Merge pull request #59 from forensenellanebbia/master

AndrewRathbun · web-flow · commit 326896dba271 · 2020-12-23T19:17:04.000-05:00
Added LogonIDs and ActivityIDs
diff --git a/evtx/Maps/Microsoft-Windows-TerminalServices-RDPClient-Operational_Microsoft-Windows-TerminalServices-ClientActiveXCore_1024.map b/evtx/Maps/Microsoft-Windows-TerminalServices-RDPClient-Operational_Microsoft-Windows-TerminalServices-ClientActiveXCore_1024.map
@@ -11,7 +11,14 @@ Maps:
       - 
         Name: DestServer
         Value: "/Event/EventData/Data[@Name=\"Value\"]"
- 
+  - 
+    Property: PayloadData6
+    PropertyValue: "ActivityID: %ActivityID%"
+    Values: 
+      - 
+        Name: ActivityID
+        Value: "/Event/System/Correlation/@ActivityID" 
+
 # Documentation:
 # RDP ClientActiveX is trying to connect to the server ([Destination Host Name]).
 # https://cyber-tls.blogspot.com/2019/08/rdp.html
diff --git a/evtx/Maps/Microsoft-Windows-TerminalServices-RDPClient-Operational_Microsoft-Windows-TerminalServices-ClientActiveXCore_1027.map b/evtx/Maps/Microsoft-Windows-TerminalServices-RDPClient-Operational_Microsoft-Windows-TerminalServices-ClientActiveXCore_1027.map
@@ -11,7 +11,14 @@ Maps:
       - 
         Name: DomainName
         Value: "/Event/EventData/Data[@Name=\"DomainName\"]"
- 
+  - 
+    Property: PayloadData6
+    PropertyValue: "ActivityID: %ActivityID%"
+    Values: 
+      - 
+        Name: ActivityID
+        Value: "/Event/System/Correlation/@ActivityID" 
+
 # Documentation:
 # https://cyber-tls.blogspot.com/2019/08/rdp.html
 # https://social.technet.microsoft.com/wiki/contents/articles/37847.rdp-direct-connection-with-nla-remote-desktop-client-event-logs.aspx
diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4624.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4624.map
@@ -41,6 +41,13 @@ Maps:
       - 
         Name: LogonType
         Value: "/Event/EventData/Data[@Name=\"LogonType\"]"
+  - 
+    Property: PayloadData3
+    PropertyValue: "LogonId: %TargetLogonId%"
+    Values: 
+      - 
+        Name: TargetLogonId
+        Value: "/Event/EventData/Data[@Name=\"TargetLogonId\"]"
   - 
     Property: ExecutableInfo
     PropertyValue: "%ProcessName%"
diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4634.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4634.map
@@ -21,6 +21,13 @@ Maps:
       - 
         Name: LogonType
         Value: "/Event/EventData/Data[@Name=\"LogonType\"]"
+  - 
+    Property: PayloadData3
+    PropertyValue: "LogonId: %TargetLogonId%"
+    Values: 
+      - 
+        Name: TargetLogonId
+        Value: "/Event/EventData/Data[@Name=\"TargetLogonId\"]"
 
 # Documentation:
 # https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4647.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4647.map
@@ -14,6 +14,13 @@ Maps:
       - 
         Name: TargetUserName
         Value: "/Event/EventData/Data[@Name=\"TargetUserName\"]"
+  - 
+    Property: PayloadData3
+    PropertyValue: "LogonId: %TargetLogonId%"
+    Values: 
+      - 
+        Name: TargetLogonId
+        Value: "/Event/EventData/Data[@Name=\"TargetLogonId\"]"
  
 # Documentation:
 # https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4672.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4672.map
@@ -24,6 +24,13 @@ Maps:
       - 
         Name: PrivilegeList
         Value: "/Event/EventData/Data[@Name=\"PrivilegeList\"]"
+  - 
+    Property: PayloadData3
+    PropertyValue: "LogonId: %SubjectLogonId%"
+    Values: 
+      - 
+        Name: SubjectLogonId
+        Value: "/Event/EventData/Data[@Name=\"SubjectLogonId\"]"
 
 # Documentation:
 # https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4672
diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4778.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4778.map
@@ -26,6 +26,13 @@ Maps:
         Value: "/Event/EventData/Data[@Name=\"ClientName\"]"
   - 
     Property: PayloadData1
+    PropertyValue: "%SessionName%"
+    Values: 
+      - 
+        Name: SessionName
+        Value: "/Event/EventData/Data[@Name=\"SessionName\"]"
+  - 
+    Property: PayloadData3
     PropertyValue: "LogonId: %LogonID%"
     Values: 
       - 
diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4779.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4779.map
@@ -26,6 +26,13 @@ Maps:
         Value: "/Event/EventData/Data[@Name=\"ClientName\"]"
   - 
     Property: PayloadData1
+    PropertyValue: "%SessionName%"
+    Values: 
+      - 
+        Name: SessionName
+        Value: "/Event/EventData/Data[@Name=\"SessionName\"]"
+  - 
+    Property: PayloadData3
     PropertyValue: "LogonId: %LogonID%"
     Values: 
       - 

Original file line number	Diff line number	Diff line change
`@@ -41,6 +41,13 @@ Maps:`
`41`	`41`	`-`
`42`	`42`	`Name: LogonType`
`43`	`43`	`Value: "/Event/EventData/Data[@Name=\"LogonType\"]"`
	`44`	`+ -`
	`45`	`+ Property: PayloadData3`
	`46`	`+ PropertyValue: "LogonId: %TargetLogonId%"`
	`47`	`+ Values:`
	`48`	`+ -`
	`49`	`+ Name: TargetLogonId`
	`50`	`+ Value: "/Event/EventData/Data[@Name=\"TargetLogonId\"]"`
`44`	`51`	`-`
`45`	`52`	`Property: ExecutableInfo`
`46`	`53`	`PropertyValue: "%ProcessName%"`
Original file line number	Diff line number	Diff line change
`@@ -26,6 +26,13 @@ Maps:`
`26`	`26`	`Value: "/Event/EventData/Data[@Name=\"ClientName\"]"`
`27`	`27`	`-`
`28`	`28`	`Property: PayloadData1`
	`29`	`+ PropertyValue: "%SessionName%"`
	`30`	`+ Values:`
	`31`	`+ -`
	`32`	`+ Name: SessionName`
	`33`	`+ Value: "/Event/EventData/Data[@Name=\"SessionName\"]"`
	`34`	`+ -`
	`35`	`+ Property: PayloadData3`
`29`	`36`	`PropertyValue: "LogonId: %LogonID%"`
`30`	`37`	`Values:`
`31`	`38`	`-`