Sigma FP fixes

[djlukic]

Summary of the Pull Request

This PR is meant to resolve noisy FPs found within multiple normal events.

Changelog

update: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation - Add additional filters for third party AV
update: Suspicious Non PowerShell WSMAN COM Provider - Add new filter to cover the edge case where the HostApplication field is null
update: Renamed Powershell Under Powershell Channel - Add new filter to cover the edge case where the HostApplication field is null

Example Log Event

CodeIntegrity - Unmet Signing Level Requirements By File Under Validation

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-CodeIntegrity" Guid="{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}" /> 
  <EventID>3033</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>1</Task> 
  <Opcode>111</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2024-08-27T16:54:58.8487833Z" /> 
  <EventRecordID>74</EventRecordID> 
  <Correlation ActivityID="{4bbf743e-edd2-0001-45a1-c04bd2edda01}" /> 
  <Execution ProcessID="780" ThreadID="8788" /> 
  <Channel>Microsoft-Windows-CodeIntegrity/Operational</Channel> 
  <Computer>CR05.GRCPROP.local</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="FileNameLength">97</Data> 
  <Data Name="FileNameBuffer">\Device\HarddiskVolume2\Program Files\SentinelOne\Sentinel Agent 23.4.4.223\InProcessClient64.dll</Data> 
  <Data Name="ProcessNameLength">53</Data> 
  <Data Name="ProcessNameBuffer">\Device\HarddiskVolume2\Windows\System32\services.exe</Data> 
  <Data Name="RequestedPolicy">12</Data> 
  <Data Name="ValidatedPolicy">1</Data> 
  <Data Name="Status">3221226536</Data> 
  </EventData>
  </Event>

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-CodeIntegrity" Guid="{4ee76bd8-3cf4-44a0-a0ac-3937643e37a3}" /> 
  <EventID>3033</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>1</Task> 
  <Opcode>111</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2024-08-27T22:41:51.4426258Z" /> 
  <EventRecordID>157</EventRecordID> 
  <Correlation ActivityID="{0324767f-f8a9-0002-69e0-2403a9f8da01}" /> 
  <Execution ProcessID="10644" ThreadID="10480" /> 
  <Channel>Microsoft-Windows-CodeIntegrity/Operational</Channel> 
  <Computer>DESKTOP-J1T5HON.GRCPROP.local</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="FileNameLength">124</Data> 
  <Data Name="FileNameBuffer">\Device\HarddiskVolume3\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLMF.DLL</Data> 
  <Data Name="ProcessNameLength">93</Data> 
  <Data Name="ProcessNameBuffer">\Device\HarddiskVolume3\Program Files\SentinelOne\Sentinel Agent 23.4.4.223\SentinelAgent.exe</Data> 
  <Data Name="RequestedPolicy">7</Data> 
  <Data Name="ValidatedPolicy">1</Data> 
  <Data Name="Status">3221226536</Data> 
  </EventData>
  </Event>

Remote Schtasks Creation
4698 and 4702 do not contain Source Network Address data.

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" /> 
  <EventID>4698</EventID> 
  <Version>1</Version> 
  <Level>0</Level> 
  <Task>12804</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8020000000000000</Keywords> 
  <TimeCreated SystemTime="2024-08-28T05:47:12.6216279Z" /> 
  <EventRecordID>488676</EventRecordID> 
  <Correlation ActivityID="{89af78a9-cbb7-4481-b520-3d9d8a3baf1f}" /> 
  <Execution ProcessID="820" ThreadID="3028" /> 
  <Channel>Security</Channel> 
  <Computer></Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="SubjectUserSid">S-1-5-18</Data> 
  <Data Name="SubjectUserName"></Data> 
  <Data Name="SubjectDomainName"></Data> 
  <Data Name="SubjectLogonId">0x3e7</Data> 
  <Data Name="TaskName">\Microsoft\Windows\Windows Server\Backup_On_Idle</Data> 
  <Data Name="TaskContent"><?xml version="1.0" encoding="UTF-16"?> <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> <RegistrationInfo> <Author>Windows Small Business Server 2011 Essentials</Author> <Description>This task automatically backs up this computer at the scheduled time.</Description> <URI>\Microsoft\Windows\Windows Server\Backup_On_Idle</URI> </RegistrationInfo> <Triggers> <TimeTrigger> <Repetition> <Interval>PT120M</Interval> <StopAtDurationEnd>false</StopAtDurationEnd> </Repetition> <StartBoundary>2024-08-28T00:47:12</StartBoundary> <Enabled>true</Enabled> </TimeTrigger> </Triggers> <Settings> <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy> <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>true</AllowHardTerminate> <StartWhenAvailable>false</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable> <IdleSettings> <Duration>PT10M</Duration> <WaitTimeout>PT110M</WaitTimeout> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle>true</RunOnlyIfIdle> <WakeToRun>false</WakeToRun> <ExecutionTimeLimit>PT72H</ExecutionTimeLimit> <Priority>5</Priority> </Settings> <Actions Context="Author"> <Exec> <Command>C:\Program Files\Windows Server\Bin\RunTask.exe</Command> <Arguments>/asm:"C:\Program Files\Windows Server\Bin\BackupClientProvider.dll" /class:Microsoft.WindowsServerSolutions.DataProtection.PCBackup.ObjectModel.PCBackupClientManager /method:DoScheduledOnIdleBackup /task:"Backup_On_Idle"</Arguments> </Exec> </Actions> <Principals> <Principal id="Author"> <UserId>NT AUTHORITY\SYSTEM</UserId> <RunLevel>LeastPrivilege</RunLevel> </Principal> </Principals> </Task></Data> 
  <Data Name="ClientProcessStartKey">7036874417766526</Data> 
  <Data Name="ClientProcessId">4768</Data> 
  <Data Name="ParentProcessId">780</Data> 
  <Data Name="RpcCallClientLocality">0</Data> 
  <Data Name="FQDN"></Data> 
  </EventData>
  </Event>

Suspicious Non PowerShell WSMAN COM Provider

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="PowerShell" /> 
  <EventID Qualifiers="0">600</EventID> 
  <Level>4</Level> 
  <Task>6</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2024-08-27T20:58:07.0000000Z" /> 
  <EventRecordID>1248483</EventRecordID> 
  <Channel>Windows PowerShell</Channel> 
  <Computer></Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>WSMan</Data> 
  <Data>Started</Data> 
  <Data>ProviderName=WSMan NewProviderState=Started SequenceNumber=1 HostName=ConsoleHost HostVersion=2.0 HostId=312b66eb-6af5-46ab-8c94-60d88535599d EngineVersion= RunspaceId= PipelineId= CommandName= CommandType= ScriptName= CommandPath= CommandLine=</Data> 
  </EventData>
  </Event>

Renamed Powershell Under Powershell Channel

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="PowerShell" /> 
  <EventID Qualifiers="0">400</EventID> 
  <Level>4</Level> 
  <Task>4</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2024-08-26T15:58:16.0000000Z" /> 
  <EventRecordID>1248482</EventRecordID> 
  <Channel>Windows PowerShell</Channel> 
  <Computer></Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>Available</Data> 
  <Data>None</Data> 
  <Data>NewEngineState=Available PreviousEngineState=None SequenceNumber=9 HostName=ConsoleHost HostVersion=2.0 HostId=abb1ca02-2b41-4a28-a55c-6351eff4a056 EngineVersion=2.0 RunspaceId=5030c50f-f46e-44a1-b278-a11dc216a1a2 PipelineId= CommandName= CommandType= ScriptName= CommandPath= CommandLine=</Data> 
  </EventData>
  </Event>

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[djlukic]

I did not edit dates, sorry about that. If that is a requirement for the future I can do it.

[nasbench]

I did not edit dates, sorry about that. If that is a requirement for the future I can do it.

It is a requirements per the Sigma standard and as you're not a fist time contributor you have to do it now not next time :)

[djlukic]

I did not edit dates, sorry about that. If that is a requirement for the future I can do it.

It is a requirements per the Sigma standard and as you're not a fist time contributor you have to do it now not next time :)

Acknowledged, thanks.

requires some changes for empty host application based on the data field

[djlukic]

Do you need more examples regarding Remote Schtasks Creation - cf349c4b-99af-40fa-a051-823aa2307a84?
I have plenty of those.

4698 - A scheduled task was created.
4702 - A scheduled task was updated.

do not contain Source_network_address data.

[djlukic]

I am sorry, my bad on this one. I just noticed that Remote Schtasks Creation has unsupported status.