Microsoft Syslog via Snare Agent

WARNING: The Snare Agent not recommended for new installs and is included here only for older setups.

Rule Function

There are two rules in this app. The first rule parses MS Windows log messages as forwarded by the Snare windows agent application. It adds EventID and EventLog to the message and sets a user tag. This rule is used as a precursor to the second rule. The second rule sets several categorization user tags referenced by event id.

Vendor Documentation

Log Source Details

Item	Value
Vendor	Microsoft
Device Type	Windows
Supported Software Version(s)	Windows XP or later (desktop or server)
Collection Method	Syslog
Configurable Log Output?	no
Log Source Type	Snare Windows agent
Exceptions	N/A

Currently Supported Log Types

These log messages are sent from the Snare agent in a tab-separated format.

Field Name	Example
`Fixed Message Type`	`MSWinEventLog`
`Criticality`	`0`
`EventLogSource`	`Security`
`SnareCounter`	`12399`
`SubmitTime`	`Fri Feb 25 08:15:52 2022`
`EventID`	`4689`
`SourceName`	`Microsoft-Windows-Security-Auditing`
`UserName`	`WIN2019-DC-SNAR\Administrator`
`SIDType`	`N/A`
`EventLogType`	`Success Audit`
`ComputerName`	`Win2019-DC-snare`
`CategoryString`	`Process Termination`
`DataString`	(see below)
`ExpandedString`	(not available)
`OptionalMD5Checksum`	(not available)

The DataString would be something similar to:

A process has exited.    Subject:   Security ID:  
S-1-5-21-889138511-2922568610-3431993163-500   Account Name:  
Administrator   Account Domain:  WIN2019-DC-SNAR   Logon ID:  
0xF199D4B    Process Information:   Process ID: 0x12dc   Process
Name: C:\Windows\System32\PING.EXE   Exit Status: 0x0   12370

NOTE: the Snare log messages are parsed differently by LogZilla; on receipt, the first four fields are read as the LogZilla program field and the remainder as the message field.

Parsed Metadata Fields

Note that only the MSWin EventID and Hostname fields are parsed directly from the log message itself; the remainder of the user tags come from a listing of the relevant information below, by event id.

Tagged	Tag Name	Example
☑	`MSWin EventID`	`4634`
☑	`Hostname`	`TestHost`
☑	`MSWin Category`	`Logon/Logoff`
☑	`MSWin Compliance Category`	`PCI DSS`
☑	`MSWin Criticality`	`Low`
☑	`MSWin Sub Category`	`Account Lockout`
☑	`MSWin Failed Login User`	`User-20DDC`
☑	`MSWin Failed Login Source Network`	`106.26.164.208`

Log Examples

(line breaks between fields in the following examples are not included and have been added for readability:)

Process Termination

MSWinEventLog   0   Security    12399 Feb 25 11:01:19 2022 4689
Microsoft-Windows-Security-Auditing WORKGROUP\WIN2019-DC-SNAR$
N/A Success Audit Win2019-DC-snare Process Termination A process
has exited. Subject: Security ID: S-1-5-18 Account Name: WIN2019-DC-SNAR$
Account Domain: WORKGROUP Logon ID: 0x3E7 Process Information: Process
ID: 0x748 Process Name: C:\Windows\System32\svchost.exe Exit Status: 0x0 12801

Process Creation

Feb 25 11:09:46 2022 4688 Microsoft-Windows-Security-Auditing NT
AUTHORITY\LOCAL SERVICE N/A Success Audit Win2019-DC-snare Process
Creation A new process has been created. Creator Subject: Security
ID: S-1-5-18 Account Name: WIN2019-DC-SNAR$ Account Domain: WORKGROUP
Logon ID: 0x3E7 Target Subject: Security ID: S-1-5-19 Account Name:
LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3E5 Process
Information: New Process ID: 0xf28 New Process Name:
C:\Windows\System32\wbem\WmiPrvSE.exe Token Elevation Type: %%1936
Mandatory Label: S-1-16-16384 Creator Process ID: 0x2e0 Creator Process
Name: C:\Windows\System32\svchost.exe Process Command Line: Token
Elevation Type indicates the type of token that was assigned to the
new process in accordance with User Account Control policy. Type 1
is a full token with no privileges removed or groups disabled. A full
token is only used if User Account Control is disabled or if the user
is the built-in Administrator account or a service account. Type 2 is
an elevated token with no privileges removed or groups disabled. An
elevated token is used when User Account Control is enabled and the
user chooses to start the program using Run as administrator. An
elevated token is also used when an application is configured to always
require administrative privilege or to always require maximum privilege,
and the user is a member of the Administrators group. Type 3 is a limited
token with administrative privileges removed and administrative groups
disabled. The limited token is used when User Account Control is enabled,
the application does not require administrative privilege, and the user
does not choose to start the program using Run as administrator. 12803