feat(rules/windows): update adfs, certificate services, sid history and smbv1 rules

Author: JocLRojas

rules/windows/adfs_authentication_anomalies.yml

@@ -24,7 +24,7 @@ description: |
   5. Consider implementing IP-based blocking if malicious activity is confirmed
   6. Review ADFS configuration for security hardening opportunities
   7. Correlate with other authentication events across the domain
-where: equals("log.providerName", "AD FS") && (equals("log.eventId", "411") || equals("log.eventId", "342") || equals("log.eventId", "516")) && contains("log.message", "token validation failed")
+where: equals("log.providerName", "AD FS") && (equals("log.eventCode", "342") || equals("log.eventCode", "516")) && contains("log.message", "token validation failed")
 afterEvents:
   - indexPattern: v11-log-wineventlog-*
     with:

rules/windows/certificate_services_abuse.yml

@@ -24,7 +24,7 @@ description: |
   5. Examine the requesting host for signs of compromise
   6. Consider revoking any suspicious certificates issued
   7. Validate Certificate Authority security configurations and access controls
-where: (equals("log.eventId", "4886") || equals("log.eventId", "4887")) && equals("log.providerName", "Microsoft-Windows-Security-Auditing") && (contains("log.eventDataSubjectUserName", "$") || equals("log.eventDataSubjectUserName", "ANONYMOUS LOGON"))
+where: (equals("log.eventCode", "4886") || equals("log.eventCode", "4887")) && equals("log.providerName", "Microsoft-Windows-Security-Auditing") && (contains("log.eventDataSubjectUserName", "$") || equals("log.eventDataSubjectUserName", "ANONYMOUS LOGON"))
 groupBy:
   - lastEvent.log.eventDataSubjectUserName
   - origin.host

rules/windows/sid_history_injection.yml

@@ -27,7 +27,7 @@ description: |
   6. Consider resetting the target account password and removing unauthorized SID History entries
   7. Review domain administrator accounts and privileged group memberships for anomalies
 where: |
-  oneOf("log.eventId", ["4765", "4766"]) &&
+  oneOf("log.eventCode", ["4765", "4766"]) &&
   equals("log.channel", "Security")
 groupBy:
   - origin.host

rules/windows/smbv1_usage_detection.yml

@@ -24,7 +24,7 @@ description: |
   5. Plan migration to SMBv2/SMBv3 and disable SMBv1 on all systems where possible
   6. Monitor for any lateral movement patterns that may indicate ongoing compromise
   7. Consider implementing network segmentation to limit exposure if SMBv1 cannot be immediately disabled
-where: equals("log.eventId", "3000") && equals("log.providerName", "Microsoft-Windows-SMBServer") && contains("log.message", "SMB1")
+where: equals("log.eventCode", "3000") && equals("log.providerName", "Microsoft-Windows-SMBServer") && contains("log.message", "SMB1")
 groupBy:
   - origin.host
   - origin.ip