Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

New Kit: Windows #165

Open
13 of 17 tasks
kris-watts-gravwell opened this issue Apr 2, 2024 · 2 comments
Open
13 of 17 tasks

New Kit: Windows #165

kris-watts-gravwell opened this issue Apr 2, 2024 · 2 comments
Assignees
@keith-smiley-gravwell
Labels
02 - Medium medium priority 05 - feature new feature that does not currently exist

Comments

@kris-watts-gravwell
Copy link
Contributor

kris-watts-gravwell commented Apr 2, 2024 •
edited by keith-smiley-gravwell
Loading

General issue for tracking a generic windows kit.

Helpful links

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/
https://www.xplg.com/windows-server-security-events-list/
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor

Query library stuff

  • Account lockouts
  • Logins
    Logouts
  • RDP logins
  • administrator RDP logins
  • Event data is cleared
    network authentications

Dashboards

  • Overview
  • Account logons - successful
  • Group events
  • User events
  • Account logon - failures/lockouts

Playbook

  • Overview
  • Windows Event Collection

Resources

  • EventID to description lookup

Next iteration

  • Query: RDP logins with wonky language or clients
  • Query: Pass the hash
  • Playbook: Query overview
  • Playbook: Important events to monitor
@kris-watts-gravwell kris-watts-gravwell added 06 - enhancement improvement or extension of existing feature 02 - Medium medium priority labels Apr 2, 2024
@ashnwade ashnwade added 05 - feature new feature that does not currently exist and removed 06 - enhancement improvement or extension of existing feature labels Apr 2, 2024
@ashnwade ashnwade modified the milestone: v5.4.8 Apr 16, 2024
Merged
@ashnwade ashnwade added this to the v5.5.0 milestone May 23, 2024
Closed
@keith-smiley-gravwell
Copy link
Contributor

Update...

@keith-smiley-gravwell
Copy link
Contributor

Added a few more dashboards, playbooks

Merged
Merged
@ashnwade ashnwade removed this from the v5.5.0 milestone Jul 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@keith-smiley-gravwell keith-smiley-gravwell

Labels
02 - Medium medium priority 05 - feature new feature that does not currently exist
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@ashnwade @kris-watts-gravwell @keith-smiley-gravwell