<!-- Rules 102101 - 102499: Direct Mapping from Sysmon Config File, Rule Level:3 -->
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<group name="windows,sysmon,">
<rule id="102101" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1021,technique_name=Remote Services$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1021</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102102" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1569.002,technique_name=Service Execution$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1569</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102103" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1197,technique_name=BITS Jobs$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1197</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102104" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1021,technique_name=Remote Services$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1021</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102105" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1102,technique_name=Web Service$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1102</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102106" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1016,technique_name=System Network Configuration Discovery$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1016</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102107" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1057,technique_name=Process Discovery$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1057</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102108" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1049,technique_name=System Network Connections Discovery$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1049</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102109" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1033,technique_name=System Owner/User Discovery$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1033</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102110" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1134,technique_name=Access Token Manipulation$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1134</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102111" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1112,technique_name=Modify Registry$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1112</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102112" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1518.001,technique_name=Security Software Discovery$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1518</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102113" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1070,technique_name=Indicator Removal on Host$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1070</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102114" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1053,technique_name=Scheduled Task/Job$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1053</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102115" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218.010,technique_name=Regsvr32$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102116" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1059.003,technique_name=Windows Command Shell$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1059</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102117" level="3">
<if_sid>61605,92101,92102</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1059.001,technique_name=PowerShell$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1059</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102118" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1202,technique_name=Indirect Command Execution$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1202</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102119" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218.005,technique_name=Mshta$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102120" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1069,technique_name=Permission Groups Discovery$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1069</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102121" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1018,technique_name=Remote System Discovery$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1018</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102122" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1543.003,technique_name=Windows Service$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1543</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102123" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1127</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102124" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1096,technique_name=NTFS File Attributes$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1096</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102125" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1105,technique_name=Ingress Tool Transfer$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1105</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102126" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218,technique_name=Signed Binary Proxy Execution$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102127" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1003,technique_name=Credential Dumping$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1003</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102128" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1548.002,technique_name=Bypass User Access Control$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1548</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102129" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1053,technique_name=Scheduled Task$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1053</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102130" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218,technique_name=Signed Script Proxy Execution$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102131" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1012,technique_name=Query Registry$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1012</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102132" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218,technique_name=Regsvr32$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102133" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218.011,technique_name=Rundll32$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102134" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1047,technique_name=Windows Management Instrumentation$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1047</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102135" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1218.009,technique_name=Regsvcs/Regasm$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1218</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102136" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1089,technique_name=Disabling Security Tools$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1089</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102137" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1043,technique_name=Commonly Used Port$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1043</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102138" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1036,technique_name=Masquerading$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1036</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Sysmon - Event 3: Network connection by $(win.eventdata.image) -->
<rule id="102139" level="3">
<if_sid>61605</if_sid>
<field name="win.eventdata.RuleName">^technique_id=T1021.006,technique_name=Windows Remote Management$</field>
<description>Sysmon - Event 3: Network connection by $(win.eventdata.image)</description>
<mitre>
<id>T1021</id>
</mitre>
<options>no_full_log</options>
<group>sysmon_event3,</group>
</rule>
<!-- Rules 102500 - 102599: Exceptions/Rule Level Mod -->
<!-- Frequency rule to capture 2 sysmon event 3 alerts within of the same destination ip within 5 seconds -->
<rule frequency="2" id="102502" level="1" timeframe="60">
		<if_matched_group>sysmon_event3</if_matched_group>
		<same_field>win.eventdata.destinationIp</same_field>
		<description>Multiple Sysmon Level 3 alerts for same destination IP.</description>
		<options>no_full_log</options>
	</rule>
<!-- Sysmon Event 3: Sysmon Anomalies -->
<!-- Abnormal Destination Port Detected -->
<rule id="102503" level="10">
  <if_group>sysmon_event3</if_group>
  <list field="win.eventdata.destinationPort" lookup="not_address_match_key">etc/lists/common-ports</list>
  <description>Sysmon - Event 3: Network connection to Uncommon Port by $(win.eventdata.image)</description>
  <options>no_full_log</options>
  <group>sysmon_event3,</group>
</rule>
<!-- Rules 102600 - 102699: Correlation Rules -->
</group>
