- Added new event sources: PowerShell Operational Log, WinRM, Windows…

EventList/EventList.psd1

@@ -3,7 +3,7 @@
 	ModuleToProcess = 'EventList.psm1'
 
 	# Version number of this module.
-	ModuleVersion = '2.0.1'
+	ModuleVersion = '2.0.2'
 
 	# ID used to uniquely identify this module
 	GUID = '6a7ec113-3459-431c-a0eb-4942615a850c'

EventList/EventList.psm1

@@ -1,5 +1,5 @@
 $script:ModuleRoot = $PSScriptRoot
-$script:ModuleVersion = "2.0.1"
+$script:ModuleVersion = "2.0.2"
 $Script:database = "$ModuleRoot\internal\data\EventList.db"
 
 # Detect whether at some level dotsourcing was enforced

EventList/functions/Get-BaselineEventList.ps1

@@ -45,7 +45,7 @@
         }
         else {
             $BaselineName = ConvertTo-PSSQLString($BaselineName)
-            $query = "select eaac.category_name as Category, d.subcategory as Subcategory, em.id as 'Event ID', em.event_name as 'Event Description', em.link_text as 'Event Link', d.inclusion_setting as 'Audit Recommendation', d.setting_value 'Audit Recommendation Number', sf.success_failure_name as 'Event S/F', d.policy_target as 'Policy Target', sr.sec_rec_name as Recommendation from baseline_main m, baseline_data d, events_main em, events_source so, events_success_failure sf, events_security_recommendation sr, events_audit_subcategory eas, events_advanced_audit_categories eaac, events_advanced_audit_subcategories eaas where m.id = d.b_id and d.subcategory = eaas.subcategory_name and em.so_id = so.id and em.success_failure_id = sf.id and em.sr_id = sr.id and em.id = eas.event_id and eas.audit_subc_id = eaas.id and eaas.c_id = eaac.id and m.name = '$BaselineName';"
+            $query = "select eaac.category_name as Category, d.subcategory as Subcategory, em.event_id as 'Event ID', em.event_name as 'Event Description', em.link_text as 'Event Link', d.inclusion_setting as 'Audit Recommendation', d.setting_value 'Audit Recommendation Number', sf.success_failure_name as 'Event S/F', d.policy_target as 'Policy Target', sr.sec_rec_name as Recommendation from baseline_main m, baseline_data d, events_main em, events_source so, events_success_failure sf, events_security_recommendation sr, events_audit_subcategory eas, events_advanced_audit_categories eaac, events_advanced_audit_subcategories eaas where m.id = d.b_id and d.subcategory = eaas.subcategory_name and em.so_id = so.id and em.success_failure_id = sf.id and em.sr_id = sr.id and em.event_id = eas.event_id and eas.audit_subc_id = eaas.id and eaas.c_id = eaac.id and m.name = '$BaselineName';"
             $results = Invoke-SqliteQuery -Query $query -DataSource $database
             if ($generateExcelYsn) {
                 $tmp = get-date -f yyyyMMddHHmmss

EventList/internal/functions/Add-MitreCheckboxes.ps1

@@ -63,7 +63,7 @@
         $tmp.location = New-Object System.Drawing.Point($x,$y)
         $tmp.Font = 'Microsoft Sans Serif,10'
 
-        $query = "select distinct ma.area_name, mt.technique_id, mt.technique_name from mitre_events me, events_main em, mitre_techniques mt, mitre_areas ma where me.technique_id = mt.id and me.event_id = em.id and me.area_id = ma.id and ma.id = '" + $area.id + "' order by technique_name;"
+        $query = "select distinct ma.area_name, mt.technique_id, mt.technique_name from mitre_events me, events_main em, mitre_techniques mt, mitre_areas ma where me.technique_id = mt.id and me.event_id = em.event_id and me.area_id = ma.id and ma.id = '" + $area.id + "' order by technique_name;"
 
         $techniques = Invoke-SqliteQuery -Query $query -DataSource $Database
 

EventList/internal/functions/Get-MitreEvents.ps1

@@ -36,13 +36,13 @@
 
         if ($AdvancedAudit){
             # if success_failure_id >= 3 it's always s+f / 1 = s / 2 = f
-            $query = "select subcategory_name, guid, sum(success_failure_id) as sf_sum from ( select distinct eaas.subcategory_name, eaas.guid, m.success_failure_id from mitre_techniques t, mitre_events e left join events_main m on e.event_id = m.id left join events_source so on m.so_id = so.id left join events_audit_subcategory eas on m.id = eas.event_id left join events_advanced_audit_subcategories eaas on eas.audit_subc_id = eaas.id where t.technique_id in ($MitreTechniques) and t.id = e.technique_id and e.event_id is not null and so.source_name = 'Advanced Audit Logs' and e.event_id <> '-1' ) group by subcategory_name, guid order by subcategory_name"
+            $query = "select subcategory_name, guid, sum(success_failure_id) as sf_sum from ( select distinct eaas.subcategory_name, eaas.guid, m.success_failure_id from mitre_techniques t, mitre_events e left join events_main m on e.event_id = em.event_id left join events_source so on m.so_id = so.id left join events_audit_subcategory eas on em.event_id = eas.event_id left join events_advanced_audit_subcategories eaas on eas.audit_subc_id = eaas.id where t.technique_id in ($MitreTechniques) and t.id = e.technique_id and e.event_id is not null and so.source_name = 'Advanced Audit Logs' and e.event_id <> '-1' ) group by subcategory_name, guid order by subcategory_name"
         }
 		elseif ($EventIds) {
-            $query = "select distinct e.event_id from mitre_techniques t, mitre_events e left join events_main m on e.event_id = m.id left join events_source so on m.so_id = so.id left join events_security_recommendation sr on m.sr_id = sr.id where t.technique_id in ($MitreTechniques) and t.id = e.technique_id and e.event_id is not null order by e.event_id"
+            $query = "select distinct e.event_id from mitre_techniques t, mitre_events e left join events_main m on e.event_id = em.event_id left join events_source so on m.so_id = so.id left join events_security_recommendation sr on m.sr_id = sr.id where t.technique_id in ($MitreTechniques) and t.id = e.technique_id and e.event_id is not null order by e.event_id"
         }
         else {
-            $query = "select t.technique_id, t.technique_name, e.event_id, m.event_name, m.link_text, so.source_name, sr.sec_rec_name from mitre_techniques t, mitre_events e left join events_main m on e.event_id = m.id left join events_source so on m.so_id = so.id left join events_security_recommendation sr on m.sr_id = sr.id where t.technique_id in ($MitreTechniques) and t.id = e.technique_id and e.event_id is not null order by e.event_id"
+            $query = "select t.technique_id, t.technique_name, e.event_id, m.event_name, m.link_text, so.source_name, sr.sec_rec_name from mitre_techniques t, mitre_events e left join events_main m on e.event_id = em.event_id left join events_source so on m.so_id = so.id left join events_security_recommendation sr on m.sr_id = sr.id where t.technique_id in ($MitreTechniques) and t.id = e.technique_id and e.event_id is not null order by e.event_id"
         }
 
         $resultStr = Invoke-SqliteQuery -Query $query -DataSource $database

README.md

@@ -147,3 +147,10 @@ It is still ordered by the MITRE ATT&CK areas & techniques, but it’s still onl
 
 
 Happy hunting!
+
+# EventList Change Log
+## 2021-03-21
+- Added new event sources: PowerShell Operational Log, WinRM, Windows Defender, Windows PowerShell, PowerShell DSC, Applocker: Packaged app-Deployment, Applocker: MSI and Script, Applocker: EXE and DLL, Applocker: Packaged app-Execution
+- Added new columns in events_source: Full Name, Log Path
+- Added more event ids to the database: PowerShell
+- Changed events_main structure: the PK "id" is no longer treated as the event id of each event. Column "event_id" was added instead. This should avoid conflicts with matching event ids in different event logs