<group name="windows,sysmon,">
  <rule id="61646" level="3" overwrite="yes">
    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^17$</field>
    <description>Sysmon - Event 17: PipeEvent (Pipe Created) by $(win.eventdata.image)</description>
    <options>no_full_log</options>
    <group>sysmon_event_17,</group>
  </rule>

  <rule id="61647" level="3" overwrite="yes">
    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^18$</field>
    <description>Sysmon - Event 18: PipeEvent (Pipe Connected) by $(win.eventdata.image)</description>
    <options>no_full_log</options>
    <group>sysmon_event_18,</group>
  </rule>

  <rule id="61644" level="3" overwrite="yes">
    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^22$</field>
    <description>Sysmon - Event 22: DNS Request by $(win.eventdata.image)</description>
    <mitre>
    <id>T1071</id>
    </mitre>
    <options>no_full_log</options>
    <group>sysmon_event_22,</group>
  </rule>

  <rule id="109203" level="3">
    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^19$</field>
    <description>Sysmon - Event 19:  WmiEvent (WmiEventFilter activity detected) by $(win.eventdata.image)</description>
    <mitre>
      <id>T047</id>
    </mitre>
    <group>sysmon_event_19,</group>
  </rule>

  <rule id="109204" level="3">
    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^20$</field>
    <description>Sysmon - Event 20:  WmiEvent (WmiEventConsumer activity detected) by $(win.eventdata.image)</description>
    <mitre>
      <id>T047</id>
    </mitre>
    <group>sysmon_event_20,</group>
  </rule>

  <rule id="109205" level="3">
    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^21$</field>
    <description>Sysmon - Event 21: WmiEvent (WmiEventConsumerToFilter activity detected) by $(win.eventdata.image)</description>
    <mitre>
      <id>T047</id>
    </mitre>
    <group>sysmon_event_21,</group>
  </rule>

  <rule id="109206" level="3">
    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^23$</field>
    <description>Sysmon - Event 23: FileDelete (A file delete was detected) by $(win.eventdata.image)</description>
    <mitre>
      <id>T1107</id>
      <id>T1485</id>
    </mitre>
    <group>sysmon_event_23,</group>
  </rule>

  <rule id="109207" level="3">
    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^24$</field>
    <description>Sysmon - Event 24: ClipboardChange (New content in the clipboard) by $(win.eventdata.image)</description>
    <mitre>
      <id>T1115</id>
    </mitre>
    <group>sysmon_event_24,</group>
  </rule>

  <rule id="109208" level="3">
    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^25$</field>
    <description>Sysmon - Event 25: ProcessTampering (Process image change) by $(win.eventdata.image)</description>
    <mitre>
      <id>T1055</id>
    </mitre>
    <group>sysmon_event_25,</group>
  </rule>
  
  <rule id="109209" level="12">
    <if_sid>63103</if_sid>
    <field name="win.system.channel">Security</field>
    <description>Windows Security log was cleared.</description>
    <mitre>
      <id>T1070</id>
      <id>T1107</id>
    </mitre>
    <group>logs_cleared,pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AU.6,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>
  
  <rule id="109210" level="12">
    <if_sid>60106</if_sid>
    <field name="win.eventdata.logonType">^9$</field>
    <field name="win.eventdata.logonProcessName">^seclogo$</field>
    <field name="win.eventdata.authenticationPackageName">^Negotiate$</field>
    <description>Potential User Login Via Pass the Hash Detected.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>special_logon</group>
  </rule>
  
  <rule id="109211" level="3">
    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^6$</field>
    <description>Sysmon - Event 6: Driver Loaded by $(win.eventdata.image)</description>
    <group>sysmon_event_6,</group>
    <options>no_full_log</options>
  </rule>
  
</group>
