Windows.Sigma.Base Model #

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Application.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: application

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=[
  ROOT + "/Microsoft-Windows-AppLocker%4MSI and Script.evtx",
  ROOT + "/Microsoft-Windows-AppLocker%4EXE and DLL.evtx",
  ROOT + "/Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx",
  ROOT + "/Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx",
])
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: applocker

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-AppModel-Runtime%4Admin.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: appmodel-runtime

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-AppxPackaging%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: appxdeployment-server

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-AppxPackaging%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: appxpackaging-om

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-Bits-Client%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: bits-client

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-CAPI2/Operational")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: capi2

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: certificateservicesclient-lifecycle-system

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-CodeIntegrity%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: codeintegrity-operational

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-Diagnosis-Scripted%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: diagnosis-scripted

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-DNS Client Events%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: dns-client

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/DNS Server.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: dns-server

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-DNS-Server%4Analytical.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: dns-server-analytic

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: driver-framework

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: firewall-as

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-LDAP-Client%4Debug.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: ldap_debug

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-LSA%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: lsa-server

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-ServiceBus-Client.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: microsoft-servicebus-client

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/MSExchange Management.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: msexchange-management

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-NTLM%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: ntlm

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/OpenSSH%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: openssh

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=[
   ROOT + "/Microsoft-Windows-PowerShell%4Operational.evtx",
   ROOT + "/PowerShellCore%4Operational.evtx",
])
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: powershell

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *, EventData + dict(
   Data=EventData.Data[2],
   HostApplication=parse_string_with_regex(
     regex="HostApplication=([^\\r\\n]+)",
     string=EventData.Data[2]).g1) AS EventData
FROM parse_evtx(filename=ROOT + "/Windows PowerShell.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: powershell-classic

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Security.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: security

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-Security-Mitigations.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: security-mitigations

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-Shell-Core%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: shell-core

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-SmbClient%4Security.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: smbclient-security

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: sysmon

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/System.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: system

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-TaskScheduler%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: taskscheduler

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: terminalservices-localsessionmanager

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-VHDMP%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: vhdmp

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-Windows Defender%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: windefend

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-WMI-Activity%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  product: windows
  service: wmi

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=[
   ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx",
   ROOT + "/Security.evtx"
])
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime
  AND System.EventID.Value = 1 OR System.EventID.Value = 4688

logsource:
  category: process_creation
  product: windows

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Windows PowerShell.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime AND System.EventID.Value = 600

logsource:
  category: ps_classic_provider_start
  product: windows

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Windows PowerShell.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime AND System.EventID.Value = 400

logsource:
  category: ps_classic_start
  product: windows

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=[
   ROOT + "/Microsoft-Windows-PowerShell%4Operational.evtx",
   ROOT + "/PowerShellCore%4Operational.evtx"
])
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime AND System.EventID.Value = 4103

logsource:
  category: ps_module
  product: windows

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=[
   ROOT + "/Microsoft-Windows-PowerShell%4Operational.evtx",
   ROOT + "/PowerShellCore%4Operational.evtx"
])
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime AND System.EventID.Value = 4104

logsource:
  category: ps_script
  product: windows

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=[
   ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx",
   ROOT + "/Security.evtx"
])
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime AND System.EventID.Value = 12 OR System.EventID.Value = 4657

logsource:
  category: registry_add
  product: windows

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=[
   ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx",
   ROOT + "/Security.evtx"
])
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime
  AND System.EventID.Value IN (12, 13, 14) OR System.EventID.Value = 4657

logsource:
  category: registry_event
  product: windows

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=[
   ROOT + "/Microsoft-Windows-Sysmon%4Operational.evtx",
   ROOT + "/Security.evtx"
])
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime
  AND System.EventID.Value = 13 OR System.EventID.Value = 4657

logsource:
  category: registry_set
  product: windows

SELECT timestamp(epoch=System.TimeCreated.SystemTime) AS Timestamp, *
FROM parse_evtx(filename=ROOT + "/Microsoft-Windows-Windows Defender%4Operational.evtx")
WHERE Timestamp >= DateAfterTime AND Timestamp <= DateBeforeTime

logsource:
  category: antivirus
  product: windows
  service: windefend