vxcontrol/xp-rules
1
0
Fork 0
mirror of https://github.com/vxcontrol/xp-rules.git synced 2026-07-25 16:55:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

[PR #1] [CLOSED] Детект включения процессом привилегии SeDebugPrivilege #1

New Issue
Closed
opened 2026-06-06 22:11:38 -04:00 by yindo · 0 comments
yindo commented 2026-06-06 22:11:38 -04:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/vxcontrol/xp-rules/pull/1
Author: @driverenok
Created: 6/1/2023
Status: ❌ Closed

Base: master ← Head: feature/win10_4703_SeDebugPrivilege_enabled

📝 Commits (10+)

  • 7980eeb в репозитории остался только SIEM формат и добавлены примеры фильтров
  • 5ce5ac8 1. Добавил правило Schtasks_Commandline и его зависимости.
  • 81d662e sync rule filters from parent repo
  • 0f1b3cf Merge branch 'master' of github.com:Security-Experts-Community/open-xp-rules
  • 98c915c Добавлены примеры правил для выявления запуска Mimikatz и эксплуатирования ProxyNotShell.
  • b4c6d34 Правило Schtasks_Commandline переведено на использование макросов.
  • e4b8c73 fix
  • 5f5d5ef names pipe impersonation rule
  • 3c498b8 Merge pull request #1 from Vasilisa-L/feature/demo
  • 7e71ac9 Correlation name fix

📊 Changes

3333 files changed (+1185 additions, -50123 deletions)

View changed files

➕ NOTICE (+1 -0)
➕ README.md (+3 -0)
➕ common/rules_filters/Contexts/System/FileSystemObject/FileCreate_Windows/filter.flt (+16 -0)
➕ common/rules_filters/Contexts/System/FileSystemObject/FileCreate_Windows/metainfo.yaml (+13 -0)
➕ common/rules_filters/Contexts/System/Process/ProcessStart_Windows_any/filter.flt (+13 -0)
➕ common/rules_filters/Contexts/System/Process/ProcessStart_Windows_any/metainfo.yaml (+13 -0)
➕ common/rules_filters/Contexts/System/Process/ProcessStart_Windows_cmd_meta/filter.flt (+17 -0)
➕ common/rules_filters/Contexts/System/Process/ProcessStart_Windows_cmd_meta/metainfo.yaml (+33 -0)
➕ common/rules_filters/Contexts/System/Process/ProcessStart_Windows_commandline/filter.flt (+17 -0)
➕ common/rules_filters/Contexts/System/Process/ProcessStart_Windows_commandline/metainfo.yaml (+27 -0)
➕ common/rules_filters/Contexts/Users_and_Access/Authentication/LoginAttempt_Windows_Endpoint/filter.flt (+10 -0)
➕ common/rules_filters/Contexts/Users_and_Access/Authentication/LoginAttempt_Windows_Endpoint/metainfo.yaml (+13 -0)
➕ common/rules_filters/Properties/Accounts/UserAccount_Windows/filter.flt (+19 -0)
➕ common/rules_filters/Properties/Accounts/UserAccount_Windows/metainfo.yaml (+26 -0)
➕ common/rules_filters/Properties/Generic/NotFromCorrelator/filter.flt (+3 -0)
➕ common/rules_filters/Properties/Generic/NotFromCorrelator/metainfo.yaml (+11 -0)
➕ common/rules_filters/Properties/OperatingSystems/OperatingSystem_UNIXLike/filter.flt (+13 -0)
➕ common/rules_filters/Properties/OperatingSystems/OperatingSystem_UNIXLike/metainfo.yaml (+10 -0)
➕ common/rules_filters/examples/IsNormalizedEvent/filter.flt (+5 -0)
➕ common/rules_filters/examples/IsNormalizedEvent/metainfo.yaml (+11 -0)

...and 80 more files

📄 Description

Данное правило срабатывает при включении процессом привилегии SeDebugPrivilege. Работает на основе события WinEventLog 4703 (Security). Resolves #278

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/vxcontrol/xp-rules/pull/1 **Author:** [@driverenok](https://github.com/driverenok) **Created:** 6/1/2023 **Status:** ❌ Closed **Base:** `master` ← **Head:** `feature/win10_4703_SeDebugPrivilege_enabled` --- ### 📝 Commits (10+) - [`7980eeb`](https://github.com/vxcontrol/xp-rules/commit/7980eebd725ce767095888ff22fa70647ce0c296) в репозитории остался только SIEM формат и добавлены примеры фильтров - [`5ce5ac8`](https://github.com/vxcontrol/xp-rules/commit/5ce5ac85e33bdd50143df69dc35dd2aa9b2304f7) 1. Добавил правило Schtasks_Commandline и его зависимости. - [`81d662e`](https://github.com/vxcontrol/xp-rules/commit/81d662e021004461694f326159abba47f644cebb) sync rule filters from parent repo - [`0f1b3cf`](https://github.com/vxcontrol/xp-rules/commit/0f1b3cfd3a05084f4ac843c754eababa89178c90) Merge branch 'master' of github.com:Security-Experts-Community/open-xp-rules - [`98c915c`](https://github.com/vxcontrol/xp-rules/commit/98c915c161d4f69233a38835bb3f2bf37317bbe1) Добавлены примеры правил для выявления запуска Mimikatz и эксплуатирования ProxyNotShell. - [`b4c6d34`](https://github.com/vxcontrol/xp-rules/commit/b4c6d3492140e72c2b2ab3d75cdb94c40887fa74) Правило Schtasks_Commandline переведено на использование макросов. - [`e4b8c73`](https://github.com/vxcontrol/xp-rules/commit/e4b8c732fd8da8d8cf5c91db7743c45adafe5d42) fix - [`5f5d5ef`](https://github.com/vxcontrol/xp-rules/commit/5f5d5efcb213134eac5a43bb09d882ca1afa8fe0) names pipe impersonation rule - [`3c498b8`](https://github.com/vxcontrol/xp-rules/commit/3c498b828ad1a178e48ebd78230333d587cae3d5) Merge pull request #1 from Vasilisa-L/feature/demo - [`7e71ac9`](https://github.com/vxcontrol/xp-rules/commit/7e71ac98f33f0b95e575c2bc925dc402f8301124) Correlation name fix ### 📊 Changes **3333 files changed** (+1185 additions, -50123 deletions) <details> <summary>View changed files</summary> ➕ `NOTICE` (+1 -0) ➕ `README.md` (+3 -0) ➕ `common/rules_filters/Contexts/System/FileSystemObject/FileCreate_Windows/filter.flt` (+16 -0) ➕ `common/rules_filters/Contexts/System/FileSystemObject/FileCreate_Windows/metainfo.yaml` (+13 -0) ➕ `common/rules_filters/Contexts/System/Process/ProcessStart_Windows_any/filter.flt` (+13 -0) ➕ `common/rules_filters/Contexts/System/Process/ProcessStart_Windows_any/metainfo.yaml` (+13 -0) ➕ `common/rules_filters/Contexts/System/Process/ProcessStart_Windows_cmd_meta/filter.flt` (+17 -0) ➕ `common/rules_filters/Contexts/System/Process/ProcessStart_Windows_cmd_meta/metainfo.yaml` (+33 -0) ➕ `common/rules_filters/Contexts/System/Process/ProcessStart_Windows_commandline/filter.flt` (+17 -0) ➕ `common/rules_filters/Contexts/System/Process/ProcessStart_Windows_commandline/metainfo.yaml` (+27 -0) ➕ `common/rules_filters/Contexts/Users_and_Access/Authentication/LoginAttempt_Windows_Endpoint/filter.flt` (+10 -0) ➕ `common/rules_filters/Contexts/Users_and_Access/Authentication/LoginAttempt_Windows_Endpoint/metainfo.yaml` (+13 -0) ➕ `common/rules_filters/Properties/Accounts/UserAccount_Windows/filter.flt` (+19 -0) ➕ `common/rules_filters/Properties/Accounts/UserAccount_Windows/metainfo.yaml` (+26 -0) ➕ `common/rules_filters/Properties/Generic/NotFromCorrelator/filter.flt` (+3 -0) ➕ `common/rules_filters/Properties/Generic/NotFromCorrelator/metainfo.yaml` (+11 -0) ➕ `common/rules_filters/Properties/OperatingSystems/OperatingSystem_UNIXLike/filter.flt` (+13 -0) ➕ `common/rules_filters/Properties/OperatingSystems/OperatingSystem_UNIXLike/metainfo.yaml` (+10 -0) ➕ `common/rules_filters/examples/IsNormalizedEvent/filter.flt` (+5 -0) ➕ `common/rules_filters/examples/IsNormalizedEvent/metainfo.yaml` (+11 -0) _...and 80 more files_ </details> ### 📄 Description Данное правило срабатывает при включении процессом привилегии SeDebugPrivilege. Работает на основе события WinEventLog 4703 (Security). Resolves #278 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-06 22:11:38 -04:00
yindo closed this issue 2026-06-06 22:11:38 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: vxcontrol/xp-rules#1
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?