed Firewall rule
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Ruben Bouman @rubinatorz
  attack:
    data_source: firewall
    data_component: firewall rule modification
  behavior:
    source: user
    relationship: removed
    target: firewall rule
  security_events:
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: DeleteRuleGroup
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  - event_id: '2006'
    name: A rule has been deleted in the Windows Defender Firewall exception list
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version:
    - '0'
  - event_id: '2033'
    name: All rules have been deleted from the Windows Firewall configuration on this
      computer.
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version:
    - '0'
  references: null
  notes: null
- relationship_id: REL-2022-0159
  name: Device blocked listener on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: blocked listener on
    target: port
  security_events:
  - event_id: '5155'
    name: The Windows Filtering Platform has blocked an application or service from
      listening on a port for incoming connections.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5155
  notes: null
- relationship_id: REL-2022-0119
  name: User modified Schedule job
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: scheduled job
    data_component: scheduled job modification
  behavior:
    source: user
    relationship: modified
    target: schedule job
  security_events:
  - event_id: '4702'
    name: A scheduled task was updated.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ScheduledTaskUpdated
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4702
  notes: null
- relationship_id: REL-2022-0121
  name: Process accessed Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: process
    data_component: process access
  behavior:
    source: process
    relationship: accessed
    target: process
  security_events:
  - event_id: '10'
    name: ProcessAccess
    platform: windows
    audit_category: ProcessAccess
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '4663'
    name: An attempt was made to access an object.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Kernel Object
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Process
    event_version:
    - '1'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: OpenProcessApiCall
    event_version:
    - '0'
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Event 4663, this event generates only if object SACL has required ACE to handle
    specific access right use.
- relationship_id: REL-2022-0122
  name: User attempted to authenticate from Device
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: user account
    data_component: user account authentication
  behavior:
    source: user
    relationship: attempted to authenticate from
    target: device
  security_events:
  - event_id: '4776'
    name: The domain controller or local computer attempted to validate the credentials
      for an account.
    platform: windows
    audit_category: Account Logon
    audit_sub_category: Credential Validation
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
  notes: null
- relationship_id: REL-2022-0126
  name: Driver loaded
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: driver
    data_component: driver load
  behavior:
    source: driver
    relationship: loaded
    target: null
  security_events:
  - event_id: '6'
    name: Driver loaded.
    platform: windows
    audit_category: DriverLoad
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: DriverLoaded
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-6-driver-loaded
  notes: null
- relationship_id: REL-2022-0050
  name: Logon Metadata
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: logon session
    data_component: logon session metadata
  behavior:
    source: logon
    relationship: metadata
    target: null
  security_events:
  - event_id: '4703'
    name: A token right was adjusted.
    platform: windows
    audit_category: Policy Change
    audit_sub_category: Authorization Policy Change
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4673'
    name: A privileged service was called.
    platform: windows
    audit_category: Privilege Use
    audit_sub_category: Sensitive Privilege Use
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4674'
    name: An operation was attempted on a privileged object.
    platform: windows
    audit_category: Privilege Use
    audit_sub_category: Sensitive Privilege Use
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4610'
    name: An authentication package has been loaded by the Local Security Authority.
    platform: windows
    audit_category: System
    audit_sub_category: Security System Extension
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4611'
    name: A trusted logon process has been registered with the Local Security Authority.
    platform: windows
    audit_category: System
    audit_sub_category: Security System Extension
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4614'
    name: A notification package has been loaded by the Security Account Manager.
    platform: windows
    audit_category: System
    audit_sub_category: Security System Extension
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4622'
    name: A security package has been loaded by the Local Security Authority.
    platform: windows
    audit_category: System
    audit_sub_category: Security System Extension
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4673
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4674
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4610
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4611
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4614
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4622
  notes: null
- relationship_id: REL-2022-0173
  name: Device blocked connection to Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: blocked connection to
    target: ip
  security_events:
  - event_id: '5157'
    name: The Windows Filtering Platform has blocked a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FirewallOutboundConnectionBlocked
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
  notes: null
- relationship_id: REL-2022-0137
  name: Device blocked connection to Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: blocked connection to
    target: port
  security_events:
  - event_id: '5157'
    name: The Windows Filtering Platform has blocked a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FirewallOutboundConnectionBlocked
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
  notes: null
- relationship_id: REL-2022-0128
  name: Device blocked listener on Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: blocked listener on
    target: process
  security_events:
  - event_id: '5155'
    name: The Windows Filtering Platform has blocked an application or service from
      listening on a port for incoming connections.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5155
  notes: null
- relationship_id: REL-2022-0164
  name: Device permitted listener on Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: permitted listener on
    target: process
  security_events:
  - event_id: '5154'
    name: The Windows Filtering Platform has permitted an application or service to
      listen on a port for incoming connections.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154
  notes: null
- relationship_id: REL-2022-0129
  name: User created Pipe
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: named pipe
    data_component: named pipe metadata
  behavior:
    source: user
    relationship: created
    target: pipe
  security_events:
  - event_id: '17'
    name: PipeEvent (Pipe Created).
    platform: windows
    audit_category: PipeEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '4656'
    name: A handle to an object was requested.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: '5145'
    name: A network share object was checked to see whether client can be granted
      desired access.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Detailed File Share
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-17-pipeevent-pipe-created
  notes:
  - Potential contribution for ATT&CK - Named Pipe / named pipe creation
  - Event ID 5145 logs accesses of network share objects. Look for named pipe by searching
    for "Accesses=CreatePipeInstance".
  - Event ID 4656 logs handles to objects. Look for named pipe by searching for "Accesses=CreatePipeInstance".
- relationship_id: REL-2022-0130
  name: User deleted Registry
  contributors:
  - Ruben Bouman @rubinatorz
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: windows registry
    data_component: windows registry key deletion
  behavior:
    source: user
    relationship: deleted
    target: registry
  security_events:
  - event_id: '12'
    name: RegistryEvent (Object create and delete).
    platform: windows
    audit_category: RegistryEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryValueDeleted
    event_version:
    - '0'
    - '1'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryKeyDeleted
    event_version:
    - '0'
    - '1'
  - event_id: '4657'
    name: A registry value was modified.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - OperationType: Registry value deleted
    event_version:
    - '0'
  - event_id: '4660'
    name: An object was deleted.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660
  notes:
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=Registry value deleted" to look for deletions.
- relationship_id: REL-2022-0131
  name: Process executed Command
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: command
    data_component: command execution
  behavior:
    source: process
    relationship: executed
    target: command
  security_events:
  - event_id: '4688'
    name: A new process has been created.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: Process Creation
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '2'
  - event_id: '1'
    name: Process Creation.
    platform: windows
    audit_category: ProcessCreate
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '1'
    name: Process Creation.
    platform: linux
    audit_category: ProcessCreate
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: '4103'
    name: Module logging.
    platform: windows
    channel: Microsoft-Windows-PowerShell/Operational
    log_source: Microsoft-Windows-PowerShell
    event_version:
    - '0'
  - event_id: DeviceProcessEvents
    name: DeviceProcessEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ProcessCreated
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation
  - null
  notes: null
- relationship_id: REL-2022-0133
  name: User attempted to modify User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Ruben Bouman @rubinatorz
  attack:
    data_source: user account
    data_component: user account modification
  behavior:
    source: user
    relationship: attempted to modify
    target: user
  security_events:
  - event_id: '4723'
    name: An attempt was made to change an account's password.
    platform: windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4724'
    name: An attempt was made to reset an account's password.
    platform: windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4723
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4724
  notes: null
- relationship_id: REL-2022-0135
  name: User connected to Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected to
    target: port
  security_events:
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ConnectionSuccess
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0010
  name: Device blocked port bind on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: blocked port bind on
    target: port
  security_events:
  - event_id: '5159'
    name: The Windows Filtering Platform has blocked a bind to a local port.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5159
  notes: null
- relationship_id: REL-2022-0136
  name: User created AD Object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: active directory
    data_component: active directory object creation
  behavior:
    source: user
    relationship: created
    target: ad object
  security_events:
  - event_id: '5137'
    name: A directory service object was created.
    platform: windows
    audit_category: DS Access
    audit_sub_category: Directory Service Changes
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5137
  notes: null
- relationship_id: REL-2022-0139
  name: Process accessed File
  contributors:
  - Reid Gilman @reidgilman
  - Ruben Bouman @rubinatorz
  attack:
    data_source: file
    data_component: file access
  behavior:
    source: process
    relationship: accessed
    target: file
  security_events:
  - event_id: '4663'
    name: An attempt was made to access an object.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  notes:
  - Event 4663 includes the following caveat "This event generates only if object's
    SACL has required ACE to handle specific access right use."
  - Event ID 4663 logs attempts of accesses to objects. Look for file access by searching
    for "ObjectType=File".
- relationship_id: REL-2022-0141
  name: Process connected to Host
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected to
    target: host
  security_events:
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ConnectionSuccess
    event_version:
    - '0'
    - '1'
  references:
  - - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0143
  name: Process modified Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: process
    data_component: process modification
  behavior:
    source: process
    relationship: modified
    target: process
  security_events:
  - event_id: '8'
    name: CreateRemoteThread.
    platform: windows
    audit_category: CreateRemoteThread
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: CreateRemoteThreadApiCall
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-8-createremotethread
  notes: null
- relationship_id: REL-2022-0144
  name: User deleted File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: file
    data_component: file deletion
  behavior:
    source: user
    relationship: deleted
    target: file
  security_events:
  - event_id: '23'
    name: File Delete archived.
    platform: windows
    audit_category: FileDelete
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '23'
    name: File Delete archived.
    platform: linux
    audit_category: FileDelete
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: '26'
    name: File Delete logged.
    platform: windows
    audit_category: FileDeleteDetected
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '4660'
    name: An object was deleted.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4663'
    name: An attempt was made to access an object.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: DeviceFileEvents
    name: DeviceFileEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FileDeleted
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4660
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-23-filedelete-file-delete-archived
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-26-filedeletedetected-file-delete-logged
  notes:
  - Event ID 4663 logs attempts of accesses to objects. Look for file creations by
    searching for "Accesses=Delete".
- relationship_id: REL-2022-0124
  name: Device blocked port bind on Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: blocked port bind on
    target: ip
  security_events:
  - event_id: '5159'
    name: The Windows Filtering Platform has blocked a bind to a local port.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5159
  notes: null
- relationship_id: REL-2022-0146
  name: User created Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: process
    data_component: process creation
  behavior:
    source: user
    relationship: created
    target: process
  security_events:
  - event_id: '4688'
    name: A new process has been created.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: Process Creation
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '2'
  - event_id: '1'
    name: Process Creation.
    platform: windows
    audit_category: ProcessCreate
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '1'
    name: Process Creation.
    platform: linux
    audit_category: ProcessCreate
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceProcessEvents
    name: DeviceProcessEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ProcessCreated
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation
  notes: null
- relationship_id: REL-2022-0127
  name: Firewall attempted to load Configuration
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: firewall
    data_component: firewall metadata
  behavior:
    source: firewall
    relationship: attempted to load
    target: configuration
  security_events:
  - event_id: '2009'
    name: The Windows Firewall service failed to load Group Policy.
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version: []
  references: null
  notes: null
- relationship_id: REL-2022-0148
  name: User enabled Scheduled job
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: scheduled job
    data_component: scheduled job modification
  behavior:
    source: user
    relationship: enabled
    target: scheduled job
  security_events:
  - event_id: '4700'
    name: A scheduled task was enabled.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ScheduledTaskModified
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4700
  notes: null
- relationship_id: REL-2022-0150
  name: Process executed Api call
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: process
    data_component: OS api execution
  behavior:
    source: process
    relationship: executed
    target: api call
  security_events:
  - event_id: '8'
    name: CreateRemoteThread.
    platform: windows
    audit_category: CreateRemoteThread
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: CreateRemoteThreadApiCall
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-8-createremotethread
  notes: null
- relationship_id: REL-2022-0160
  name: Device blocked connection from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: device
    relationship: blocked connection from
    target: ip
  security_events:
  - event_id: '5157'
    name: The Windows Filtering Platform has blocked a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FirewallInboundConnectionBlocked
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
  notes: null
- relationship_id: REL-2022-0138
  name: User connected from Device
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected from
    target: device
  security_events:
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: InboundConnectionAccepted
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0070
  name: Process requested access to Registry
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: windows registry
    data_component: windows registry key access
  behavior:
    source: process
    relationship: requested access to
    target: registry
  security_events:
  - event_id: '4656'
    name: A handle to an object was requested.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Key
    event_version:
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
  notes: null
- relationship_id: REL-2022-0152
  name: User modified Firewall
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall metadata
  behavior:
    source: user
    relationship: modified
    target: firewall
  security_events:
  - event_id: '2002'
    name: A Windows Defender Firewall setting has changed.
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version:
    - '0'
  - event_id: '2003'
    name: A Windows Defender Firewall setting in the Private profile has changed.
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version:
    - '0'
  references: null
  notes:
  - Potential contribution for ATT&CK - Firewall / firewall modification (New data
    component and relationship)
- relationship_id: REL-2022-0153
  name: Process created Thread
  contributors:
  - Reid Gilman @reidgilman
  - Olaf Hartong @olafhartong
  attack:
    data_source: process
    data_component: process creation
  behavior:
    source: process
    relationship: created
    target: thread
  security_events:
  - event_id: '8'
    name: CreateRemoteThread.
    platform: windows
    audit_category: CreateRemoteThread
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: CreateRemoteThreadApiCall
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-8-createremotethread
  notes: null
- relationship_id: REL-2022-0155
  name: Process modified File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: file
    data_component: file modification
  behavior:
    source: process
    relationship: modified
    target: file
  security_events:
  - event_id: '2'
    name: A process changed a file creation time.
    platform: windows
    audit_category: FileCreateTime
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '11'
    name: FileCreate.
    platform: windows
    audit_category: FileCreate
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '4670'
    name: Permissions on an object were changed.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceFileEvents
    name: DeviceFileEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FileModified
    event_version:
    - '0'
    - '1'
  - event_id: DeviceFileEvents
    name: DeviceFileEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FileRenamed
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-2-a-process-changed-a-file-creation-time
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-11-filecreate
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670
  notes: null
- relationship_id: REL-2022-0105
  name: User created Registry
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: windows registry
    data_component: windows registry key creation
  behavior:
    source: user
    relationship: created
    target: registry
  security_events:
  - event_id: '12'
    name: RegistryEvent (Object create and delete).
    platform: windows
    audit_category: RegistryEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    filter_in:
    - EventType: CreateKey
    event_version:
    - '4.32'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryValueSet
    event_version:
    - '0'
    - '1'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryKeyCreated
    event_version:
    - '0'
    - '1'
  - event_id: '4657'
    name: A registry value was modified.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - OperationType: New registry value created
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-12-registryevent-object-create-and-delete
  notes:
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=New registry value created" to look for creations.
- relationship_id: REL-2022-0156
  name: User retrieved information about cloud service from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: cloud service
    data_component: cloud service metadata
  behavior:
    source: user
    relationship: retrieved information about cloud service from
    target: ip
  security_events:
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: GetTrail
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: GetTrailStatus
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: DescribeTrails
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: GetEventSelectors
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: GetInsightSelectors
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  references: null
  notes:
  - Potential contribution for ATT&CK - Cloud Service / cloud service metadata
- relationship_id: REL-2022-0158
  name: User created instance from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: instance
    data_component: instance creation
  behavior:
    source: user
    relationship: created instance from
    target: ip
  security_events:
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudTrail
    filter_in:
    - eventName: RunInstances
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  references: null
  notes: null
- relationship_id: REL-2022-0013
  name: User requested access to Registry
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: windows registry
    data_component: windows registry key access
  behavior:
    source: user
    relationship: requested access to
    target: registry
  security_events:
  - event_id: '4656'
    name: A handle to an object was requested.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - ObjectType: Key
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
  note: null
- relationship_id: REL-2022-0161
  name: User connected from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected from
    target: ip
  security_events:
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: InboundConnectionAccepted
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0162
  name: User modified AD Object
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Ruben Bouman @rubinatorz
  attack:
    data_source: active directory
    data_component: active directory object modification
  behavior:
    source: user
    relationship: modified
    target: ad object
  security_events:
  - event_id: '5136'
    name: A directory service object was modified.
    platform: windows
    audit_category: DS Access
    audit_sub_category: Directory Service Changes
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '5139'
    name: A directory service object was moved.
    platform: windows
    audit_category: DS Access
    audit_sub_category: Directory Service Changes
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4719'
    name: System audit policy was changed.
    platform: windows
    audit_category: Policy Change
    audit_sub_category: Policy Change
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5139
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4719
  notes: null
- relationship_id: REL-2022-0163
  name: User authenticated from Device
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: user account
    data_component: user account authentication
  behavior:
    source: user
    relationship: authenticated from
    target: device
  security_events:
  - event_id: '4776'
    name: The domain controller or local computer attempted to validate the credentials
      for an account.
    platform: windows
    audit_category: Account Logon
    audit_sub_category: Credential Validation
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
  notes: null
- relationship_id: REL-2022-0165
  name: User enumerated Group
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: group
    data_component: group enumeration
  behavior:
    source: user
    relationship: enumerated
    target: group
  security_events:
  - event_id: '4798'
    name: A user's local group membership was enumerated.
    platform: windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4799'
    name: A security-enabled local group membership was enumerated.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4799
  notes: null
- relationship_id: REL-2022-0145
  name: User modified Registry
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: windows registry
    data_component: windows registry key modification
  behavior:
    source: user
    relationship: modified
    target: registry
  security_events:
  - event_id: '13'
    name: RegistryEvent (Value Set).
    platform: windows
    audit_category: RegistryEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '14'
    name: RegistryEvent (Key and Value Rename).
    platform: windows
    audit_category: RegistryEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '4657'
    name: A registry value was modified.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - OperationType: Existing registry value modified
    event_version:
    - '0'
  - event_id: '4670'
    name: Permissions on an object were changed.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryValueSet
    event_version:
    - '0'
    - '1'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryKeySet
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-13-registryevent-value-set
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-14-registryevent-key-and-value-rename
  notes:
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=Existing registry value modified" to look for modifications.
- relationship_id: REL-2022-0166
  name: Process connected from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: connected from
    target: ip
  security_events:
  - event_id: '5156'
    name: The Windows Filtering Platform has permitted a connection.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: InboundConnectionAccepted
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0167
  name: User disabled Scheduled job
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: scheduled job
    data_component: scheduled job modification
  behavior:
    source: user
    relationship: disabled
    target: scheduled job
  security_events:
  - event_id: '4701'
    name: A scheduled task was disabled.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Other Object Access Events
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ScheduledTaskModified
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4701
  notes: null
- relationship_id: REL-2022-0168
  name: User added Firewall rule
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall rule modification
  behavior:
    source: user
    relationship: added
    target: firewall rule
  security_events:
  - event_id: '2004'
    name: A rule has been added to the Windows Defender Firewall exception list
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version:
    - '0'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: CreateRuleGroup
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  references: null
  notes: null
- relationship_id: REL-2022-0104
  name: User connected to Device
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: user
    relationship: connected to
    target: device
  security_events:
  - event_id: '3'
    name: Network connection.
    platform: windows
    audit_category: NetworkConnect
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '3'
    name: Network connection.
    platform: linux
    audit_category: NetworkConnect
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceNetworkEvents
    name: DeviceNetworkEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ConnectionSuccess
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-3-network-connection
  notes: null
- relationship_id: REL-2022-0169
  name: User created Network Share
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network share
    data_component: network share creation
  behavior:
    source: user
    relationship: created
    target: network share
  security_events:
  - event_id: '5142'
    name: A network share object was added.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File Share
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142
  notes: null
- relationship_id: REL-2022-0071
  name: Process modified Registry
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: windows registry
    data_component: windows registry key modification
  behavior:
    source: process
    relationship: modified
    target: registry
  security_events:
  - event_id: '13'
    name: RegistryEvent (Value Set).
    platform: windows
    audit_category: RegistryEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    filter_in:
    - EventType: SetValue
    event_version:
    - '4.32'
  - event_id: '14'
    name: RegistryEvent (Key and Value Rename).
    platform: windows
    audit_category: RegistryEvent
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '4657'
    name: A registry value was modified.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    filter_in:
    - OperationType: Existing registry value modified
    event_version:
    - '0'
  - event_id: '4670'
    name: Permissions on an object were changed.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Registry
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryValueSet
    event_version:
    - '0'
    - '1'
  - event_id: DeviceRegistryEvents
    name: DeviceRegistryEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: RegistryKeyCreated
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-13-registryevent-value-set
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-14-registryevent-key-and-value-rename
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4657
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4670
  notes:
  - Event ID 4657 is logged for Creation, Modification and Deletion of registry key
    values. Use "Operation Type=Existing registry value modified" to look for modifications.
- relationship_id: REL-2022-0170
  name: User attempted to authenticate from Ip
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Reid Gilman @reidgilman
  - Olaf Hartong @olafhartong
  attack:
    data_source: user account
    data_component: user account authentication
  behavior:
    source: user
    relationship: attempted to authenticate from
    target: ip
  security_events:
  - event_id: '4624'
    name: An account was successfully logged on.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '2'
  - event_id: '4625'
    name: An account failed to log on.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Account Lockout
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4648'
    name: A logon was attempted using explicit credentials.
    platform: windows
    audit_category: Logon/Logoff
    audit_sub_category: Logon
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceLogonEvents
    name: DeviceLogonEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: LogonSuccess
    event_version:
    - '0'
    - '1'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: ConsoleLogin
    - eventType: AwsConsoleSignin
    event_version:
    - '1.05'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
  - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-non-api-events.html
  notes: null
- relationship_id: REL-2022-0174
  name: User deleted Network share
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network share
    data_component: network share deletion
  behavior:
    source: user
    relationship: deleted
    target: network share
  security_events:
  - event_id: '5144'
    name: A network share object was deleted.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File Share
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5144
  notes: null
- relationship_id: REL-2022-0175
  name: Process created Process
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: process
    data_component: process creation
  behavior:
    source: process
    relationship: created
    target: process
  security_events:
  - event_id: '4688'
    name: A new process has been created.
    platform: windows
    audit_category: Detailed Tracking
    audit_sub_category: Process Creation
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '2'
  - event_id: '1'
    name: Process Creation.
    platform: windows
    audit_category: ProcessCreate
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '1'
    name: Process Creation.
    platform: linux
    audit_category: ProcessCreate
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceProcessEvents
    name: DeviceProcessEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ProcessCreated
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-1-process-creation
  notes: null
- relationship_id: REL-2022-0176
  name: User deleted User
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: user account
    data_component: user account deletion
  behavior:
    source: user
    relationship: deleted
    target: user
  security_events:
  - event_id: '4726'
    name: A user account was deleted.
    platform: windows
    audit_category: Account Management
    audit_sub_category: User Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4743'
    name: A computer account was deleted.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Computer Account Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: DeviceEvents
    name: DeviceEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: UserAccountDeleted
    event_version:
    - '0'
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4726
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4743
  notes: null
- relationship_id: REL-2022-0178
  name: Process loaded Module
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  attack:
    data_source: module
    data_component: module load
  behavior:
    source: process
    relationship: loaded
    target: module
  security_events:
  - event_id: '7'
    name: Image loaded.
    platform: windows
    audit_category: ImageLoad
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: DeviceImageLoadEvents
    name: DeviceImageLoadEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: ImageLoaded
    event_version:
    - '0'
    - '1'
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-7-image-loaded
  notes: null
- relationship_id: REL-2022-0179
  name: User modified Firewall rule
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall rule modification
  behavior:
    source: user
    relationship: modified
    target: firewall rule
  security_events:
  - event_id: '2005'
    name: A rule has been modified in the Windows Defender Firewall exception list.
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version:
    - '0'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: UpdateRuleGroup
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  references: null
  notes: null
- relationship_id: REL-2022-0180
  name: Process modified Firewall
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: firewall
    data_component: firewall metadata
  behavior:
    source: process
    relationship: modified
    target: firewall
  security_events:
  - event_id: '2002'
    name: A Windows Defender Firewall setting has changed.
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version:
    - '0'
  - event_id: '2003'
    name: A Windows Defender Firewall setting in the Private profile has changed.
    platform: windows
    channel: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
    log_source: Microsoft-Windows-Windows Firewall With Advanced Security
    event_version:
    - '0'
  references: null
  notes: null
- relationship_id: REL-2022-0181
  name: Process created File
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  - Olaf Hartong @olafhartong
  - Ruben Bouman @rubinatorz
  attack:
    data_source: file
    data_component: file creation
  behavior:
    source: process
    relationship: created
    target: file
  security_events:
  - event_id: 11
    name: FileCreate
    platform: windows
    audit_category: FileCreate
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: 11
    name: FileCreate
    platform: linux
    audit_category: FileCreate
    log_source: sysmon
    event_version:
    - '4.81'
  - event_id: DeviceFileEvents
    name: DeviceFileEvents
    platform: windows
    log_source: Microsoft Defender for Endpoint
    filter_in:
    - ActionType: FileCreated
    event_version:
    - '0'
    - '1'
  - event_id: '4663'
    name: An attempt was made to access an object.
    platform: windows
    audit_category: Object Access
    audit_sub_category: File System
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '1'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-11-filecreate
  notes:
  - Event ID 4663 logs attempts of accesses to objects. Look for file creations by
    searching for "Accesses=WriteData".
- relationship_id: REL-2022-0182
  name: User retrieved information about Cloud service
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  attack:
    data_source: cloud service
    data_component: cloud service metadata
  behavior:
    source: user
    relationship: retrieved information about
    target: cloud service
  security_events:
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: GetTrail
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: GetTrailStatus
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: DescribeTrails
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: GetEventSelectors
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  - event_id: cloudtrail
    name: cloudtrail
    platform: aws
    log_source: cloudtrail
    filter_in:
    - eventName: GetInsightSelectors
    - eventType: AwsApiCall
    event_version:
    - '1.05'
  references: null
  notes: null
- relationship_id: REL-2022-0183
  name: Process attempted to bind on Port
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: network traffic
    data_component: network connection creation
  behavior:
    source: process
    relationship: attempted to bind on
    target: port
  security_events:
  - event_id: '5159'
    name: The Windows Filtering Platform has blocked a bind to a local port.
    platform: windows
    audit_category: Object Access
    audit_sub_category: Filtering Platform Connection
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5159
  notes: null
- relationship_id: REL-2022-0184
  name: Service started
  contributors:
  - Jose Rodriguez @Cyb3rPandaH
  - Roberto Rodriguez @Cyb3rWard0g
  attack:
    data_source: service
    data_component: service metadata
  behavior:
    source: service
    relationship: started
    target: null
  security_events:
  - event_id: '4'
    name: Sysmon service state changed.
    platform: windows
    audit_category: ServiceStateChange
    channel: Microsoft-Windows-Sysmon/Operational
    log_source: Microsoft-Windows-Sysmon
    event_version:
    - '4.32'
  - event_id: '6005'
    name: The Event log service was started.
    platform: windows
    channel: System
    log_source: EventLog
  references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-4-sysmon-service-state-changed
  notes: null
- relationship_id: REL-2022-0185
  name: User modified Group
  contributors:
  - Ruben Bouman @rubinatorz
  attack:
    data_source: group
    data_component: group modification
  behavior:
    source: user
    relationship: modified
    target: group
  security_events:
  - event_id: '4728'
    name: A member was added to a security-enabled global group.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4729'
    name: A member was removed from a security-enabled global group.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4732'
    name: A member was added to a security-enabled local group.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4733'
    name: A member was removed from a security-enabled local group.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4735'
    name: A security-enabled local group was changed.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4737'
    name: A security-enabled global group was changed.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4755'
    name: A security-enabled universal group was changed.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4756'
    name: A member was added to a security-enabled universal group.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4757'
    name: A member was removed from a security-enabled universal group.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  - event_id: '4764'
    name: A groups type was changed.
    platform: windows
    audit_category: Account Management
    audit_sub_category: Security Group Management
    channel: Security
    log_source: Microsoft-Windows-Security-Auditing
    event_version:
    - '0'
  references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-security-group-management
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4733
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4735
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4764
  notes: null