zeek | LoFP

zeek rule

Title	Tags
a dns lookup does not necessarily mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those ips. b) verify if http, ssl, or tls activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'.	t1496 t1569 t1569.002 zeek sigma
although it is recommended to not have rdp exposed to the internet, verify that this is a) allowed b) the server has not already been compromised via some brute force or remote exploit since it has been exposed to the internet. work to secure the server if you are unable to remove it from being exposed to the internet.	t1021 t1021.001 zeek sigma
domain controllers that are sometimes, commonly although should not be, acting as printer servers too	t1021 t1021.002 zeek sigma
exploits that were attempted but unsuccessful.	t1021 t1021.006 t1068 t1190 t1203 t1210 zeek sigma
help desk operator doing backup or re-imaging end user machine or backup software	t1039 zeek windows sigma
if you work in a public sector then it may be good to exclude things like endswith \".edu\", \".gov\" and or \".mil\"	t1095 t1571 zeek sigma
internal or legitimate external domains using dnssec. verify if these are legitimate dnssec domains and then exclude them.	t1095 t1571 zeek sigma
legitimate remote alteration of a printer driver.	zeek sigma
normal enterprise spn requests activity	t1558 t1558.003 zeek sigma
scanning attempts with the abnormal use of the http post method with no indication of code execution within the http client (request) body. an example would be vulnerability scanners trying to identify unpatched versions while not actually exploiting the vulnerability. see description for investigation tips.	t1021 t1021.006 t1068 t1190 t1203 t1210 zeek sigma
transferring sensitive files for legitimate administration work by legitimate administrator	t1003 t1003.001 t1003.002 t1003.003 zeek windows sigma
uncommon but legitimate windows administrator or software tasks that make use of the encrypting file system rpc calls. verify if this is common activity (see description).	t1187 t1557 t1557.001 zeek sigma
update the excluded named pipe to filter out any newly observed legit named pipe	t1021 t1021.002 zeek windows sigma
users working with these data types or exchanging message files	t1039 zeek windows sigma
windows administrator tasks or troubleshooting	t1047 t1053 t1053.002 t1547 t1547.004 t1569 t1569.002 zeek sigma
windows management scripts or software	t1047 t1053 t1053.002 t1547 t1547.004 t1569 t1569.002 zeek sigma