Yamato-Security/hayabusa-rules

Incorrect Sysmon EID `14` default_details

Closed this issue · 0 comments

Describe the bug
%Details% is defined below, but the event with EID 14 does not have the Details field.

Microsoft-Windows-Sysmon, 16, Config: %Configuration%

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90014

Step to Reproduce
./hayabusa json-timeline -d ../all-evtx/Win2022-AD -m high -o out.json -w -C

{
    "Timestamp": "2022-03-02 04:24:21.737 +09:00",
    "RuleTitle": "Reg Key Value Rename (Noisy)",
    "Level": "info",
    "Computer": "DESKTOP-6D0DBMB",
    "Channel": "Sysmon",
    "EventID": 14,
    "RuleAuthor": "Zach Mathis",
    "RuleModifiedDate": "2023/01/13",
    "Status": "stable",
    "RecordID": 1098384,
    "Details": {
        "EventType": "RenameKey",
        "TgtObj": "HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\VREGISTRY_FC4EF5AF-A40A-4956-9AD1-3BFA0BA62E9E",
        "": "n/a",
        "Proc": "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe",
        "PID": 8076,
        "PGUID": "6A627BFB-7265-621E-2F01-000000000300"
    },
    "ExtraFieldInfo": {
        "NewName": "HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\REGISTRY",
        "RuleName": "-",
        "User": "AUTORITE NT\\Système",
        "UtcTime": "2022-03-01 19:24:21.727"
    },
    "OtherTags": [
        "sysmon"
    ],
    "Provider": "Sysmon",
    "RuleCreationDate": "2022/03/23",
    "RuleFile": "Sysmon_14_Info_RegKeyValueRename_Noisy.yml",
    "EvtxFile": "../all-evtx/Logs_Win11/Microsoft-Windows-Sysmon%4Operational.evtx"
}