EventSentry supports Windows-based stateless Sigma rules. When using a Sigma rule instead of a classic content filter then the majority of event filter properties are automatically disabled as they need to be defined in the Sigma rule:
•Event Log
•Event Severity
•Event Source
•Event Category
•Event ID
•Event User
EventSentry supports the following Sigma properties:
logsource:product
•windows
logsource:service
•application
•security
•system
•dns-server
•sysmon
detection:selection
•contains
•startswith
•endswith
•all
•re
•i
•m
•s
•base64
•base64offset
•utf16
•utf-16
•utf16le
•utf-16le
•utf16be
•utf-16be
•wide
•cased
•exists
•fieldref
•cidr
•windash
•gt
•gte
•lt
•lte
The event id can be specified in any selection section as EventID
It is not necessary to paste the entire Sigma rule, only the key properties listed below need to be provided:
•logsource
- product
- service
•detection
- selection
- condition
An example Sigma rule is shown below:
logsource:
product: windows
service: security
detection:
selection1:
EventID:
- 4625
- 4624
LogonType: 3
AuthenticationPackageName: 'NTLM'
WorkstationName|re: '^[A-Za-z0-9]{16}$'
selection2:
EventID: 4776
Workstation|re: '^[A-Za-z0-9]{16}$'
Port|gt: 8000
LogonType|exists: true
Username|cased: 'Administrator'
SubjectUsername|fieldref: Username
IpAddress|cidr: 172.21.2.0/23
CommandLine|windash: '//init'
condition: 1 of selection*
