fix: add field name to default_detail.txt (Sysmon EID 13, 14)

[fukusuket]

What Changed

• Closed Incorrect Sysmon EID 13 default_details  #616
• Closed Incorrect Sysmon EID 14 default_details #617

Test (Sysmon EID 13)

% ./hayabusa json-timeline -d ../all-evtx/Win2022-AD -m high -o out.json -w -C --include-eid 13

{
    "Timestamp": "2022-04-07 17:14:49.824 +09:00",
    "RuleTitle": "Disable Windows Defender Functionalities Via Registry Keys",
    "Level": "high",
    "Computer": "WIN-FPV0DSIC9O6.sigma.fr",
    "Channel": "Sysmon",
    "EventID": 13,
    "RecordID": 160653,
    "Details": {
        "EventType": "SetValue",
        "TgtObj": "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\TamperProtection",
        "Details": "DWORD (0x00000000)",
        "Proc": "C:\\Program Files\\Windows Defender\\MsMpEng.exe",
        "PID": 2936,
        "PGUID": "CB66FCBA-9D71-624E-4700-000000000200"
    },
    "ExtraFieldInfo": {
        "RuleName": "-",
        "User": "NT AUTHORITY\\SYSTEM",
        "UtcTime": "2022-04-07 08:14:49.818"
    }
}

Test (Sysmon EID 14)

% ./hayabusa json-timeline -d ../all-evtx/ -o eid-14.json -w -C --include-eid 14 -n -u -D

{
    "Timestamp": "2022-03-02 04:24:21.737 +09:00",
    "RuleTitle": "Reg Key Value Rename (Noisy)",
    "Level": "info",
    "Computer": "DESKTOP-6D0DBMB",
    "Channel": "Sysmon",
    "EventID": 14,
    "RecordID": 1098384,
    "Details": {
        "EventType": "RenameKey",
        "TgtObj": "HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\VREGISTRY_FC4EF5AF-A40A-4956-9AD1-3BFA0BA62E9E",
        "NewName": "HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\REGISTRY",
        "Proc": "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe",
        "PID": 8076,
        "PGUID": "6A627BFB-7265-621E-2F01-000000000300"
    },
    "ExtraFieldInfo": {
        "RuleName": "-",
        "User": "AUTORITE NT\\Système",
        "UtcTime": "2022-03-01 19:24:21.727"
    }
}

I would appreciate it if you could review when you have time🙏

[YamatoSecurity]

Thanks for finding and fixing these! What about for EID 13, we rename "TgtObj" to "RegKey". For EID 14, we rename "TgtObj" to "OldName"? I think it would be easier to understand. Also, "User" information can be important so for both events, how about we put them in "Details"?

[fukusuket]

@YamatoSecurity
Thank you so much for checking :) I updated as follows!

{
    "Timestamp": "2022-04-07 17:14:49.824 +09:00",
    "RuleTitle": "Disable Windows Defender Functionalities Via Registry Keys",
    "Level": "high",
    "Computer": "WIN-FPV0DSIC9O6.sigma.fr",
    "Channel": "Sysmon",
    "EventID": 13,
    "RecordID": 160653,
    "Details": {
        "EventType": "SetValue",
        "RegKey": "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\\TamperProtection",
        "Details": "DWORD (0x00000000)",
        "Proc": "C:\\Program Files\\Windows Defender\\MsMpEng.exe",
        "PID": 2936,
        "PGUID": "CB66FCBA-9D71-624E-4700-000000000200",
        "User": "NT AUTHORITY\\SYSTEM"
    },
    "ExtraFieldInfo": {
        "RuleName": "-",
        "UtcTime": "2022-04-07 08:14:49.818"
    }
}

{
    "Timestamp": "2022-03-02 04:24:21.737 +09:00",
    "RuleTitle": "Reg Key Value Rename (Noisy)",
    "Level": "info",
    "Computer": "DESKTOP-6D0DBMB",
    "Channel": "Sysmon",
    "EventID": 14,
    "RecordID": 1098384,
    "Details": {
        "EventType": "RenameKey",
        "OldName": "HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\VREGISTRY_FC4EF5AF-A40A-4956-9AD1-3BFA0BA62E9E",
        "NewName": "HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\REGISTRY",
        "Proc": "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe",
        "PID": 8076,
        "PGUID": "6A627BFB-7265-621E-2F01-000000000300",
        "User": "AUTORITE NT\\Système"
    },
    "ExtraFieldInfo": {
        "RuleName": "-",
        "UtcTime": "2022-03-01 19:24:21.727"
    }
}

[YamatoSecurity]

@fukusuket Thanks so much! LGTM!