Exclude Failed attempt for privileged Operation.

Description

field win.eventdata.processName="(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\\d+\.\d+\.\d+\.\d+\\\\msedgewebview2\.exe$|(?i)^C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome\.exe$|(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge\.exe$|(?i)^C:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Adobe Desktop Common\\\\HEX\\\\Creative Cloud UI Helper\.exe$|(?i)^C:\\\\Program Files\\\\Microsoft OneDrive\\\\OneDrive\.exe$|(?i)^C:\\\\Program Files \(x86\)\\\\Logitech\\\\LogiTune\\\\LogiTune\.exe$|(?i)C:\\\\Windows\\\\System32\\\\RuntimeBroker\.exe$|(?i)C:\\\\Program Files\\\\Adobe\\\\Adobe Creative Cloud\\\\ACC\\\\Creative Cloud\.exe$|(?i)C:\\\\Program Files\\\\Intuit\\\\QuickBooks 2024\\\\CefSharp\.BrowserSubprocess\.exe"

No license declared

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 60000 Group of windows rules. anchor level 0
   decoded_as=windows_eventchannel AND field win.system.providerName="\.+"
2. 60001 Group of Windows rules for the security channel. anchor level 0
   field win.system.channel="^Security$"
3. 60104 Windows audit failure event anchor level 5
   field win.system.severityValue="^AUDIT_FAILURE$|^failure$"
4. 60107 Failed attempt to perform a privileged operation anchor level 4
   field win.system.eventID="^577$|^4673$"
5. 900095 Exclude Failed attempt for privileged Operation. exclusion level 1 this rule
   field win.eventdata.processName="(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\\d+\.\d+\.\d+\.\d+\\\\msedgewebview2\.exe$|(?i)^C:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome\.exe$|(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge\.exe$|(?i)^C:\\\\Program Files\\\\Common Files\\\\Adobe\\\\Adobe Desktop Common\\\\HEX\\\\Creative Cloud UI Helper\.exe$|(?i)^C:\\\\Program Files\\\\Microsoft OneDrive\\\\OneDrive\.exe$|(?i)^C:\\\\Program Files \(x86\)\\\\Logitech\\\\LogiTune\\\\LogiTune\.exe$|(?i)C:\\\\Windows\\\\System32\\\\RuntimeBroker\.exe$|(?i)C:\\\\Program Files\\\\Adobe\\\\Adobe Creative Cloud\\\\ACC\\\\Creative Cloud\.exe$|(?i)C:\\\\Program Files\\\\Intuit\\\\QuickBooks 2024\\\\CefSharp\.BrowserSubprocess\.exe"

Rule dependencies

Depends on

• composes · Wazuh if_sid 60107
  • Failed attempt to perform a privileged operation