13 - Cheatsheet EIDs Windows y Sysmon SOC

Quick reference de los Event IDs más usados en caza de amenazas en Windows, organizados por categoría MITRE ATT&CK. Aplicables a tus índices win_security, win_sysmon, win_powershell, win_defender, win_tasks, win_wmi, win_rdp.

🔐 Autenticación y sesiones (win_security)

EID	Significado	Ejemplo SPL
4624	Logon correcto	`index=win_security EventCode=4624`
4625	Logon fallido	`index=win_security EventCode=4625`
4626	Logon user/IP info (raro)
4634	Logoff (Logon Type específico)
4647	User initiated logoff
4648	Explicit credentials (runas)	`index=win_security EventCode=4648`
4672	Special privileges assigned a new logon (admin)
4634	Logoff
4675	SIDs filtered
4720	User account created	`index=win_security EventCode=4720`
4722	User account enabled
4724	Password reset attempt
4726	User account deleted
4732	Member added to security-enabled local group
4738	User account changed
4740	Account locked out
4767	Account unlocked
4776	NTLM authentication attempted
4778	Session reconnected (RDP)
4779	Session disconnected (RDP)

Logon_Type cheatsheet (campo en 4624/4625)

Code	Tipo
2	Interactive (local)
3	Network (SMB, etc.)
4	Batch (scheduled task)
5	Service
7	Unlock (lock screen)
8	NetworkCleartext (IIS basic auth)
9	NewCredentials (runas /netonly)
10	RemoteInteractive (RDP)
11	CachedInteractive (offline DC)
12	CachedRemoteInteractive
13	CachedUnlock

⚙️ Procesos y servicios (win_security + win_sysmon)

Windows Security

EID	Significado
4688	Process created (con `CommandLine` si `IncludeCommandLine=1` ya activo)
4689	Process terminated
7045	Service installed (positivo de instalación de servicio)
7036	Service stopped
7034	Service crashed
7040	Service start type changed (e.g., Defender disabled)

Sysmon (telemetría rica - tu fuente principal)

EID	Nombre	qué capta	Ejemplo SPL
1	ProcessCreate	Image, ParentImage, CommandLine, Hashes, User	`index=win_sysmon EventID=1`
2	FileCreateTime	quiénes cambian timestamps
3	NetworkConnection	Image, DestinationIp, DestinationPort, Protocol	`index=win_sysmon EventID=3`
4	SysmonServiceStateChanged	cambio de estado del servicio Sysmon
5	ProcessTerminate	quién cerró procesos
6	DriverLoad	driver cargado (rootkits)	`index=win_sysmon EventID=6`
7	ImageLoaded	DLL/importaciones cargadas por un proceso
8	CreateRemoteThread	process injection clásico
9	RawAccessRead	raw disk read (dump lsass by raw)
10	ProcessAccess	quán tocó a qué proceso (con GrantedAccess)	`index=win_sysmon EventID=10 TargetImage="*lsass.exe"`
11	FileCreate	creación de archivos	`index=win_sysmon EventID=11 TargetFilename="*.exe"`
12	RegistryEvent (Object create/delete)	claves de registry creadas/borradas
13	RegistryEvent (Value Set)	valores de registry cambiados	`index=win_sysmon EventID=13 TargetObject="Run"`
14	RegistryEvent (Value Rename)
15	FileCreateStreamHash	ADS (Alternate Data Streams), macros office
16	SysmonConfigchange	cambios en config de Sysmon
17	PipeEvent (Created)	pipes cre	pozos para lateral movement (mimikatz)
18	PipeEvent (Connected)
19	WmiFilterEvent	persistence via WMI
20	WmiConsumerEvent	persistence via WMI
21	WmiConsumerToFilter	persistence via WMI
22	DNSQuery	QueryName (dominios resueltos por proceso)	`index=win_sysmon EventID=22`
23	FileDelete	archivos borrados (post-exploitation)
24	ClipboardChange	clipboard content
25	ProcessTampering	process hide/hollow
26	FileDeleteDetected	Files deleted with archived copy
255	Sysmon error

GrantedAccess cheatsheet (EID 10, ProcessAccess a lsass.exe)

Hex	Significado	Notas
`0x1010`	VM_READ + QUERY_INFO	Necesario mimikatz base
`0x1410`	VM_READ + VM_WRITE + VM_OPERATION + QUERY_INFO	Firma clásica mimikatz (con WRITE)
`0x1ffff`	Full access	Bulletin
`0x1f0fff`	Full access alt
`0x40`	VM_READ (sólo lectura)	dumpert, pypykatz variantes

🔧 PowerShell (win_powershell)

EID	Canal	Significado
4100	PowerShell/Operational	Error en ejecución
4103	PowerShell/Operational	Module logging (pipeline + cmdlets invocados) — requiere `EnableModuleLogging=1`
4104	PowerShell/Operational	ScriptBlock logging (código completo) — el rey para malware detection
4105	PowerShell/Operational	Script block execution started
400	PowerShell/Classic	Engine state (started) - opcional
403	PowerShell/Operational	Engine state (stopped)
800	PowerShell/Classic	Pipeline execution

Patrones a buscar en ScriptBlockText

*-EncodedCommand*, *-e *, *-enc* — Base64 ofuscación.
*FromBase64String* — decodificación en runtime.
*IEX*, *Invoke-Expression* — ejecución dinámica.
*DownloadString*, *DownloadFile*, *WebClient* — descarga de payload.
*Invoke-Mimikatz*, *sekurlsa*, *lsadump* — credential access.
*System.Reflection.Assembly* — loads .NET en runtime.
*AMSIInitFailed*, *amsi.dll* — AMSI bypass attempt.
*-ExecutionPolicy Bypass* — evadir política.

📡 Red (win_sysmon EID 3 + EID 22)

EID 3 - NetworkConnection

Campos útiles:

Image (quién hizo la conexión)
DestinationIp, DestinationHostname, DestinationPort
Protocol (TCP/UDP)
SourceIp, SourcePort
User

EID 22 - DNSQuery

Campos útiles:

Image (quién emitió la query)
QueryName (dominio)
QueryResults (respuesta IPs)

Detecciones:

TLDs sospechosos: .ru, .cn, .xyz, .top, .click, .country, .gq, .ml, .cf, .tk.
QueryName >30 chars (DGA-like).
Echo de peticiones desde proceso no-navegador.

✍️ Persistencia (win_sysmon + win_tasks + win_wmi)

Registry (win_sysmon EID 12/13/14)

Claves vigilables:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SYSTEM\CurrentControlSet\Services\* (servicios)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\* (Debugger hijack)
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*

Task Scheduler (win_tasks)

EID	Significado
100	Task started
102	Task completed
106	Task registered (nueva tarea creada)
107	Task launched on event trigger
108	Task launched on time trigger
129	Task launched and deleted
200	Action started
201	Action completed

Sospecha: tarea creada por proceso que no es schtasks.exe o con ruta de Action en Temp/AppData.

WMI subscriptions (win_sysmon EID 19/20/21)

EID	Significado
19	WmiFilterEvent (filtro creado)
20	WmiConsumerEvent (consumer creado — `CommandLineEventConsumer` es típico de malware)
21	WmiConsumerToFilter (binding filter→consumer — la persistencia en sí)

💀 Credential Access (win_sysmon)

EID 10 ProcessAccess (clave de detección de credential dumping)

Buscar TargetImage="*lsass.exe" y GrantedAccess suspicious:

GrantedAccess	Code	Tool/family
0x1410	mimikatz clásico	mimikatz, sekurlsa
0x1010	menor lectura	nanodump, comsvcs
0x1ffff	full access	procdump, pypykatz
0x40	VM_READ	dumpert
0x10	VM_READ alt	variants

Lateral movement

EID 8 CreateRemoteThread → proceso X inyecta thread en proceso Y. Sospechoso si:

SourceImage no es良性 (CSRSS, wininit)
TargetImage contiene explorer.exe, svchost.exe, lsass.exe

EID 7 ImageLoaded → DLL loaded en proceso. Sospechoso si:

ImageLoaded no está en System32, SysWOW64, Program Files
Loaded same name as legit DLL (side-loading attack)

🛡️ Defender (win_defender)

EID	Significado
1116	Defender detectó amenaza
1117	Defender took action (quarantine/remove)
1118	Extended threat detection
1150	Enterprise正向
2000 / 2001	Defender state changed (real-time protection on/off)
5007	AntiMalware config changed (tampering!)

Detección de tampering:

index=win_sysmon EventID=13 TargetObject="*DisableAntiSpyware*" Details="*1*"
index=win_sysmon EventID=13 TargetObject="*DisableRealtimeMonitoring*" Details="*1*"
index=win_defender EventCode=5007

📊 Host anómalo (win_perfmon — cuando esté recibiendo datos)

Counter	Anomaly
`% Processor Time` > 80% sostenido 30 min	Cryptominer sospechoso
`% Free Space` cae > 5%en 10 min	Ransomware encryption
`Committed Bytes` sube sharp	Memory leak / heap spraying
`Network Interface` > 10MB/s inusual	Exfiltración / C2

🚪 RDP (win_rdp)

EID	Significado
21	Session logon succeeded (RDP)
22	Shell start notification
24	Window title (ven app remota)
25	RemoteApp launched
40	Disconnect reason
131	Account logoff from RDP session

⚡ Atajos de query (para tu día a día)

“¿Qué ha hecho este usuario hoy?"

index=win_sysmon EventID=1 User="sammi"
| table _time Image ParentImage CommandLine
| sort -_time

"¿Quién conectó a este .dominio?"

index=win_sysmon EventID=22 QueryName="*malicious.example*"
| stats dc(Image) as procs, values(Image) by QueryName

"¿Quién leyó lsass?"

index=win_sysmon EventID=10 TargetImage="*lsass.exe"
| stats count by SourceImage,GrantedAccess
| sort -count

"¿Qué sesiones RDP han habido?"

index=win_rdp EventCode=21
| table _time User SourceNetworkAddress SessionID

"¿Nuevas tareas programadas?"

index=win_tasks EventCode=200 OR EventCode=106
| table _time TaskName ActionName User

"ScriptBlocks PowerShell sospechosos"

index=win_powershell EventCode=4104
| search ScriptBlockText="*IEX*" OR ScriptBlockText="*FromBase64String*" OR ScriptBlockText="*DownloadString*"
| table _time ScriptBlockText Path

"Procesos cuya ParentImage no es habitual”

index=win_sysmon EventID=1
| where NOT match(ParentImage,"(?i)(explorer.exe|svchost.exe|cmd.exe|powershell.exe|winlogon.exe|services.exe|smss.exe|csrss.exe|taskhostw.exe|spoolsv.exe|MsMpEng.exe|wininit.exe|lsass.exe|RuntimeBroker.exe|sihost.exe|ctfmon.exe|ServiceHub.exe)")
| stats count by Image,ParentImage
| sort -count

📝 Books / docs suggested

Triaging Forward: The Blue Teamer’s Digital Forensic Handbook (Jack Cabirso)
Splunk Security Essentials docs
SANS SEC555: SIEM with Tactical Threat Hunting (caro)
Cyber Threat Intelligence técnicas (blogs Active Countermeasures)

Volver a: 00 - MOC Monitorización PC Local | Ver también: 11 - Busquedas SOC y Casos de Uso | 12 - Apps Complementarias y Post-Instalación

Sammi Notes

Explorador