Skip to content

Commit b85d5b8

Browse files
AndrewRathbunAndrewRathbun
authored
Merge pull request #58 from forensenellanebbia/master
New maps for Citrix events
2 parents 8b9cc80 + 43564f6 commit b85d5b8

6 files changed

+192
-6
lines changed

‎evtx/Maps/Application_Citrix-Desktop-Service_1027.map

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
Author: Gabriele Zambelli @gazambelli
2+
Description: Citrix user session started
3+
EventId: 1027
4+
Channel: Application
5+
Provider: "Citrix Desktop Service"
6+
Maps:
7+
-
8+
Property: Username
9+
PropertyValue: "Target: %user%"
10+
Values:
11+
-
12+
Name: user
13+
Value: "/Event/EventData/Data"
14+
Refine: "^.*(?=, )"
15+
-
16+
Property: PayloadData1
17+
PropertyValue: "SessionID: %SessionID%"
18+
Values:
19+
-
20+
Name: SessionID
21+
Value: "/Event/EventData/Data"
22+
Refine: "[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}"
23+
24+
# Documentation:
25+
# https://discussions.citrix.com/topic/342198-xendesktop-7-interactive-session-slows-logon/page/9/
26+
#
27+
# Example Event Data:
28+
# <Event>
29+
# <System>
30+
# <Provider Name="Citrix Desktop Service" />
31+
# <EventID Qualifiers="16384">1027</EventID>
32+
# <Level>4</Level>
33+
# <Task>0</Task>
34+
# <Keywords>0x80000000000000</Keywords>
35+
# <TimeCreated SystemTime="2020-10-07 08:19:49.0000000" />
36+
# <EventRecordID>359095</EventRecordID>
37+
# <Channel>Application</Channel>
38+
# <Computer>hostname</Computer>
39+
# <Security />
40+
# </System>
41+
# <EventData>
42+
# <Data>remoteuser, 1234abcd-12ab-12ab-12ab-123456abcdef</Data>
43+
# <Binary></Binary>
44+
# </EventData>
45+
# </Event>

‎evtx/Maps/Application_Citrix-Desktop-Service_1049.map

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
Author: Gabriele Zambelli @gazambelli
2+
Description: Citrix user session disconnected
3+
EventId: 1049
4+
Channel: Application
5+
Provider: "Citrix Desktop Service"
6+
Maps:
7+
-
8+
Property: PayloadData1
9+
PropertyValue: "SessionID: %SessionID%"
10+
Values:
11+
-
12+
Name: SessionID
13+
Value: "/Event/EventData/Data"
14+
15+
# Documentation:
16+
# https://computergarage.org/citrix-desktop-service-eventid-1049-the-session-was-disconnected.html
17+
#
18+
# Example Event Data:
19+
# <Event>
20+
# <System>
21+
# <Provider Name="Citrix Desktop Service" />
22+
# <EventID Qualifiers="16384">1049</EventID>
23+
# <Level>4</Level>
24+
# <Task>0</Task>
25+
# <Keywords>0x80000000000000</Keywords>
26+
# <TimeCreated SystemTime="2020-10-26 17:22:45.0000000" />
27+
# <EventRecordID>3590389</EventRecordID>
28+
# <Channel>Application</Channel>
29+
# <Computer>hostname</Computer>
30+
# <Security />
31+
# </System>
32+
# <EventData>
33+
# <Data>1234abcd-12ab-12ab-12ab-123456abcdef</Data>
34+
# <Binary></Binary>
35+
# </EventData>
36+
# </Event>
37+

‎evtx/Maps/Application_MetaFrameEvents_1106.map

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
Author: Gabriele Zambelli @gazambelli
2+
Description: Citrix client printer auto-creation failed
3+
EventId: 1106
4+
Channel: Application
5+
Provider: MetaFrameEvents
6+
Maps:
7+
-
8+
Property: RemoteHost
9+
PropertyValue: "%ClientName%"
10+
Values:
11+
-
12+
Name: ClientName
13+
Value: "/Event/EventData/Data"
14+
Refine: "^[a-z0-9-]*"
15+
-
16+
Property: PayloadData1
17+
PropertyValue: "Printer: %Printer%"
18+
Values:
19+
-
20+
Name: Printer
21+
Value: "/Event/EventData/Data"
22+
Refine: "(?<=, ).*"
23+
24+
# Documentation:
25+
# https://support.citrix.com/article/CTX137114
26+
#
27+
# Example Event Data:
28+
# <Event>
29+
# <System>
30+
# <Provider Name="MetaFrameEvents" />
31+
# <EventID Qualifiers="49152">1106</EventID>
32+
# <Level>3</Level>
33+
# <Task>2</Task>
34+
# <Keywords>0x80000000000000</Keywords>
35+
# <TimeCreated SystemTime="2020-10-24 14:50:50.0000000" />
36+
# <EventRecordID>3587921</EventRecordID>
37+
# <Channel>Application</Channel>
38+
# <Computer>hostname</Computer>
39+
# <Security />
40+
# </System>
41+
# <EventData>
42+
# <Data>NOTEBOOK, Brother PC-FAX v.3.2 #2 (from NOTEBOOK) in session 2, Brother PC-FAX v.3.2</Data>
43+
# <Binary></Binary>
44+
# </EventData>
45+
# </Event>
46+

‎evtx/Maps/Application_WSH_0.map

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
Author: Gabriele Zambelli @gazambelli
2+
Description: Windows Script Host (WSH)
3+
EventId: 0
4+
Channel: Application
5+
Provider: WSH
6+
Maps:
7+
-
8+
Property: PayloadData1
9+
PropertyValue: "%PayloadData1%"
10+
Values:
11+
-
12+
Name: PayloadData1
13+
Value: "/Event/EventData/Data"
14+
15+
# Documentation:
16+
# http://www.eventid.net/display-eventid-0-source-WSH-eventno-3533-phase-1.htm
17+
#
18+
# Example Event Data:
19+
# <Event>
20+
# <System>
21+
# <Provider Name="WSH" />
22+
# <EventID Qualifiers="0">0</EventID>
23+
# <Level>0</Level>
24+
# <Task>0</Task>
25+
# <Keywords>0x80000000000000</Keywords>
26+
# <TimeCreated SystemTime="2020-10-03 15:26:28.0000000" />
27+
# <EventRecordID>359861</EventRecordID>
28+
# <Channel>Application</Channel>
29+
# <Computer>hostname</Computer>
30+
# <Security />
31+
# </System>
32+
# <EventData>
33+
# <Data></Data>
34+
# <Binary></Binary>
35+
# </EventData>
36+
# </Event>

‎evtx/Maps/Microsoft-Windows-TerminalServices-RDPClient-Operational_Microsoft-Windows-TerminalServices-ClientActiveXCore_1029.map

+26-4
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,32 @@ Maps:
2323
# Documentation:
2424
# Windows Event ID 1029 Hashes: https://nullsec.us/windows-event-id-1029-hashes/
2525
# CyberChef recipes to calculate the same encoded value from a known username
26-
# Windows 7 : Base64(SHA1(UserName))
27-
# - https://gchq.github.io/CyberChef/#recipe=Decode_text('UTF-8%20(65001)')Encode_text('UTF-16LE%20(1200)')SHA1()From_Hex('Space')To_Base64('A-Za-z0-9%2B/%3D')
28-
# Windows 10: Base64(SHA256(UserName))
29-
# - https://gchq.github.io/CyberChef/#recipe=Decode_text('UTF-8%20(65001)')Encode_text('UTF-16LE%20(1200)')SHA2('256')From_Hex('Space')To_Base64('A-Za-z0-9%2B/%3D')
26+
# OS : Windows 7 / Windows Server 2008 R2
27+
# Hash : Base64(SHA1(UserName))
28+
# Recipe : https://gchq.github.io/CyberChef/#recipe=Decode_text('UTF-8%20(65001)')Encode_text('UTF-16LE%20(1200)')SHA1()From_Hex('Space')To_Base64('A-Za-z0-9%2B/%3D')
29+
# Example:
30+
# Input = administrator
31+
# Output = /6UN2Oco6V2sEKuooAIuzrrOUrk=
32+
#
33+
# OS : Windows 10
34+
# Hash : Base64(SHA256(UserName))
35+
# Recipe: https://gchq.github.io/CyberChef/#recipe=Decode_text('UTF-8%20(65001)')Encode_text('UTF-16LE%20(1200)')SHA2('256')From_Hex('Space')To_Base64('A-Za-z0-9%2B/%3D')
36+
# Example:
37+
# Input = administrator
38+
# Output = WAlZ81aqzLQmoWEfQivmPQwJxIm/XQcDjplQdjznr5E=
39+
#
40+
# If you need to decode a large number of encoded values, try my recipe for CyberChef. These are the steps to follow:
41+
# 1) Copy and paste the following recipe into CyberChef:
42+
# Compact JSON:
43+
# [{"op":"Unique","args":["Line feed"]},{"op":"Fork","args":["\\n","\\n",false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"-\\\\-"},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(User Name|Payload Data.|Target: |Target \\(encoded\\).*| \\(S\\-.*\\)|NETWORK SERVICE)"},"",true,false,true,false]},{"op":"Find / Replace","args":[{"option":"Regex","string":"(^.*\\\\|S-[0-9\\-]*)"},"",true,false,true,false]},{"op":"Register","args":["([\\s\\S]*)",true,false,false]},{"op":"Decode text","args":["UTF-8 (65001)"]},{"op":"Encode text","args":["UTF-16LE (1200)"]},{"op":"SHA1","args":[],"disabled":true},{"op":"SHA2","args":["256"]},{"op":"From Hex","args":["Space"]},{"op":"To Base64","args":["A-Za-z0-9+/="]},{"op":"Register","args":["([\\s\\S]*)",true,false,false]},{"op":"Find / Replace","args":[{"option":"Simple string","string":"$R1"},"$R1,$R0",true,false,true,false]},{"op":"Merge","args":[]},{"op":"Unique","args":["Line feed"]},{"op":"Sort","args":["Line feed",false,"Alphabetical (case insensitive)"]},{"op":"To Table","args":[",","\\r\\n",false,"HTML"]}]
44+
# 2) From CyberChef, disable or remove the hash operation (SHA1 or SHA2) that you don't need
45+
# 3) From Timeline Explorer:
46+
# - Column "User Name" : copy all the non-blank values
47+
# - Column "Payload Data1": copy all the values containing "Target:"
48+
# 4) Paste what you just copied into the input area of CyberChef (no need to clean or dedupe the input before pasting)
49+
# 5) Bake!
50+
#
51+
# Articles:
3052
# https://cyber-tls.blogspot.com/2019/08/rdp.html
3153
# https://social.technet.microsoft.com/wiki/contents/articles/37847.rdp-direct-connection-with-nla-remote-desktop-client-event-logs.aspx
3254
# https://nullsec.us/windows-rdp-related-event-logs-the-client-side-of-the-story/

‎evtx/Maps/Symantec-Endpoint-Protection-Client_Symantec-Endpoint-Protection-Client_51.map

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,12 @@ Maps:
1414
Refine: "(?<=File: ).*(?= by: )"
1515
-
1616
Property: PayloadData1
17-
PropertyValue: "%PayloadData1%"
17+
PropertyValue: "Risk: %PayloadData1%"
1818
Values:
1919
-
2020
Name: PayloadData1
2121
Value: "/Event/EventData/Data"
22-
Refine: "^.*(?= in File:)"
22+
Refine: "(?<=Security Risk Found! ).*(?= in File:)"
2323
-
2424
Property: PayloadData2
2525
PropertyValue: "%PayloadData2%"

0 commit comments

Comments
 (0)