Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Antivirus Maps #236

Merged
merged 5 commits into from
Jun 1, 2024
Merged

Antivirus Maps #236

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
73a0007
Antivirus Maps
reece394 Jun 1, 2024
f0abe0f
F-Secure 11 Map
reece394 Jun 1, 2024
3d9d072
Update Application_FSecure-FSecure-F-Secure-Anti-Virus_103.map
AndrewRathbun Jun 1, 2024
f6587f3
Update Application_FSecure-FSecure-F-Secure-Anti-Virus_103.map
AndrewRathbun Jun 1, 2024
4427e28
Update Application_Trellix-Endpoint-Security_3.map
AndrewRathbun Jun 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions evtx/Maps/Application_FSecure-FSecure-Application-F-Secure-Anti-Virus_103.map
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
Author: Reece394
Description: F-Secure Anti-Virus - Manual scanning was finished - workstation was found infected
EventId: 103
Channel: "Application"
Provider: "FSecure-FSecure Application-F-Secure Anti-Virus"
Maps:
-
Property: PayloadData1
PropertyValue: "%PayloadData1%"
Values:
-
Name: PayloadData1
Value: "/Event/EventData/Data[@Name=\"MessageText\"]"
-
Property: PayloadData2
PropertyValue: "%PayloadData2%"
Values:
-
Name: PayloadData2
Value: "/Event/EventData/Data[@Name=\"UserName\"]"

# Documentation:
# N/A
#
# Example Event Data:
# <Event>
# <System>
# <Provider Name="FSecure-FSecure Application-F-Secure Anti-Virus" Guid="14226663-5b17-4fcc-b09b-4d2644e4a1e7" />
# <EventID>103</EventID>
# <Version>0</Version>
# <Level>1</Level>
# <Task>0</Task>
# <Opcode>0</Opcode>
# <Keywords>0x8000000000000000</Keywords>
# <TimeCreated SystemTime="2024-01-06 20:50:27.6710933" />
# <EventRecordID>706</EventRecordID>
# <Correlation />
# <Execution ProcessID="3096" ThreadID="2272" />
# <Channel>Application</Channel>
# <Computer>User-PC</Computer>
# <Security UserID="S-1-5-18" />
# </System>
# <EventData>
# <Data Name="MessageText">Manual scanning was finished - workstation was found infected!</Data>
# <Data Name="TrapTimestamp">1704574227</Data>
# <Data Name="TrapId">103</Data>
# <Data Name="TrapNumber">9</Data>
# <Data Name="Severity">5</Data>
# <Data Name="HostName">user-pc</Data>
# <Data Name="UserName">User-PC\User</Data>
# <Data Name="ProductOID">1.3.6.1.4.1.2213.12</Data>
# <Data Name="ProductName">F-Secure Anti-Virus</Data>
# <Data Name="ParamCount">0</Data>
# <Data Name="Param"></Data>
# </EventData>
# </Event>
56 changes: 56 additions & 0 deletions evtx/Maps/Application_FSecure-FSecure-Application-F-Secure-Anti-Virus_207.map
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
Author: Reece394
Description: F-Secure Anti-Virus - Malicious code found in file
EventId: 207
Channel: "Application"
Provider: "FSecure-FSecure Application-F-Secure Anti-Virus"
Maps:
-
Property: PayloadData1
PropertyValue: "%PayloadData1%"
Values:
-
Name: PayloadData1
Value: "/Event/EventData/Data[@Name=\"MessageText\"]"
-
Property: PayloadData2
PropertyValue: "%PayloadData2%"
Values:
-
Name: PayloadData2
Value: "/Event/EventData/Data[@Name=\"UserName\"]"

# Documentation:
# N/A
#
# Example Event Data:
# <Event>
# <System>
# <Provider Name="FSecure-FSecure Application-F-Secure Anti-Virus" Guid="14226663-5b17-4fcc-b09b-4d2644e4a1e7" />
# <EventID>207</EventID>
# <Version>0</Version>
# <Level>1</Level>
# <Task>0</Task>
# <Opcode>0</Opcode>
# <Keywords>0x8000000000000000</Keywords>
# <TimeCreated SystemTime="2024-01-06 20:23:11.2496022" />
# <EventRecordID>703</EventRecordID>
# <Correlation />
# <Execution ProcessID="3096" ThreadID="2272" />
# <Channel>Application</Channel>
# <Computer>User-PC</Computer>
# <Security UserID="S-1-5-18" />
# </System>
# <EventData>
# <Data Name="MessageText">Malicious code found in file C:\Users\User\Downloads\mimikatz_trunk\x64\mimispool.dll. , Infection: Heuristic.HEUR/AGEN.1240390 , Action: The file was quarantined. , </Data>
# <Data Name="TrapTimestamp">1704572591</Data>
# <Data Name="TrapId">207</Data>
# <Data Name="TrapNumber">8</Data>
# <Data Name="Severity">5</Data>
# <Data Name="HostName">user-pc</Data>
# <Data Name="UserName">User-PC\User</Data>
# <Data Name="ProductOID">1.3.6.1.4.1.2213.12</Data>
# <Data Name="ProductName">F-Secure Anti-Virus</Data>
# <Data Name="ParamCount">3</Data>
# <Data Name="Param">C:\Users\User\Downloads\mimikatz_trunk\x64\mimispool.dll, Heuristic.HEUR/AGEN.1240390</Data>
# </EventData>
# </Event>
56 changes: 56 additions & 0 deletions evtx/Maps/Application_FSecure-FSecure-Application-F-Secure-Anti-Virus_296.map
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
Author: Reece394
Description: F-Secure Anti-Virus - Spyware detected
EventId: 296
Channel: "Application"
Provider: "FSecure-FSecure Application-F-Secure Anti-Virus"
Maps:
-
Property: PayloadData1
PropertyValue: "%PayloadData1%"
Values:
-
Name: PayloadData1
Value: "/Event/EventData/Data[@Name=\"MessageText\"]"
-
Property: PayloadData2
PropertyValue: "%PayloadData2%"
Values:
-
Name: PayloadData2
Value: "/Event/EventData/Data[@Name=\"UserName\"]"

# Documentation:
# N/A
#
# Example Event Data:
# <Event>
# <System>
# <Provider Name="FSecure-FSecure Application-F-Secure Anti-Virus" Guid="14226663-5b17-4fcc-b09b-4d2644e4a1e7" />
# <EventID>296</EventID>
# <Version>0</Version>
# <Level>1</Level>
# <Task>0</Task>
# <Opcode>0</Opcode>
# <Keywords>0x8000000000000000</Keywords>
# <TimeCreated SystemTime="2024-01-06 20:23:11.0000017" />
# <EventRecordID>698</EventRecordID>
# <Correlation />
# <Execution ProcessID="3096" ThreadID="2272" />
# <Channel>Application</Channel>
# <Computer>User-PC</Computer>
# <Security UserID="S-1-5-18" />
# </System>
# <EventData>
# <Data Name="MessageText">Spyware detected: , Type: riskware , Family: , Name: Hack-Tool:W32/Mimikatz.G , Object: C:\Users\User\Downloads\mimikatz_trunk\Win32\mimidrv.sys , </Data>
# <Data Name="TrapTimestamp">1704572591</Data>
# <Data Name="TrapId">296</Data>
# <Data Name="TrapNumber">3</Data>
# <Data Name="Severity">5</Data>
# <Data Name="HostName">user-pc</Data>
# <Data Name="UserName">User-PC\User</Data>
# <Data Name="ProductOID">1.3.6.1.4.1.2213.12</Data>
# <Data Name="ProductName">F-Secure Anti-Virus</Data>
# <Data Name="ParamCount">4</Data>
# <Data Name="Param">riskware, Hack-Tool:W32/Mimikatz.G, C:\Users\User\Downloads\mimikatz_trunk\Win32\mimidrv.sys</Data>
# </EventData>
# </Event>
56 changes: 56 additions & 0 deletions evtx/Maps/Application_FSecure-FSecure-Application-F-Secure-Anti-Virus_722.map
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
Author: Reece394
Description: F-Secure Anti-Virus - Web Traffic Scanning Alert
EventId: 722
Channel: "Application"
Provider: "FSecure-FSecure Application-F-Secure Anti-Virus"
Maps:
-
Property: PayloadData1
PropertyValue: "%PayloadData1%"
Values:
-
Name: PayloadData1
Value: "/Event/EventData/Data[@Name=\"MessageText\"]"
-
Property: PayloadData2
PropertyValue: "%PayloadData2%"
Values:
-
Name: PayloadData2
Value: "/Event/EventData/Data[@Name=\"UserName\"]"

# Documentation:
# N/A
#
# Example Event Data:
# <Event>
# <System>
# <Provider Name="FSecure-FSecure Application-F-Secure Anti-Virus" Guid="14226663-5b17-4fcc-b09b-4d2644e4a1e7" />
# <EventID>722</EventID>
# <Version>0</Version>
# <Level>1</Level>
# <Task>0</Task>
# <Opcode>0</Opcode>
# <Keywords>0x8000000000000000</Keywords>
# <TimeCreated SystemTime="2024-01-06 20:18:01.2138813" />
# <EventRecordID>696</EventRecordID>
# <Correlation />
# <Execution ProcessID="3096" ThreadID="2272" />
# <Channel>Application</Channel>
# <Computer>User-PC</Computer>
# <Security UserID="S-1-5-18" />
# </System>
# <EventData>
# <Data Name="MessageText">Web Traffic Scanning Alert , Infection: http://malware.wicar.org/data/eicar.com , Object name: EICAR_Test_File , Action: Malicious content was blocked.</Data>
# <Data Name="TrapTimestamp">1704572281</Data>
# <Data Name="TrapId">722</Data>
# <Data Name="TrapNumber">1</Data>
# <Data Name="Severity">5</Data>
# <Data Name="HostName">user-pc</Data>
# <Data Name="UserName">User-PC\User</Data>
# <Data Name="ProductOID">1.3.6.1.4.1.2213.12</Data>
# <Data Name="ProductName">F-Secure Anti-Virus</Data>
# <Data Name="ParamCount">3</Data>
# <Data Name="Param">http://malware.wicar.org/data/eicar.com, EICAR_Test_File</Data>
# </EventData>
# </Event>
50 changes: 50 additions & 0 deletions evtx/Maps/Application_FSecure-FSecure-F-Secure-Anti-Virus_103.map
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
Author: Reece394
Description: F-Secure Anti-Virus Detection
EventId: 103
Channel: "Application"
Provider: "FSecure-FSecure-F-Secure Anti-Virus"
Maps:
-
Property: UserName
PropertyValue: "%UserName%"
Values:
-
Name: UserName
Value: "/Event/EventData/Data"
Refine: "(?<=^([^ ]* ){4})[^ ]+"
-
Property: PayloadData1
PropertyValue: "%PayloadData1%"
Values:
-
Name: PayloadData1
Value: "/Event/EventData/Data"
Refine: "(?<=\n )(.*)"

# Documentation:
# N/A
#
# Example Event Data:
# <Event>
# <System>
# <Provider Name="FSecure-FSecure-F-Secure Anti-Virus" />
# <EventID Qualifiers="49152">103</EventID>
# <Level>2</Level>
# <Task>0</Task>
# <Keywords>0x80000000000000</Keywords>
# <TimeCreated SystemTime="2024-01-06 18:57:22.0000000" />
# <EventRecordID>732</EventRecordID>
# <Channel>Application</Channel>
# <Computer>User-PC</Computer>
# <Security />
# </System>
# <EventData>
# <Data>2 2024-01-06 18:57:21+00:00 user-pc User-PC\User F-Secure Anti-Virus
# Malicious code found in file C:\Users\User\Downloads\mimikatz_trunk\Win32\mimilove.exe.
# Infection: Heuristic.HEUR/AGEN.1221331
# Action: The file was deleted.
#
# </Data>
# <Binary></Binary>
# </EventData>
# </Event>
51 changes: 51 additions & 0 deletions evtx/Maps/Application_Trellix-Endpoint-Security_3.map
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
Author: Peter Snyder, Reece394
Description: Trellix Endpoint Detection
EventId: 3
Channel: "Application"
Provider: "Trellix Endpoint Security"
Maps:
-
Property: PayloadData1
PropertyValue: "%PayloadData1%"
Values:
-
Name: PayloadData1
Value: "/Event/EventData/Data"
Refine: EventID=(\d{1,4})\b
-
Property: PayloadData2
PropertyValue: "%PayloadData2%"
Values:
-
Name: PayloadData2
Value: "/Event/EventData/Data"
Refine: (\S+ (ran|file).*(Trojan|detected|blocked|executed).*.)

# Documentation:
# N/A
#
# Example Event Data:
# <Event>
# <System>
# <Provider Name="Trellix Endpoint Security" />
# <EventID Qualifiers="8192">3</EventID>
# <Version>0</Version>
# <Level>2</Level>
# <Task>0</Task>
# <Opcode>0</Opcode>
# <Keywords>0x80000000000000</Keywords>
# <TimeCreated SystemTime="2024-01-03 23:29:00.6240345" />
# <EventRecordID>811</EventRecordID>
# <Correlation />
# <Execution ProcessID="3584" ThreadID="0" />
# <Channel>Application</Channel>
# <Computer>DESKTOP-8EB4LCL</Computer>
# <Security UserID="S-1-5-18" />
# </System>
# <EventData>
# <Data>EventID=1027
#

Check failure on line 47 in evtx/Maps/Application_Trellix-Endpoint-Security_3.map

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

47:2 [trailing-spaces] trailing spaces
# DESKTOP-8EB4LCL\User ran C:\Program Files\7-Zip\7zG.exe, which attempted to access C:\Users\User\Downloads\1a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b\1a69f2fcfe5b35bf44ea42a1efe89f18f6b0d522cbbea5c51bae93aff7d3188b.exe. The Trojan named Artemis!5FE4EA367CEE was detected and deleted.</Data>
# <Binary></Binary>
# </EventData>
# </Event>
Loading