Added more rules related to Windows Eventlog

wazuh · May 6, 2020 · 169e9e2 · 169e9e2
1 parent c168bd1
commit 169e9e2
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 0 deletions.
diff --git a/rules/0590-win-system_rules.xml b/rules/0590-win-system_rules.xml
@@ -323,4 +323,24 @@
     <options>no_email_alert</options>
   </rule>
 
+  <rule id="61139" level="8">
+    <if_sid>61102</if_sid>
+    <field name="win.system.eventID">^6008$</field>
+    <description>Unexpected system shutdown.</description>
+    <mitre>
+      <id>T1529</id>
+    </mitre>
+    <options>no_full_log</options>
+  </rule>
+
+  <rule id="61140" level="7">
+    <if_sid>61100</if_sid>
+    <field name="win.system.eventID">^1074$</field>
+    <description>System has been shutdown by a process/user.</description>
+    <mitre>
+      <id>T1529</id>
+    </mitre>
+    <options>no_full_log</options>
+  </rule>
+
 </group>
diff --git a/rules/0610-win-ms_logs_rules.xml b/rules/0610-win-ms_logs_rules.xml
@@ -81,4 +81,15 @@
     <description>Multiple Eventlog warning events</description>
     <options>no_full_log</options>
   </rule>
+
+  <rule id="63108" level="7">
+    <if_sid>63100</if_sid>
+    <field name="win.system.eventID">^6006$</field>
+    <description>The Event log service was stopped.</description>
+    <mitre>
+      <id>T1529</id>
+    </mitre>
+    <options>no_full_log</options>
+  </rule>
+
 </group>