Jose Rodriguez

icon location InfoSec Community icon location Threat Hunting & Data Science

Results 21 comments of Jose Rodriguez

1.A) User Execution, Masquerading, Uncommonly Used Port

![image](https://user-images.githubusercontent.com/33077805/80870469-9ad58180-8c74-11ea-9b7e-1637be952924.png)

1.A) User Execution, Masquerading, Uncommonly Used Port

I think the record for event 11 that you are looking for is in capital letters LOL. I got one result when using SCR. In those cases you can use...

Update Python Script Excel/MD to YAML : Ability to convert to event relationship template

Hey @ashwin-patil , I hope you are doing well. Can you provide more details or maybe an example for this issue? Thank you 👍

2.A) File and Directory Discovery, Automated Collection, Data from Local System, Data Compressed, Data Staged

Interesting event 4104 of PowerShell/Operational has a field **ExecutionProcessID** that can be related to ProcessId of event 1 of Sysmon ``` ps4104 = spark.sql( ''' SELECT `@timestamp`,EventID,ScriptBlockText FROM apt29Table WHERE...

Review comments H1L021 PR # 46 - Trusted Logon Process

Hey @H1L021 , I agree on that, using event 4611 with user context makes more sense when attributing the registration of the trusted logon process. I think we can add...

New relationships by Open Threat Research (OTR)

You are welcome @jcwilliamsATmitre, we are currently mapping security events within the [OSSEM-DM](https://github.com/OTRF/OSSEM-DM/tree/main/use-cases/mitre_attack) repository. Thank you for your feedback, here some comments: * **Driver**: We considered this relationship within the...

New relationships by Open Threat Research (OTR)

PR files updated 👍

Uniquely identify Windows events for automated data collection

Hey @b1t-hunter , I hope you are doing well 😃 We are happy to hear you are using the project in your environment. Also, thank you for taking the time...

Uniquely identify Windows events for automated data collection

Some notes to consider: - If we add the channel field, we would also need to change/review the log_source names used for Sysmon and PowerShell events in DD and DM.

Uniquely identify Windows events for automated data collection

Hey @b1t-hunter , hope you are doing well 😃 We have decided to add the `channel` field to our YAML schema. I have updated the README file of the repo...