<group name="windows,sysmon,">
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106101" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1059</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106102" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T0137.005,technique_name=Boot or Logon Initialization Scripts - Startup Items$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T0137</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106103" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1197,technique_name=BITS$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1197</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106104" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1055,technique_name=Process Injection$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1055</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106105" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1047,technique_name=Windows Scheduled Tasks$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1047</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106106" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1064,technique_name=Windows Scripting Host Component$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1064</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106107" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1170,technique_name=MSHTA with AMSI Bypass$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1170</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106108" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1137,technique_name=Office Application Startup$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1137</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106109" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1175,technique_name=Component Object Model and Distributed COM$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1175</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106110" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1047,technique_name=Windows Management Instrumentation$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1047</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106111" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1059</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106112" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=1210,technique_name=Exploitation of Remote Services$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1210</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106113" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Modify Registry$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1112</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106114" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1003.004,technique_name=LSASS Memory$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1003</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106115" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1053,technique_name=Scheduled Task$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1053</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106116" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218.010,technique_name=Regsvr32$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Image loaded by $(win.eventdata.image) -->
<rule id="106117" level="3">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1073,technique_name=DLL Side-Loading$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1073</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Sysmon - Event 7: Anomalies -->
<!-- Sysmon - Event 7: Unsigned Image loaded by $(win.eventdata.image) -->
<rule id="106118" level="10">
<if_sid>61609,106117</if_sid>
<field name="win.eventdata.signed">^false$</field>
<description>Sysmon - Event 7: Unsigned Image loaded by $(win.eventdata.image)</description>
<group>sysmon_event7,sysmon_anomaly</group>
<mitre>
<id>T1547</id>
</mitre>
<options>no_full_log</options>
</rule>
<!-- Sysmon - Event 7: Unsigned Image Exception for Microsoft DLLs -->
<rule id="106119" level="3">
<if_sid>106118</if_sid>
<field name="win.eventdata.company">^Microsoft Corporation$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<group>sysmon_event7</group>
<mitre>
<id>T1059</id>
</mitre>
<options>no_full_log</options>
</rule>
<!-- Sysmon - Event 7: Signed Image loaded by $(win.eventdata.image) -->
<rule id="106120" level="3">
<if_sid>106117</if_sid>
<field name="win.eventdata.signed">^true$</field>
<description>Sysmon - Event 7: Signed Image loaded by $(win.eventdata.image)</description>
<group>sysmon_event7,sysmon_anomaly</group>
<mitre>
<id>T1547</id>
</mitre>
<options>no_full_log</options>
</rule>
<!--  -->
<rule id="106121" level="10">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1546,technique_name=Suspicious DLL Load by MSTSC or RDP$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1546</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!--  -->
<rule id="106122" level="10">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1555.004,technique_name=vaultcli.dll Loaded$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1555.004</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!--  -->
<rule id="106123" level="10">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1071,technique_name=Telnet C2 DLL Load$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1071</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!--  -->
<rule id="106124" level="10">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1547.008,technique_name=Suspicious DLL Loaded into LSASS$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1547.008</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!--  -->
<rule id="106125" level="10">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1574.001,technique_name=Loaded amsi.dll from non-standard path$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1574.001</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!--  -->
<rule id="106126" level="10">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1505.004,technique_name=DLL Load in IIS$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1505.004</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!--  -->
<rule id="106127" level="10">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1574.001,technique_name=Loaded amsi.dll from non-standard path$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1574.001</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!--  -->
<rule id="106128" level="10">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1574.001,technique_name=Loaded WinAppXRT.dll from System32$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1574.001</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!--  -->
<rule id="106129" level="10">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1574.001,technique_name=Loaded ualapi.dll from System32$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1574.001</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!--  -->
<rule id="106130" level="10">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1574.001,technique_name=Loaded KeyScramblerIE.dll from Temp$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1574.001</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!--  -->
<rule id="106131" level="10">
<if_sid>61609</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1027.007,technique_name=Suspicious DLL Load for API Resolution$</field>
<description>Sysmon - Event 7: Image loaded by $(win.eventdata.image)</description>
<mitre>
<id>T1027.007</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event7,</group>
</rule>
<!-- Rules 106600 - 106699: Correlation Rules -->
</group>
