QLean for IBM Security

www.scnsoft.com
QRadar SIEM: Admin Guide

MITRE Windows Integration App

for IBM Security QRadar SIEM

ADMIN GUIDE

© 2021 ScienceSoft| Page 1 from 43

 MITRE Windows Integration App:
Admin Guide

Table of Contents
Overview.....................................................................................................................................3
Supported Versions ...................................................................................................................3
Extension Installation ................................................................................................................3
Downloading Extension ............................................................................................................... 3
Installing Extension ..................................................................................................................... 4
App Description .........................................................................................................................4
Rules overview ........................................................................................................................... 4
Rules structure ........................................................................................................................... 5
Application side .......................................................................................................................... 6
Prerequisites ..............................................................................................................................7
Configuring WinCollect Agent ....................................................................................................... 8
Configuring Sysmon.................................................................................................................... 9
Usage........................................................................................................................................10
Add legitimate Windows Users and Machine (host) ........................................................................ 10
Map rules to MITRE Techniques via Use Case Manager (Optional) .................................................. 10
- Manually ........................................................................................................................... 10
- Automatically ..................................................................................................................... 11
Troubleshooting .......................................................................................................................12
Appendix A: Release notes......................................................................................................13
Appendix B: Custom Properties ..............................................................................................14
Appendix C: Custom Rules......................................................................................................15

© 2021 ScienceSoft | Page 2 from 43

 MITRE Windows Integration App:
Admin Guide

Overview
MITRE Windows Integration App tactics by ScienceSoft are based on the logs provided by a Microsoft Sysmon
tool that is configured in a certain way.
System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system,
remains resident across system reboots to monitor and log system activity to the Windows event log. It
provides detailed information about process creations, network connections, and changes to file creation time.
By collecting the events it generates using Windows Event Collection or SIEM agents and subsequently
analyzing them, you can identify malicious or anomalous activity and understand how intruders and malware
operate on your network.
While massively tested and tuned, some rules are disabled by default to prevent potential false-positives on
the production SIEM environment, so make sure to enable them after the Sysmon configuration is done.
IMPORTANT: This complimentary application is a part of the full set of the MITRE Windows Integration App
created by ScienceSoft. You can request this package as a commercial product along with the professional
services support for Sysmon configuration and troubleshooting at [email protected].

Supported Versions
Supported QRadar versions are:
 7.3.2 GA and higher

NOTE: this solution is developed by ScienceSoft and is not supported by IBM. You can request your own
custom QRadar application to be developed via the following email address: [email protected].

Extension Installation
The current application is distributed as a QRadar extension. In order to install it, please follow the steps below:

Downloading Extension
 Go to https://exchange.xforce.ibmcloud.com/hub
 Log in using your IBMid
 Filter by Type: Custom Rule

© 2021 ScienceSoft | Page 3 from 43

 MITRE Windows Integration App:
Admin Guide

 Select MITRE Windows Integration App extension

 Click Download button at the top right corner
 Save the extension zip file

Installing Extension
 Log in to the QRadar UI
 Go to Admin tab
 Open Extensions Management
 Click Add button
 Select Install immediately checkbox, click Browse button, locate the extension file downloaded
from IBM App Exchange, and click Add button
 Confirm all the steps and wait for installation to finish. This may take a while.
 Close Extensions Management window, press Ctrl+F5 to fully reload QRadar UI.
 Deploy changes if requested by QRadar

App Description
Rules overview
To get the list of MITRE ATT&CK rules please follow the steps below.
 Go to Offense tab
 Click Rules link

 Click Group drop-down and select a MITRE group.

© 2021 ScienceSoft | Page 4 from 43

 MITRE Windows Integration App:
Admin Guide

Rules structure
Click any MITRE ATT&CK group rule for more details.

IMPORTANT: In order to make MITRE ATT&CK rules to trigger, you must configure Sysmon for every rule
you are interested in. The Notes section of every rule contains a detailed configuration to be performed.
Please scroll down the Notes section to review the whole configuration guide for the rule.

Press Next (3) button to check Rule Response part.

© 2021 ScienceSoft | Page 5 from 43

 MITRE Windows Integration App:
Admin Guide

The following wizard page shows the CRE event that will be generated when the rule triggers. Event Name
field contains the unique id and name of MITRE ATT&CK tactics. Event Description field contains a short
description.

Application side
The application has the following tabs:
 Authentication token – with this tab you automatically map the MITRE ATT&CK rules with Use Case
Manager. Check Usage paragraph of this guide.
 Hints – contains description and short instruction how to configure a Sysmon service.

© 2021 ScienceSoft | Page 6 from 43

 MITRE Windows Integration App:
Admin Guide

 Sysmon Rules – a text form where you can copy or download all Sysmon queries related to this rules
set.

Prerequisites
The following software versions are required for proper configuration of audit settings and forwarding to IBM
QRadar:
 WinCollect Agent 7.2.8 or higher
 Sysmon 12.03 or higher

To verify if Sysmon is present and running on your Windows host, verify these steps:
With powershell (as admin):
get-service sysmon*

With GUI:
 Open run menu, type Win + R
 Type in opened window: services.msc
 Find Sysmon or Sysmon64, verify if it installed and running

© 2021 ScienceSoft | Page 7 from 43

 MITRE Windows Integration App:
Admin Guide

In the same way for WinCollect:

With powershell (as admin):
get-service wincollect

With GUI:
 Open run menu, type Win + R
 Type in opened window: services.msc
 Find WinCollect, verify if it installed and running

Configuring WinCollect Agent

WinCollect is a Syslog event forwarder that administrators can use to forward events from Windows logs to
QRadar. WinCollect can collect events from systems locally or be configured to remotely poll other Windows
systems for events.
For WinCollect installation, please refer to the IBM documentation.

© 2021 ScienceSoft | Page 8 from 43

 MITRE Windows Integration App:
Admin Guide

We recommend use following XPath queries for WinCollect configuration:

<QueryList>
<Query Id="0" Path="Events Of Interest">
<Select Path="Security">*</Select>
<Suppress Path="Security">(*[System[(EventID=5154 or EventID=5156 or EventID=5157 or
EventID=5158)]]) or (*[(EventData[Data[@Name='SubjectUserName'] = 'ANONYMOUS LOGON'] or
EventData[Data[@Name='TargetUserName'] = 'ANONYMOUS LOGON'])])</Suppress>
<Select Path="System">(*[System[(EventID=104 or EventID=1056 or EventID=7000 or EventID=7011 or
EventID=7013 or EventID=7030 or EventID=7031 or EventID=7035 or EventID=7036 or EventID=7040 or
EventID=7045)]])</Select>
<Select Path="Application">(*[((System[Provider[@Name='MsiInstaller'] and (EventID=1022 or
EventID=1033 or EventID=1034)]) or System[(Level=2) and (EventID=1000)])])</Select>
<Select Path="Microsoft-Windows-PowerShell/Admin">*</Select>
<Select Path="Microsoft-Windows-PowerShell/Operational">(*[System[(EventID = 4103 or EventID =
4104)]])</Select>
<Select Path="Microsoft-Windows-AppLocker/EXE and DLL">(*[(System[(EventID=8002) and
UserData/RuleAndFileData/PolicyName!="DLL"]) or System[(EventID=8003 or EventID=8004)]])</Select>
<Select Path="Microsoft-Windows-AppLocker/MSI and Script">(*[System[(EventID=8005 or EventID=8006
or EventID=8007)]])</Select>
<Select Path="Microsoft-Windows-Sysmon/Operational">(*[System[(EventID=1 or EventID=3 or
EventID=7 or EventID=8 or EventID=9 or EventID=10 or EventID=11 or EventID=12 or EventID=13 or
EventID=14 or EventID=17 or EventID=18 or EventID=19 or EventID=20 or EventID=21)]])</Select>
<Select Path="Microsoft-Windows-Security-
Mitigations/KernelMode">(*[System[Provider[@Name='Microsoft-Windows-Security-Mitigations' or
@Name='Microsoft-Windows-WER-Diag' or @Name='Microsoft-Windows-Win32k' or @Name='Win32k'] and
((EventID >= 1 and EventID <= 24) or EventID=5 or EventID=260)]])</Select>
<Select Path="Microsoft-Windows-Security-
Mitigations/UserMode">(*[System[Provider[@Name='Microsoft-Windows-Security-Mitigations' or
@Name='Microsoft-Windows-WER-Diag' or @Name='Microsoft-Windows-Win32k' or @Name='Win32k'] and
((EventID >= 1 and EventID <= 24) or EventID=5 or EventID=260)]])</Select>
</Query>
</QueryList>

Configuring Sysmon
Sysmon is a free solution initially developed by Mark Russinovich and Thomas Garnier from former Winternals
Software company and currently maintained by Microsoft. The tool is designed to extend the current logging
capabilities in Windows to aid in understanding and detecting attackers by behavior. It was developed originally
for internal use at Microsoft.
All of the events generated by Sysmon are saved in Microsoft-Windows-Sysmon/Operational EventLog in
order to accommodate security products that already leverage the EventLog, and to make the events easier
to view and collect.
Download an installation file from Microsoft. The tool supports 64-bit and 32-bit systems and uses a single
command line tool for installation and configuration management. Extract it to any folder and run a command:
sysmon64.exe –I sysmon.xml

Where sysmon.xml is pre-created configuration file:

Sample of configuration:
<Sysmon schemaversion="4.22">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<FileCreate onmatch="include">
<Rule groupRelation="or">
<TargetFilename name="T1170" condition="end with">.hta</TargetFilename>
</Rule>
</RuleGroup>
</EventFiltering>
</Sysmon>

© 2021 ScienceSoft | Page 9 from 43

 MITRE Windows Integration App:
Admin Guide

NOTE: Find full configuration file in Application UI Form

To update the current configuration, run the following command:

C:\Windows\Sysmon64.exe –c sysmon.xml

NOTE: You can easily install and configure both WinCollect Agent and Sysmon in an automated mode on
multiple windows hosts using required XPath and Sysmon configuration with IBM-validated professional
solution called QWAD QWAD WinCollect Assisted Deployment available on IBM App Exchange.

Usage
Add legitimate Windows Users and Machine (host)
Most of the rules do have the following test defined in rule logic:
and NOT when any of User are contained in any of MITRE: Windows Users Whitelist
- AlphaNumeric (Ignore Case)
and NOT when any of Machine ID (custom) are contained in any of MITRE: Windows Machines Whitelist
- AlphaNumeric (Ignore Case)

Add legitimate user names to the MITRE: Windows Users Whitelist and MITRE: Windows Machines
Whitelist reference sets in order to avoid false-positive offenses.
NOTE: Please refer to Appendix C for complete list of rules available in this package.

Map rules to MITRE Techniques via Use Case Manager (Optional)

Windows MITRE rules can be mapped to MITRE Techniques with UCM Use Case Manager that you can get
from IBM App Exchange.
There are two ways to do that: manually in Use Case Manager, or automatically via MITRE Windows
Integration App application.

- Manually
To map techniques click ATT&CK™ Action button on the main page of Use Case Manager and select Import.

Click an upload icon and select a map file with .json extension, then click Import.

© 2021 ScienceSoft | Page 10 from 43

 MITRE Windows Integration App:
Admin Guide

You can download a mapping json file from Application. Open MITRE Windows App interface. Move to Hints
tab, then click Download Mapping File button.

- Automatically
 Login to QRadar UI
 Go to Admin tab
 Create new Authorized Service
 Open the MITRE Windows Integration App interface
 On the initial run you’ll be presented with a configuration field to enter Authorization Token
 Enter Authorization Token generated on previous step (1)
 Press Save button to save configuration

© 2021 ScienceSoft | Page 11 from 43

 MITRE Windows Integration App:
Admin Guide

After that the app will once map all rules from it. Check the status bar to be sure that has happened.

NOTE: Be sure that you have Use Case Manager installed.

Troubleshooting
This application is provided “as-is”. You can provide any suggestions how to make it better and request
professional services support for Sysmon configuration and troubleshooting at [email protected].

© 2021 ScienceSoft | Page 12 from 43

 MITRE Windows Integration App:
Admin Guide

Appendix A: Release notes

1.0.0
Initial version

© 2021 ScienceSoft | Page 13 from 43

 MITRE Windows Integration App:
Admin Guide

Appendix B: Custom Properties

Several custom properties are provided to enhance Sysmon events normalization. The custom properties
listed below will be installed automatically along with the application.
Name Description Regex
Target User Name Default custom extraction of Target User Target.*?Account
Machine ID Name
Defaultfrom DSMextraction
custom payload. of Machine ID. Computer=([^\s]+)
Name[\:\\\=\s]+(.*?)\s+(?:Account
Sysmon Rule Name from DSM
Name payload.
of rule that triggered the event. Domain| Target Domain:| &amp;&amp;| \s)
RuleName:\s+(.+)\s+Utc

© 2021 ScienceSoft | Page 14 from 43

 MITRE Windows Integration App:
Admin Guide

Appendix C: Custom Rules

Complete list of rules provided with application:
Rule Name Logic Notes

MITRE.WIN.T1003.005.RULE when the event(s) were This is rule based on Sysmon

OS Credential Dumping: detected by one or more of configuration. Following options should
Cached Domain Credentials Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1003.005"
Sysmon Rule Name (custom) is condition="contains">HKLM\SECURITY\C
any of T1003 ACHE</CommandLine>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1007.RULE when the event(s) were This is rule based on Sysmon
System Service Discovery detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <OriginalFileName name="T1007"
Sysmon Rule Name (custom) is condition="contains">LoadOrd</Original
any of T1007 FileName>
AND NOT when any of Machine <OriginalFileName name="T1007"
ID (custom) are contained in condition="is">PsService.exe</OriginalFil
any of MITRE: Windows eName>
Machines Whitelist -
AlphaNumeric Get more Windows MITRE rules:
AND NOT when any of https://www.scnsoft.com/services/securi
Username are contained in any ty/siem/windows-mitre-attack-rules
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1012.RULE when the event(s) were This is rule based on Sysmon
Query Registry detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <OriginalFileName name="T1012"
Sysmon Rule Name (custom) is condition="contains">Regsize</OriginalFi
any of T1012 leName>

© 2021 ScienceSoft | Page 15 from 43

 MITRE Windows Integration App:
Admin Guide

AND NOT when any of Machine <OriginalFileName name="T1012"

ID (custom) are contained in condition="is">ru.exe</OriginalFileName
any of MITRE: Windows >
Machines Whitelist -
AlphaNumeric Get more Windows MITRE rules:
AND NOT when any of https://www.scnsoft.com/services/securi
Username are contained in any ty/siem/windows-mitre-attack-rules
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1021.001.RULE when the event(s) were This is rule based on Sysmon
Remote Services: Remote detected by one or more of configuration. Following options should
Desktop Protocol Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1021.001"
AND when the event matches condition="is">HKLM\SOFTWARE\Policie
Sysmon Rule Name (custom) is s\Microsoft\Windows NT\Terminal
any of T1021 Services</TargetObject>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1021.003.RULE when the event(s) were This is rule based on Sysmon
Remote Services: detected by one or more of configuration. Following options should
Distributed Component Microsoft Windows Security be enable:
Object Model Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1021.003"
AND when the event matches condition="is">HKLM\SOFTWARE\Micros
Sysmon Rule Name (custom) is oft\Ole</TargetObject>
any of T1021
AND NOT when any of Machine Get more Windows MITRE rules:
ID (custom) are contained in https://www.scnsoft.com/services/securi
any of MITRE: Windows ty/siem/windows-mitre-attack-rules
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1021.006.RULE when the event(s) were This is rule based on Sysmon
Remote Services: Windows detected by one or more of configuration. Following options should
Remote Management Microsoft Windows Security be enable:
Event Log

© 2021 ScienceSoft | Page 16 from 43

 MITRE Windows Integration App:
Admin Guide

AND when the event matches In section <ProcessCreate

Event ID is any of [1 or 3] onmatch="include"> add following lines:
AND when the event matches <Image name="T1021.006"
Sysmon Rule Name (custom) is condition="image">winrm.cmd</Image>
any of T1021 <OriginalFileName name="T1021.006"
AND NOT when any of Machine condition="is">wsmprovhost.exe</Origin
ID (custom) are contained in alFileName>
any of MITRE: Windows
Machines Whitelist - In section <NetworkConnect
AlphaNumeric onmatch="include"> add following lines:
AND NOT when any of <DestinationPort name="T1021.006"
Username are contained in any condition="is">5986</DestinationPort>
of MITRE: Windows Users
Whitelist - AlphaNumeric Get more Windows MITRE rules:
https://www.scnsoft.com/services/securi
ty/siem/windows-mitre-attack-rules
MITRE.WIN.T1027.RULE when the event(s) were This is rule based on Sysmon
Obfuscated Files or detected by one or more of configuration. Following options should
Information Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1027"
Sysmon Rule Name (custom) is condition="contains">ˆ</CommandLine>
any of T1027 <CommandLine name="T1027"
AND NOT when any of Machine condition="contains">../../</CommandLi
ID (custom) are contained in ne>
any of MITRE: Windows
Machines Whitelist - Get more Windows MITRE rules:
AlphaNumeric https://www.scnsoft.com/services/securi
AND NOT when any of ty/siem/windows-mitre-attack-rules
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1037.001.RULE when the event(s) were This is rule based on Sysmon
Boot or Logon Initialization detected by one or more of configuration. Following options should
Scripts: Logon Script Microsoft Windows Security be enable:
(Windows) Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1037.001"
AND when the event matches condition="contains">HKCU\Environment
Sysmon Rule Name (custom) is \UserInitMprLogonScript</TargetObject>
any of T1037 <TargetObject name="T1037.001"
AND NOT when any of Machine condition="contains">HKEY_CURRENT_U
ID (custom) are contained in SER\Environment
any of MITRE: Windows "UserInitMprLogonScript"</TargetObject
Machines Whitelist - >
AlphaNumeric
AND NOT when any of Get more Windows MITRE rules:
Username are contained in any

© 2021 ScienceSoft | Page 17 from 43

 MITRE Windows Integration App:
Admin Guide

of MITRE: Windows Users https://www.scnsoft.com/services/securi

Whitelist - AlphaNumeric ty/siem/windows-mitre-attack-rules
MITRE.WIN.T1037.005.RULE when the event(s) were This is rule based on Sysmon
Boot or Logon Initialization detected by one or more of configuration. Following options should
Scripts: Startup Items Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <FileCreate
Event ID is any of [11] onmatch="include"> add following lines:
AND when the event matches <TargetFilename name="T1037.005"
Sysmon Rule Name (custom) is condition="contains">\Startup\</TargetFi
any of T1037 lename>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1040.RULE when the event(s) were This is rule based on Sysmon
Network Sniffing detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <OriginalFileName name="T1040"
Sysmon Rule Name (custom) is condition="is">PktMon.exe</OriginalFile
any of T1040 Name>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1049.RULE when the event(s) were This is rule based on Sysmon
System Network detected by one or more of configuration. Following options should
Connections Discovery Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1 or 3 or 17 onmatch="include"> add following lines:
or 18] <OriginalFileName name="T1049"
AND when the event matches condition="is">netstat.exe</OriginalFileN
Sysmon Rule Name (custom) is ame>
any of T1049
AND NOT when any of Machine In section <NetworkConnect
ID (custom) are contained in onmatch="include"> add following lines:
any of MITRE: Windows <Image name="T1049"

© 2021 ScienceSoft | Page 18 from 43

 MITRE Windows Integration App:
Admin Guide

Machines Whitelist - condition="image">netstat.exe</Image>

AlphaNumeric
AND NOT when any of In section <PipeEvent
Username are contained in any onmatch="include"> add following lines:
of MITRE: Windows Users <PipeName name="T1049"
Whitelist - AlphaNumeric condition="begin
with">\srvsvc</PipeName>

Get more Windows MITRE rules:

https://www.scnsoft.com/services/securi
ty/siem/windows-mitre-attack-rules
MITRE.WIN.T1052.001.RULE when the event(s) were No action required.
Exfiltration Over Physical detected by one or more of
Medium: Exfiltration over Microsoft Windows Security Get more Windows MITRE rules:
USB Event Log https://www.scnsoft.com/services/securi
AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of [2003 or 2004
or 2006 or 2010 or 2100 or
2101 or 2105 or 2106]
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1053.RULE when the event(s) were This is rule based on Sysmon
Scheduled Task/Job detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1 or 3 or 7 or onmatch="include"> add following lines:
11] <OriginalFileName name="T1053"
AND when the event matches condition="contains
Sysmon Rule Name (custom) is any">schtasks.exe;sctasks.exe</OriginalFi
any of T1053 leName>
AND NOT when any of Machine <OriginalFileName name="T1053"
ID (custom) are contained in condition="is">taskeng.exe</OriginalFile
any of MITRE: Windows Name>
Machines Whitelist -
AlphaNumeric In section <NetworkConnect
AND NOT when any of onmatch="include"> add following lines:
Username are contained in any <Image name="T1053"
of MITRE: Windows Users condition="image">schtasks.exe</Image
Whitelist - AlphaNumeric >
<Image name="T1053"
condition="image">at.exe</Image>
<Image name="T1053"
condition="image">taskeng.exe</Image>

© 2021 ScienceSoft | Page 19 from 43

 MITRE Windows Integration App:
Admin Guide

In section <ImageLoad
onmatch="include"> add following lines:
<ImageLoaded name="T1053"
condition="end
with">taskschd.dll</ImageLoaded>

In section <FileCreate
onmatch="include"> add following lines:
<TargetFilename name="T1053"
condition="begin
with">C:\Windows\SysWOW64\Tasks</T
argetFilename>
<TargetFilename name="T1053"
condition="begin
with">C:\Windows\system32\Tasks</Tar
getFilename>
<TargetFilename name="T1053"
condition="begin
with">C:\Windows\Tasks\</TargetFilena
me>

Get more Windows MITRE rules:

https://www.scnsoft.com/services/securi
ty/siem/windows-mitre-attack-rules
MITRE.WIN.T1053.002.RULE when the event(s) were No action required.
Scheduled Task/Job: At detected by one or more of
(Windows) Microsoft Windows Security Get more Windows MITRE rules:
Event Log https://www.scnsoft.com/services/securi
AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of [106 or 140 or
141 or 4698 or 4700 or 4701]
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1053.005.RULE when the event(s) were No action required.
Scheduled Task/Job: detected by one or more of
Scheduled Task Microsoft Windows Security Get more Windows MITRE rules:
Event Log https://www.scnsoft.com/services/securi
AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of [106 or 140 or
141 or 4698 or 4700 or 4701]
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows

© 2021 ScienceSoft | Page 20 from 43

 MITRE Windows Integration App:
Admin Guide

Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1056.001.RULE when the event(s) were This is rule based on Sysmon
Input Capture: Keylogging detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1056.001"
AND when the event matches condition="contains">\SOFTWARE\Micro
Sysmon Rule Name (custom) is soft\Windows\CurrentVersion\Capability
any of T1056 AccessManager\ConsentStore\hunmanIn
AND NOT when any of Machine terfaceDevice</TargetObject>
ID (custom) are contained in
any of MITRE: Windows Get more Windows MITRE rules:
Machines Whitelist - https://www.scnsoft.com/services/securi
AlphaNumeric ty/siem/windows-mitre-attack-rules
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1059.006.RULE when the event(s) were This is rule based on Sysmon
Command and Scripting detected by one or more of configuration. Following options should
Interpreter: Python Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <Image name="T1059.006"
Sysmon Rule Name (custom) is condition="image">python.exe</Image>
any of T1059
AND NOT when any of Machine Get more Windows MITRE rules:
ID (custom) are contained in https://www.scnsoft.com/services/securi
any of MITRE: Windows ty/siem/windows-mitre-attack-rules
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1059.007.RULE when the event(s) were This is rule based on Sysmon
Command and Scripting detected by one or more of configuration. Following options should
Interpreter: Microsoft Windows Security be enable:
JavaScript/JScript Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <Image name="T1059.007"
Sysmon Rule Name (custom) is condition="image">cscript.exe</Image>

© 2021 ScienceSoft | Page 21 from 43

 MITRE Windows Integration App:
Admin Guide

any of T1059 <Image name="T1059.007"

AND NOT when any of Machine condition="image">wscript.exe</Image>
ID (custom) are contained in
any of MITRE: Windows Get more Windows MITRE rules:
Machines Whitelist - https://www.scnsoft.com/services/securi
AlphaNumeric ty/siem/windows-mitre-attack-rules
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1069.RULE when the event(s) were This is rule based on Sysmon
Permission Groups detected by one or more of configuration. Following options should
Discovery Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <NetworkConnect
Event ID is any of [3] onmatch="include"> add following lines:
AND when the event matches <Image name="T1069"
Sysmon Rule Name (custom) is condition="image">net1.exe</Image>
any of T1069
AND NOT when any of Machine Get more Windows MITRE rules:
ID (custom) are contained in https://www.scnsoft.com/services/securi
any of MITRE: Windows ty/siem/windows-mitre-attack-rules
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1069.001.RULE when the event(s) were This is rule based on Sysmon
Permission Groups detected by one or more of configuration. Following options should
Discovery: Local Groups Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1069.001"
Sysmon Rule Name (custom) is condition="contains">net
any of T1069 localgroup</CommandLine>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1069.002.RULE when the event(s) were This is rule based on Sysmon
Permission Groups detected by one or more of configuration. Following options should
Discovery: Domain Groups Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate

© 2021 ScienceSoft | Page 22 from 43

 MITRE Windows Integration App:
Admin Guide

Event ID is any of [1] onmatch="include"> add following lines:

AND when the event matches <CommandLine name="T1069.002"
Sysmon Rule Name (custom) is condition="contains">net group
any of T1069 /domain</CommandLine>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1070.RULE when the event(s) were This is rule based on Sysmon
Indicator Removal on Host detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1 or 3] onmatch="include"> add following lines:
AND when the event matches <OriginalFileName name="T1070"
Sysmon Rule Name (custom) is condition="is">wevtutil.exe</OriginalFile
any of T1070 Name>
AND NOT when any of Machine
ID (custom) are contained in In section <NetworkConnect
any of MITRE: Windows onmatch="include"> add following lines:
Machines Whitelist - <Image name="T1070"
AlphaNumeric condition="image">wevtutil.exe</Image>
AND NOT when any of
Username are contained in any Get more Windows MITRE rules:
of MITRE: Windows Users https://www.scnsoft.com/services/securi
Whitelist - AlphaNumeric ty/siem/windows-mitre-attack-rules
MITRE.WIN.T1070.001.RULE when the event(s) were No action required.
Indicator Removal on Host: detected by one or more of
Clear Windows Event Logs Microsoft Windows Security Get more Windows MITRE rules:
Event Log https://www.scnsoft.com/services/securi
AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of [1102]
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1070.005.RULE when the event(s) were This is rule based on Sysmon
Indicator Removal on Host: detected by one or more of configuration. Following options should
Network Share Connection Microsoft Windows Security be enable:
Removal Event Log
AND when the event matches In section <ProcessCreate

© 2021 ScienceSoft | Page 23 from 43

 MITRE Windows Integration App:
Admin Guide

Event ID is any of [1] onmatch="include"> add following lines:

AND when the event matches <CommandLine name="T1070.005"
Sysmon Rule Name (custom) is condition="contains
any of T1070 any">netuse;net1use</CommandLine>
AND NOT when any of Machine <CommandLine name="T1070.005"
ID (custom) are contained in condition="contains
any of MITRE: Windows any">\\;delete</CommandLine>
Machines Whitelist -
AlphaNumeric Get more Windows MITRE rules:
AND NOT when any of https://www.scnsoft.com/services/securi
Username are contained in any ty/siem/windows-mitre-attack-rules
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1074.RULE when the event(s) were This is rule based on Sysmon
Data Staged detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <OriginalFileName name="T1074"
Sysmon Rule Name (custom) is condition="is">robocopy.exe</OriginalFil
any of T1074 eName>
AND NOT when any of Machine <OriginalFileName name="T1074"
ID (custom) are contained in condition="is">xcopy.exe</OriginalFileNa
any of MITRE: Windows me>
Machines Whitelist -
AlphaNumeric Get more Windows MITRE rules:
AND NOT when any of https://www.scnsoft.com/services/securi
Username are contained in any ty/siem/windows-mitre-attack-rules
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1078.RULE when the event(s) were This is rule based on Sysmon
Valid Accounts detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <OriginalFileName name="T1078"
Sysmon Rule Name (custom) is condition="is">djoin.exe</OriginalFileNa
any of T1078 me>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric

© 2021 ScienceSoft | Page 24 from 43

 MITRE Windows Integration App:
Admin Guide

MITRE.WIN.T1082.RULE when the event(s) were This is rule based on Sysmon

System Information detected by one or more of configuration. Following options should
Discovery Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1082"
Sysmon Rule Name (custom) is condition="contains any">systeminfo;net
any of T1082 config
AND NOT when any of Machine workstation;hostname;ver;set;date
ID (custom) are contained in /t</CommandLine>
any of MITRE: Windows
Machines Whitelist - Get more Windows MITRE rules:
AlphaNumeric https://www.scnsoft.com/services/securi
AND NOT when any of ty/siem/windows-mitre-attack-rules
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1087.RULE when the event(s) were This is rule based on Sysmon
Account Discovery detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <OriginalFileName name="T1087"
Sysmon Rule Name (custom) is condition="is">cmdkey.exe</OriginalFile
any of T1087 Name>
AND NOT when any of Machine <OriginalFileName name="T1087"
ID (custom) are contained in condition="is">klist.exe</OriginalFileNam
any of MITRE: Windows e>
Machines Whitelist -
AlphaNumeric Get more Windows MITRE rules:
AND NOT when any of https://www.scnsoft.com/services/securi
Username are contained in any ty/siem/windows-mitre-attack-rules
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1087.001.RULE when the event(s) were This is rule based on Sysmon
Account Discovery: Local detected by one or more of configuration. Following options should
Account Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1087.001"
Sysmon Rule Name (custom) is condition="contains any">net user;net
any of T1087 localgroup</CommandLine>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of

© 2021 ScienceSoft | Page 25 from 43

 MITRE Windows Integration App:
Admin Guide

Username are contained in any

of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1087.002.RULE when the event(s) were This is rule based on Sysmon
Account Discovery: Domain detected by one or more of configuration. Following options should
Account Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1087.002"
Sysmon Rule Name (custom) is condition="contains any">net user
any of T1087 /domain;net group
AND NOT when any of Machine /domain</CommandLine>
ID (custom) are contained in
any of MITRE: Windows Get more Windows MITRE rules:
Machines Whitelist - https://www.scnsoft.com/services/securi
AlphaNumeric ty/siem/windows-mitre-attack-rules
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1114.001.RULE when the event(s) were This is rule based on Sysmon
Email Collection: Local Email detected by one or more of configuration. Following options should
Collection Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1114.001"
Sysmon Rule Name (custom) is condition="contains
any of T1114 any">\AppData\Local\Microsoft\Outlook;
AND NOT when any of Machine \Documents\Outlook
ID (custom) are contained in Files</CommandLine>
any of MITRE: Windows
Machines Whitelist - Get more Windows MITRE rules:
AlphaNumeric https://www.scnsoft.com/services/securi
AND NOT when any of ty/siem/windows-mitre-attack-rules
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1123.RULE when the event(s) were This is rule based on Sysmon
Audio Capture detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1123"
AND when the event matches condition="contains">\SOFTWARE\Micro
Sysmon Rule Name (custom) is soft\Windows\CurrentVersion\Capability
any of T1123 AccessManager\ConsentStore\bluetooth
AND NOT when any of Machine </TargetObject>
ID (custom) are contained in <TargetObject name="T1123"

© 2021 ScienceSoft | Page 26 from 43

 MITRE Windows Integration App:
Admin Guide

any of MITRE: Windows condition="contains">\SOFTWARE\Micro

Machines Whitelist - soft\Windows\CurrentVersion\Capability
AlphaNumeric AccessManager\ConsentStore\micropho
AND NOT when any of ne</TargetObject>
Username are contained in any
of MITRE: Windows Users Get more Windows MITRE rules:
Whitelist - AlphaNumeric https://www.scnsoft.com/services/securi
ty/siem/windows-mitre-attack-rules
MITRE.WIN.T1125.RULE when the event(s) were This is rule based on Sysmon
Video Capture detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1125"
AND when the event matches condition="contains">\SOFTWARE\Micro
Sysmon Rule Name (custom) is soft\Windows\CurrentVersion\Capability
any of T1125 AccessManager\ConsentStore\webcam</
AND NOT when any of Machine TargetObject>
ID (custom) are contained in
any of MITRE: Windows Get more Windows MITRE rules:
Machines Whitelist - https://www.scnsoft.com/services/securi
AlphaNumeric ty/siem/windows-mitre-attack-rules
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1127.001.RULE when the event(s) were This is rule based on Sysmon
Trusted Developer Utilities detected by one or more of configuration. Following options should
Proxy Execution: MSBuild Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <OriginalFileName name="T1127.001"
Sysmon Rule Name (custom) is condition="is">MSBuild.exe</OriginalFile
any of T1127 Name>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1137.002.RULE when the event(s) were This is rule based on Sysmon
Office Application Startup: detected by one or more of configuration. Following options should
Office Test Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:

© 2021 ScienceSoft | Page 27 from 43

 MITRE Windows Integration App:
Admin Guide

14] <TargetObject name="T1137.002"

AND when the event matches condition="end
Sysmon Rule Name (custom) is with">Software\Microsoft\Office
any of T1137 test\Special\Perf</TargetObject>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1187.RULE when the event(s) were This is rule based on Sysmon
Forced Authentication detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <FileCreate
Event ID is any of [11] onmatch="include"> add following lines:
AND when the event matches <TargetFilename name="T1187"
Sysmon Rule Name (custom) is condition="end
any of T1187 with">.scf</TargetFilename>
AND NOT when any of Machine <TargetFilename name="T1187"
ID (custom) are contained in condition="end
any of MITRE: Windows with">.lnk</TargetFilename>
Machines Whitelist -
AlphaNumeric Get more Windows MITRE rules:
AND NOT when any of https://www.scnsoft.com/services/securi
Username are contained in any ty/siem/windows-mitre-attack-rules
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1200.RULE when the event(s) were No action required.
Hardware Additions detected by one or more of
Microsoft Windows Security Get more Windows MITRE rules:
Event Log https://www.scnsoft.com/services/securi
AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of [2003 or 2004
or 2006 or 2010 or 2100 or
2102 or 2101 or 2105 or 2106]
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1218.001.RULE when the event(s) were This is rule based on Sysmon
Signed Binary Proxy detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:

© 2021 ScienceSoft | Page 28 from 43

 MITRE Windows Integration App:
Admin Guide

Execution: Compiled HTML Event Log

File AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <Image name="T1218.001"
Sysmon Rule Name (custom) is condition="image">hh.exe</Image>
any of T1218
AND NOT when any of Machine Get more Windows MITRE rules:
ID (custom) are contained in https://www.scnsoft.com/services/securi
any of MITRE: Windows ty/siem/windows-mitre-attack-rules
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1218.002.RULE when the event(s) were This is rule based on Sysmon
Signed Binary Proxy detected by one or more of configuration. Following options should
Execution: Control Panel Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1218.002"
Sysmon Rule Name (custom) is condition="contains
any of T1218 all">rundll32.exe;shell32.dll;Control_Run
AND NOT when any of Machine DLL</CommandLine>
ID (custom) are contained in <CommandLine name="T1218.002"
any of MITRE: Windows condition="contains
Machines Whitelist - all">control;/name</CommandLine>
AlphaNumeric
AND NOT when any of Get more Windows MITRE rules:
Username are contained in any https://www.scnsoft.com/services/securi
of MITRE: Windows Users ty/siem/windows-mitre-attack-rules
Whitelist - AlphaNumeric
MITRE.WIN.T1218.003.RULE when the event(s) were This is rule based on Sysmon
Signed Binary Proxy detected by one or more of configuration. Following options should
Execution: CMSTP Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1218.003"
Sysmon Rule Name (custom) is condition="contains
any of T1218 all">/ni;/s</CommandLine>
AND NOT when any of Machine <OriginalFileName name="T1218.003"
ID (custom) are contained in condition="is">CMSTP.exe</OriginalFileN
any of MITRE: Windows ame>
Machines Whitelist -
AlphaNumeric Get more Windows MITRE rules:
AND NOT when any of https://www.scnsoft.com/services/securi
Username are contained in any ty/siem/windows-mitre-attack-rules
of MITRE: Windows Users
Whitelist - AlphaNumeric

© 2021 ScienceSoft | Page 29 from 43

 MITRE Windows Integration App:
Admin Guide

MITRE.WIN.T1218.004.RULE when the event(s) were This is rule based on Sysmon

Signed Binary Proxy detected by one or more of configuration. Following options should
Execution: InstallUtil Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1218.004"
Sysmon Rule Name (custom) is condition="contains
any of T1218 all">/logfile=;/LogToConsole=false;/U</C
AND NOT when any of Machine ommandLine>
ID (custom) are contained in <OriginalFileName name="T1218.004"
any of MITRE: Windows condition="is">InstallUtil.exe</OriginalFil
Machines Whitelist - eName>
AlphaNumeric
AND NOT when any of Get more Windows MITRE rules:
Username are contained in any https://www.scnsoft.com/services/securi
of MITRE: Windows Users ty/siem/windows-mitre-attack-rules
Whitelist - AlphaNumeric
MITRE.WIN.T1218.007.RULE when the event(s) were This is rule based on Sysmon
Signed Binary Proxy detected by one or more of configuration. Following options should
Execution: Msiexec Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <Image name="T1218.007"
Sysmon Rule Name (custom) is condition="image">msiexec.exe</Image>
any of T1218
AND NOT when any of Machine Get more Windows MITRE rules:
ID (custom) are contained in https://www.scnsoft.com/services/securi
any of MITRE: Windows ty/siem/windows-mitre-attack-rules
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1218.008.RULE when the event(s) were This is rule based on Sysmon
Signed Binary Proxy detected by one or more of configuration. Following options should
Execution: Odbcconf Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <Image name="T1218.008"
Sysmon Rule Name (custom) is condition="image">odbcconf.exe</Image
any of T1218 >
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of

© 2021 ScienceSoft | Page 30 from 43

 MITRE Windows Integration App:
Admin Guide

Username are contained in any

of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1218.011.RULE when the event(s) were This is rule based on Sysmon
Signed Binary Proxy detected by one or more of configuration. Following options should
Execution: Rundll32 Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <NetworkConnect
Event ID is any of [3] onmatch="include"> add following lines:
AND when the event matches <Image name="T1218.011"
Sysmon Rule Name (custom) is condition="image">rundll32.exe</Image
any of T1218 >
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1222.001.RULE when the event(s) were No action required.
File and Directory detected by one or more of
Permissions Modification: Microsoft Windows Security Get more Windows MITRE rules:
Windows File and Directory Event Log https://www.scnsoft.com/services/securi
Permissions Modification AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of [4670]
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1482.RULE when the event(s) were This is rule based on Sysmon
Domain Trust Discovery detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1482"
Sysmon Rule Name (custom) is condition="contains
any of T1482 all">"C:\WINDOWS\system32\nltest.exe"
AND NOT when any of Machine /domain_trusts </CommandLine>
ID (custom) are contained in <OriginalFileName name="T1482"
any of MITRE: Windows condition="is">nltestrk.exe</OriginalFile
Machines Whitelist - Name>
AlphaNumeric
AND NOT when any of Get more Windows MITRE rules:

© 2021 ScienceSoft | Page 31 from 43

 MITRE Windows Integration App:
Admin Guide

Username are contained in any https://www.scnsoft.com/services/securi

of MITRE: Windows Users ty/siem/windows-mitre-attack-rules
Whitelist - AlphaNumeric
MITRE.WIN.T1489.RULE when the event(s) were No action required.
Service Stop detected by one or more of
Microsoft Windows Security Get more Windows MITRE rules:
Event Log https://www.scnsoft.com/services/securi
AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of [None]
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1489.RULE when the event(s) were This is rule based on Sysmon
Service Stop [Sysmon] detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <CommandLine name="T1489"
Sysmon Rule Name (custom) is condition="contains any">net stop;Stop-
any of T1489 Service</CommandLine>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1490.RULE when the event(s) were No action required.
Inhibit System Recovery detected by one or more of
Microsoft Windows Security Get more Windows MITRE rules:
Event Log https://www.scnsoft.com/services/securi
AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of [524]
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric

© 2021 ScienceSoft | Page 32 from 43

 MITRE Windows Integration App:
Admin Guide

MITRE.WIN.T1490.RULE when the event(s) were This is rule based on Sysmon

Inhibit System Recovery detected by one or more of configuration. Following options should
[Sysmon] Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <OriginalFileName name="T1490"
Sysmon Rule Name (custom) is condition="is">vassadmin.exe</OriginalFi
any of T1490 leName>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1518.RULE when the event(s) were This is rule based on Sysmon
Software Discovery detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1518"
AND when the event matches condition="contains">SOFTWARE\Micros
Sysmon Rule Name (custom) is oft\Windows\CurrentVersion\App
any of T1518 Paths</TargetObject>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1529.RULE when the event(s) were No action required.
System Shutdown/Reboot detected by one or more of
Microsoft Windows Security Get more Windows MITRE rules:
Event Log https://www.scnsoft.com/services/securi
AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of [1074 or
6006]
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any

© 2021 ScienceSoft | Page 33 from 43

 MITRE Windows Integration App:
Admin Guide

of MITRE: Windows Users

Whitelist - AlphaNumeric
MITRE.WIN.T1546.001.RULE when the event(s) were This is rule based on Sysmon
Event Triggered Execution: detected by one or more of configuration. Following options should
Change Default File Microsoft Windows Security be enable:
Association Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1546.001"
AND when the event matches condition="contains">\Explorer\FileExts<
Sysmon Rule Name (custom) is /TargetObject>
any of T1546
AND NOT when any of Machine Get more Windows MITRE rules:
ID (custom) are contained in https://www.scnsoft.com/services/securi
any of MITRE: Windows ty/siem/windows-mitre-attack-rules
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1546.007.RULE when the event(s) were This is rule based on Sysmon
Event Triggered Execution: detected by one or more of configuration. Following options should
Netsh Helper DLL Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1546.007"
AND when the event matches condition="contains">SOFTWARE\Micros
Sysmon Rule Name (custom) is oft\Netsh</TargetObject>
any of T1546
AND NOT when any of Machine Get more Windows MITRE rules:
ID (custom) are contained in https://www.scnsoft.com/services/securi
any of MITRE: Windows ty/siem/windows-mitre-attack-rules
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1546.009.RULE when the event(s) were This is rule based on Sysmon
Event Triggered Execution: detected by one or more of configuration. Following options should
AppCert DLLs Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1546.009"
AND when the event matches condition="begin
Sysmon Rule Name (custom) is with">HKLM\SYSTEM\CurrentControlSet\
any of T1546 Control\Session
AND NOT when any of Machine Manager\AppCertDlls</TargetObject>

© 2021 ScienceSoft | Page 34 from 43

 MITRE Windows Integration App:
Admin Guide

ID (custom) are contained in

any of MITRE: Windows Get more Windows MITRE rules:
Machines Whitelist - https://www.scnsoft.com/services/securi
AlphaNumeric ty/siem/windows-mitre-attack-rules
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1546.012.RULE when the event(s) were This is rule based on Sysmon
Event Triggered Execution: detected by one or more of configuration. Following options should
Image File Execution Microsoft Windows Security be enable:
Options Injection Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1546.012"
AND when the event matches condition="begin
Sysmon Rule Name (custom) is with">HKLM\SOFTWARE\Wow6432Node
any of T1546 \Microsoft\Windows
AND NOT when any of Machine NT\CurrentVersion\Image File Execution
ID (custom) are contained in Options</TargetObject>
any of MITRE: Windows <TargetObject name="T1546.012"
Machines Whitelist - condition="begin
AlphaNumeric with">HKLM\Software\Microsoft\Windo
AND NOT when any of ws NT\CurrentVersion\Image File
Username are contained in any Execution Options</TargetObject>
of MITRE: Windows Users
Whitelist - AlphaNumeric Get more Windows MITRE rules:
https://www.scnsoft.com/services/securi
ty/siem/windows-mitre-attack-rules
MITRE.WIN.T1546.013.RULE when the event(s) were This is rule based on Sysmon
Event Triggered Execution: detected by one or more of configuration. Following options should
PowerShell Profile Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <FileCreate
Event ID is any of [11] onmatch="include"> add following lines:
AND when the event matches <TargetFilename name="T1546.013"
Sysmon Rule Name (custom) is condition="end
any of T1546 with">\Profile.ps1</TargetFilename>
AND NOT when any of Machine <TargetFilename name="T1546.013"
ID (custom) are contained in condition="end
any of MITRE: Windows with">_profile.ps1</TargetFilename>
Machines Whitelist -
AlphaNumeric Get more Windows MITRE rules:
AND NOT when any of https://www.scnsoft.com/services/securi
Username are contained in any ty/siem/windows-mitre-attack-rules
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1547.002.RULE when the event(s) were This is rule based on Sysmon
Boot or Logon Autostart detected by one or more of configuration. Following options should
Execution: Authentication Microsoft Windows Security be enable:
Package Event Log

© 2021 ScienceSoft | Page 35 from 43

 MITRE Windows Integration App:
Admin Guide

AND when the event matches In section <RegistryEvent

Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1547.002"
AND when the event matches condition="begin
Sysmon Rule Name (custom) is with">HKLM\SYSTEM\CurrentControlSet\
any of T1547 Control\Lsa</TargetObject>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1547.003.RULE when the event(s) were This is rule based on Sysmon
Boot or Logon Autostart detected by one or more of configuration. Following options should
Execution: Time Providers Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1547.003"
AND when the event matches condition="contains">HKEY_LOCAL_MAC
Sysmon Rule Name (custom) is HINE\System\CurrentControlSet\Services
any of T1547 \W32Time\TimeProviders</TargetObject
AND NOT when any of Machine >
ID (custom) are contained in
any of MITRE: Windows Get more Windows MITRE rules:
Machines Whitelist - https://www.scnsoft.com/services/securi
AlphaNumeric ty/siem/windows-mitre-attack-rules
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1547.005.RULE when the event(s) were This is rule based on Sysmon
Boot or Logon Autostart detected by one or more of configuration. Following options should
Execution: Security Support Microsoft Windows Security be enable:
Provider Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1547.005"
AND when the event matches condition="contains">SOFTWARE\Micros
Sysmon Rule Name (custom) is oft\Windows NT\CurrentVersion\Image
any of T1547 File Execution
AND NOT when any of Machine Options\LSASS.exe</TargetObject>
ID (custom) are contained in
any of MITRE: Windows Get more Windows MITRE rules:
Machines Whitelist - https://www.scnsoft.com/services/securi
AlphaNumeric ty/siem/windows-mitre-attack-rules
AND NOT when any of
Username are contained in any

© 2021 ScienceSoft | Page 36 from 43

 MITRE Windows Integration App:
Admin Guide

of MITRE: Windows Users

Whitelist - AlphaNumeric
MITRE.WIN.T1547.008.RULE when the event(s) were This is rule based on Sysmon
Boot or Logon Autostart detected by one or more of configuration. Following options should
Execution: LSASS Driver Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1547.008"
AND when the event matches condition="contains">\CurrentControlSet
Sysmon Rule Name (custom) is \Services\NTDS\DirectoryServiceExtPt</T
any of T1547 argetObject>
AND NOT when any of Machine <TargetObject name="T1547.008"
ID (custom) are contained in condition="contains">\CurrentControlSet
any of MITRE: Windows \Services\NTDS\LsaDbExtPt</TargetObjec
Machines Whitelist - t>
AlphaNumeric
AND NOT when any of Get more Windows MITRE rules:
Username are contained in any https://www.scnsoft.com/services/securi
of MITRE: Windows Users ty/siem/windows-mitre-attack-rules
Whitelist - AlphaNumeric
MITRE.WIN.T1547.009.RULE when the event(s) were This is rule based on Sysmon
Boot or Logon Autostart detected by one or more of configuration. Following options should
Execution: Shortcut Microsoft Windows Security be enable:
Modification Event Log
AND when the event matches In section <FileCreate
Event ID is any of [11] onmatch="include"> add following lines:
AND when the event matches <TargetFilename name="T1547.009"
Sysmon Rule Name (custom) is condition="contains">\Start
any of T1547 Menu</TargetFilename>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1547.010.RULE when the event(s) were This is rule based on Sysmon
Boot or Logon Autostart detected by one or more of configuration. Following options should
Execution: Port Monitors Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1547.010"
AND when the event matches condition="begin
Sysmon Rule Name (custom) is with">HKCU\SOFTWARE\Microsoft\Wind
any of T1547 ows
AND NOT when any of Machine NT\CurrentVersion\Ports</TargetObject>
ID (custom) are contained in <TargetObject name="T1547.010"

© 2021 ScienceSoft | Page 37 from 43

 MITRE Windows Integration App:
Admin Guide

any of MITRE: Windows condition="begin

Machines Whitelist - with">HKLM\SOFTWARE\Microsoft\Wind
AlphaNumeric ows
AND NOT when any of NT\CurrentVersion\Ports</TargetObject>
Username are contained in any
of MITRE: Windows Users Get more Windows MITRE rules:
Whitelist - AlphaNumeric https://www.scnsoft.com/services/securi
ty/siem/windows-mitre-attack-rules
MITRE.WIN.T1550.002.RULE when the event(s) were This is rule based on Sysmon
Use Alternate detected by one or more of configuration. Following options should
Authentication Material: Microsoft Windows Security be enable:
Pass the Hash Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1550.002"
AND when the event matches condition="contains">SOFTWARE\Micros
Sysmon Rule Name (custom) is oft\Windows\CurrentVersion\Policies\Sy
any of T1550 stem\LocalAccountTokenFilterPolicy</Tar
AND NOT when any of Machine getObject>
ID (custom) are contained in
any of MITRE: Windows Get more Windows MITRE rules:
Machines Whitelist - https://www.scnsoft.com/services/securi
AlphaNumeric ty/siem/windows-mitre-attack-rules
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1552.001.RULE when the event(s) were This is rule based on Sysmon
Unsecured Credentials: detected by one or more of configuration. Following options should
Credentials In Files Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <OriginalFileName name="T1552.001"
Sysmon Rule Name (custom) is condition="is">where.exe</OriginalFileN
any of T1552 ame>
AND NOT when any of Machine <OriginalFileName name="T1552.001"
ID (custom) are contained in condition="is">findstr.exe</OriginalFileN
any of MITRE: Windows ame>
Machines Whitelist -
AlphaNumeric Get more Windows MITRE rules:
AND NOT when any of https://www.scnsoft.com/services/securi
Username are contained in any ty/siem/windows-mitre-attack-rules
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1552.002.RULE when the event(s) were This is rule based on Sysmon
Unsecured Credentials: detected by one or more of configuration. Following options should
Credentials in Registry Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:

© 2021 ScienceSoft | Page 38 from 43

 MITRE Windows Integration App:
Admin Guide

AND when the event matches <CommandLine name="T1552.002"

Sysmon Rule Name (custom) is condition="contains">/f password /t
any of T1552 REG_SZ /s</CommandLine>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1553.004.RULE when the event(s) were This is rule based on Sysmon
Subvert Trust Controls: detected by one or more of configuration. Following options should
Install Root Certificate Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1553.004"
AND when the event matches condition="contains">\Microsoft\System
Sysmon Rule Name (custom) is Certificates\Root\Certificates</TargetObj
any of T1553 ect>
AND NOT when any of Machine <TargetObject name="T1553.004"
ID (custom) are contained in condition="begin
any of MITRE: Windows with">HKLM\SOFTWARE\Microsoft\Enter
Machines Whitelist - priseCertificates\Root\Certificates</Targ
AlphaNumeric etObject>
AND NOT when any of
Username are contained in any Get more Windows MITRE rules:
of MITRE: Windows Users https://www.scnsoft.com/services/securi
Whitelist - AlphaNumeric ty/siem/windows-mitre-attack-rules
MITRE.WIN.T1556.RULE when the event(s) were This is rule based on Sysmon
Modify Authentication detected by one or more of configuration. Following options should
Process Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1556"
AND when the event matches condition="contains">\SYSTEM\CurrentC
Sysmon Rule Name (custom) is ontrolSet\Control\Lsa\Notification
any of T1556 Packages</TargetObject>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric

© 2021 ScienceSoft | Page 39 from 43

 MITRE Windows Integration App:
Admin Guide

MITRE.WIN.T1556.001.RULE when the event(s) were This is rule based on Sysmon

Modify Authentication detected by one or more of configuration. Following options should
Process: Domain Controller Microsoft Windows Security be enable:
Authentication Event Log
AND when the event matches In section <ImageLoad
Event ID is any of [7] onmatch="include"> add following lines:
AND when the event matches
Sysmon Rule Name (custom) is Get more Windows MITRE rules:
any of T1556 https://www.scnsoft.com/services/securi
AND NOT when any of Machine ty/siem/windows-mitre-attack-rules
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1556.002.RULE when the event(s) were This is rule based on Sysmon
Modify Authentication detected by one or more of configuration. Following options should
Process: Password Filter DLL Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1556.002"
AND when the event matches condition="contains">\SYSTEM\CurrentC
Sysmon Rule Name (custom) is ontrolSet\Control\Lsa\Notification
any of T1556 Packages</TargetObject>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1557.001.RULE when the event(s) were This is rule based on Sysmon
Man-in-the-Middle: detected by one or more of configuration. Following options should
LLMNR/NBT-NS Poisoning Microsoft Windows Security be enable:
and SMB Relay Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1557.001"
AND when the event matches condition="contains">\Software\Policies\
Sysmon Rule Name (custom) is Microsoft\Windows
any of T1557 NT\DNSClient</TargetObject>
AND NOT when any of Machine
ID (custom) are contained in Get more Windows MITRE rules:
any of MITRE: Windows https://www.scnsoft.com/services/securi
Machines Whitelist - ty/siem/windows-mitre-attack-rules

© 2021 ScienceSoft | Page 40 from 43

 MITRE Windows Integration App:
Admin Guide

AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1558.001.RULE when the event(s) were No action required.
Steal or Forge Kerberos detected by one or more of
Tickets: Golden Ticket Microsoft Windows Security Get more Windows MITRE rules:
Event Log https://www.scnsoft.com/services/securi
AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of [4624 or 4672
or 4634]
AND when the event matches
"Target User Name" != "Logon
Account Name" AQL filter query
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1558.002.RULE when the event(s) were No action required.
Steal or Forge Kerberos detected by one or more of
Tickets: Silver Ticket Microsoft Windows Security Get more Windows MITRE rules:
Event Log https://www.scnsoft.com/services/securi
AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of [4624 or 4672
or 4634]
AND when the event matches
"Target User Name" != "Logon
Account Name" AQL filter query
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1558.003.RULE when the event(s) were No action required.
Steal or Forge Kerberos detected by one or more of
Tickets: Kerberoasting Microsoft Windows Security Get more Windows MITRE rules:
Event Log https://www.scnsoft.com/services/securi
AND when the event matches ty/siem/windows-mitre-attack-rules
Event ID is any of 4769
AND when the event matches
Ticket Encryption Type (custom)

© 2021 ScienceSoft | Page 41 from 43

 MITRE Windows Integration App:
Admin Guide

is any of 0x17
AND NOT when any of Machine
ID (custom) are contained in
any of MITRE: Windows
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1562.002.RULE when the event(s) were This is rule based on Sysmon
Impair Defenses: Disable detected by one or more of configuration. Following options should
Windows Event Logging Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1562.002"
AND when the event matches condition="contains
Sysmon Rule Name (custom) is all">REGISTRY\MACHINE\SYSTEM\Contro
any of T1562 lSet001\Service\EventLog;MaxSize</Targ
AND NOT when any of Machine etObject>
ID (custom) are contained in <TargetObject name="T1562.002"
any of MITRE: Windows condition="contains
Machines Whitelist - all">REGISTRY\MACHINE\SYSTEM\Contro
AlphaNumeric lSet001\Service\EventLog;Retention</Tar
AND NOT when any of getObject>
Username are contained in any
of MITRE: Windows Users Get more Windows MITRE rules:
Whitelist - AlphaNumeric https://www.scnsoft.com/services/securi
ty/siem/windows-mitre-attack-rules
MITRE.WIN.T1563.002.RULE when the event(s) were This is rule based on Sysmon
Remote Service Session detected by one or more of configuration. Following options should
Hijacking: RDP Hijacking Microsoft Windows Security be enable:
Event Log
AND when the event matches In section <ProcessCreate
Event ID is any of [1] onmatch="include"> add following lines:
AND when the event matches <Image name="T1563.002"
Sysmon Rule Name (custom) is condition="image">tscon.exe</Image>
any of T1563 <CommandLine name="T1563.002"
AND NOT when any of Machine condition="contains any">cmd.exe
ID (custom) are contained in /k;cmd.exe /c</CommandLine>
any of MITRE: Windows
Machines Whitelist - Get more Windows MITRE rules:
AlphaNumeric https://www.scnsoft.com/services/securi
AND NOT when any of ty/siem/windows-mitre-attack-rules
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1574.010.RULE when the event(s) were This is rule based on Sysmon
Hijack Execution Flow: detected by one or more of configuration. Following options should
Microsoft Windows Security be enable:

© 2021 ScienceSoft | Page 42 from 43

 MITRE Windows Integration App:
Admin Guide

Services File Permissions Event Log

Weakness AND when the event matches In section <FileCreate
Event ID is any of [11] onmatch="include"> add following lines:
AND when the event matches <TargetFilename name="T1574.010"
Sysmon Rule Name (custom) is condition="begin
any of T1574 with">C:\Windows\Temp\</TargetFilena
AND NOT when any of Machine me>
ID (custom) are contained in
any of MITRE: Windows Get more Windows MITRE rules:
Machines Whitelist - https://www.scnsoft.com/services/securi
AlphaNumeric ty/siem/windows-mitre-attack-rules
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric
MITRE.WIN.T1574.011.RULE when the event(s) were This is rule based on Sysmon
Hijack Execution Flow: detected by one or more of configuration. Following options should
Services Registry Microsoft Windows Security be enable:
Permissions Weakness Event Log
AND when the event matches In section <RegistryEvent
Event ID is any of [12 or 13 or onmatch="include"> add following lines:
14] <TargetObject name="T1574.011"
AND when the event matches condition="contains">HKLM\SYSTEM\Cur
Sysmon Rule Name (custom) is rentControlSet\Services</TargetObject>
any of T1574
AND NOT when any of Machine Get more Windows MITRE rules:
ID (custom) are contained in https://www.scnsoft.com/services/securi
any of MITRE: Windows ty/siem/windows-mitre-attack-rules
Machines Whitelist -
AlphaNumeric
AND NOT when any of
Username are contained in any
of MITRE: Windows Users
Whitelist - AlphaNumeric

© 2021 ScienceSoft | Page 43 from 43