Incorrect Sysmon EID `14` default_details
Closed this issue · 0 comments
fukusuket commented
Describe the bug
%Details%
is defined below, but the event with EID 14
does not have the Details
field.
hayabusa-rules/config/default_details.txt
Line 66 in 201d909
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90014
Step to Reproduce
./hayabusa json-timeline -d ../all-evtx/Win2022-AD -m high -o out.json -w -C
{
"Timestamp": "2022-03-02 04:24:21.737 +09:00",
"RuleTitle": "Reg Key Value Rename (Noisy)",
"Level": "info",
"Computer": "DESKTOP-6D0DBMB",
"Channel": "Sysmon",
"EventID": 14,
"RuleAuthor": "Zach Mathis",
"RuleModifiedDate": "2023/01/13",
"Status": "stable",
"RecordID": 1098384,
"Details": {
"EventType": "RenameKey",
"TgtObj": "HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\VREGISTRY_FC4EF5AF-A40A-4956-9AD1-3BFA0BA62E9E",
"": "n/a",
"Proc": "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe",
"PID": 8076,
"PGUID": "6A627BFB-7265-621E-2F01-000000000300"
},
"ExtraFieldInfo": {
"NewName": "HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\REGISTRY",
"RuleName": "-",
"User": "AUTORITE NT\\Système",
"UtcTime": "2022-03-01 19:24:21.727"
},
"OtherTags": [
"sysmon"
],
"Provider": "Sysmon",
"RuleCreationDate": "2022/03/23",
"RuleFile": "Sysmon_14_Info_RegKeyValueRename_Noisy.yml",
"EvtxFile": "../all-evtx/Logs_Win11/Microsoft-Windows-Sysmon%4Operational.evtx"
}