AD_SystemShutdown
ID: 100027
Description:
EventID 1074: System has been shutdown by a process/user.
Notes: This rule will create a timeline (zero-score) hit when the event occurs for the Hostname
Repository: Fluency Group: AD Type: event
Default Status:
Enabled
| Tags: |
|---|
| AD |
Selector:
Query:
Filters:
| Field | MUST hit |
|---|---|
| @fields.EventID | 1074 |
| @eventType | nxlogAD |
| Field | MUST NOT hit |
|---|---|
Behavior Rule:
| Key | Type | Behavior Category |
|---|---|---|
| @fields.Hostname | asset | account login |
Risks:
| Risks | Base Score | Dimension |
|---|---|---|
| Timeline | 0 | - |
Attributes:
| Alias | Key |
|---|---|
| Hostname | @fields.Hostname |
| SourceName | @fields.SourceName |
| Process | @fields.param1 |
| ComputerName | @fields.param2 |
| Reason | @fields.param3 |
| ReasonCode | @fields.param4 |
| ShutdownType | @fields.param5 |
| Username | @fields.param7 |
| Event ID | @fields.EventID |
Correlation Rules:
History:
| User | Date |
|---|---|
| ho*d@fluencysecurity.com | 2021 Oct 4 16:30:55 EDT |
| ho*d@fluencysecurity.com | 2021 Oct 4 16:35:36 EDT |
| ho*d@fluencysecurity.com | 2021 Nov 12 10:03:55 EST |
This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)