[Rule Tuning] Sysmon Registry-based Rules Review & Fixes#1775
Conversation
| """ | ||
| from = "now-9m" | ||
| index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"] | ||
| index = ["logs-endpoint.events.*"] |
There was a problem hiding this comment.
The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support
| """ | ||
| from = "now-9m" | ||
| index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] | ||
| index = ["logs-endpoint.events.*"] |
There was a problem hiding this comment.
The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support
| """ | ||
| from = "now-9m" | ||
| index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"] | ||
| index = ["logs-endpoint.events.*"] |
There was a problem hiding this comment.
The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support
| """ | ||
| from = "now-9m" | ||
| index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"] | ||
| index = ["logs-endpoint.events.*"] |
There was a problem hiding this comment.
The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support
| """ | ||
| from = "now-9m" | ||
| index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] | ||
| index = ["logs-endpoint.events.*"] |
There was a problem hiding this comment.
The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support
| """ | ||
| from = "now-9m" | ||
| index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] | ||
| index = ["logs-endpoint.events.*"] |
There was a problem hiding this comment.
The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support
| registry where event.type in ("creation", "change") and | ||
| registry.path : ("HKLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Monitors\\*", | ||
| "HLLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Environments\\Windows*\\Print Processors\\*") and | ||
| "HKLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Environments\\Windows*\\Print Processors\\*") and |
| """ | ||
| from = "now-9m" | ||
| index = ["logs-endpoint.events.*", "logs-windows.*"] | ||
| index = ["logs-endpoint.events.*"] |
There was a problem hiding this comment.
The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support
| """ | ||
| from = "now-9m" | ||
| index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] | ||
| index = ["logs-endpoint.events.*"] |
There was a problem hiding this comment.
The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support
| """ | ||
| from = "now-9m" | ||
| index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"] | ||
| index = ["logs-endpoint.events.*"] |
There was a problem hiding this comment.
The integration is only parsing DWORD and QWORD registry values, so registry.data.strings will always be null here. Dropping Support
* Initial Review of Sysmon Registry Rules * Update defense_evasion_sip_provider_mod.toml (cherry picked from commit 9bbe26f)
* Initial Review of Sysmon Registry Rules * Update defense_evasion_sip_provider_mod.toml (cherry picked from commit 9bbe26f)
* Initial Review of Sysmon Registry Rules * Update defense_evasion_sip_provider_mod.toml (cherry picked from commit 9bbe26f)
* Initial Review of Sysmon Registry Rules * Update defense_evasion_sip_provider_mod.toml (cherry picked from commit 9bbe26f)
* Initial Review of Sysmon Registry Rules * Update defense_evasion_sip_provider_mod.toml (cherry picked from commit 9bbe26f)
* Initial Review of Sysmon Registry Rules * Update defense_evasion_sip_provider_mod.toml (cherry picked from commit 9bbe26f)
Summary
Resolves #1766
Resolves #1761
Changes: