Content
- Log parsers2
- Attack scenarios2
Windows - CVE DetectionParent4 items
Windows - CVE Detection
Collection
- Version
- 0.4
- Name
- crowdsecurity/windows-cve
windows CVE: try to detect local CVE exploitation on windows.
Installation
sudo cscli collections install crowdsecurity/windows-cveThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/windows-cveparsers:- crowdsecurity/windows-logs- crowdsecurity/sysmon-logsscenarios:- crowdsecurity/windows-CVE-2022-30190-msdt- crowdsecurity/CVE-2023-23397description: "windows CVE: try to detect local CVE exploitation on windows."labels:label: "Windows - CVE Detection"author: crowdsecuritytags:- security_engine- windows- local- exploit
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
A collection of windows specific CVEs :
⚠️ This collection requires a working sysmon installation. This is still a proof-of-concept, and will gain more scenarios over time.
Example acquisition config:
1source: wineventlog2pretty_name: sysmon3event_channel: "Microsoft-Windows-Sysmon/Operational"4labels:5 type: sysmon