Skip to content

Commit 5a2940c

Browse files
w0rk3rtradebot-elastic
w0rk3r
authored and
tradebot-elastic
committed
[Rule Tuning] Windows 3rd Party EDR Compatibility - Part 15 (#5030)
* [Rule Tuning] Windows 3rd Party EDR Compatibility - Part 15 * Apply suggestions from code review Co-authored-by: Samirbous <[email protected]> * ++ --------- Co-authored-by: Samirbous <[email protected]> (cherry picked from commit ccedd45)
1 parent bf2a651 commit 5a2940c

6 files changed

+56
-43
lines changed

‎rules/windows/persistence_werfault_reflectdebugger.toml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2023/08/29"
3-
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows"]
3+
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -17,6 +17,7 @@ index = [
1717
"logs-m365_defender.event-*",
1818
"logs-sentinel_one_cloud_funnel.*",
1919
"logs-windows.sysmon_operational-*",
20+
"logs-crowdstrike.fdr*",
2021
]
2122
language = "eql"
2223
license = "Elastic License v2"
@@ -69,18 +70,20 @@ tags = [
6970
"Data Source: Microsoft Defender for Endpoint",
7071
"Data Source: SentinelOne",
7172
"Data Source: Sysmon",
73+
"Data Source: Crowdstrike",
7274
"Resources: Investigation Guide",
7375
]
7476
timestamp_override = "event.ingested"
7577
type = "eql"
7678

7779
query = '''
7880
registry where host.os.type == "windows" and event.type == "change" and
79-
registry.path : (
80-
"HKLM\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Hangs\\ReflectDebugger",
81-
"\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Hangs\\ReflectDebugger",
82-
"MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Hangs\\ReflectDebugger"
83-
)
81+
registry.value : "ReflectDebugger"
82+
83+
/*
84+
Full registry key path omitted due to data source variations:
85+
HKLM\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Hangs\\ReflectDebugger
86+
*/
8487
'''
8588

8689

‎rules/windows/privilege_escalation_disable_uac_registry.toml‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2021/01/20"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -20,6 +20,7 @@ index = [
2020
"endgame-*",
2121
"logs-m365_defender.event-*",
2222
"logs-sentinel_one_cloud_funnel.*",
23+
"logs-crowdstrike.fdr*",
2324
]
2425
language = "eql"
2526
license = "Elastic License v2"
@@ -91,25 +92,22 @@ tags = [
9192
"Data Source: Sysmon",
9293
"Data Source: Microsoft Defender for Endpoint",
9394
"Data Source: SentinelOne",
95+
"Data Source: Crowdstrike",
9496
]
9597
timestamp_override = "event.ingested"
9698
type = "eql"
9799

98100
query = '''
99101
registry where host.os.type == "windows" and event.type == "change" and
100-
registry.path :
101-
(
102-
"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
103-
"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin",
104-
"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop",
105-
"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
106-
"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin",
107-
"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop",
108-
"MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
109-
"MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin",
110-
"MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop"
111-
) and
102+
registry.value : ("EnableLUA", "ConsentPromptBehaviorAdmin", "PromptOnSecureDesktop") and
112103
registry.data.strings : ("0", "0x00000000")
104+
105+
/*
106+
Full registry key path omitted due to data source variations:
107+
HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA
108+
HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin
109+
HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop
110+
*/
113111
'''
114112

115113

‎rules/windows/privilege_escalation_exploit_cve_202238028.toml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2024/04/23"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -15,6 +15,7 @@ index = [
1515
"winlogbeat-*",
1616
"logs-m365_defender.event-*",
1717
"logs-sentinel_one_cloud_funnel.*",
18+
"logs-crowdstrike.fdr*",
1819
]
1920
language = "eql"
2021
license = "Elastic License v2"
@@ -71,6 +72,7 @@ tags = [
7172
"Data Source: Sysmon",
7273
"Data Source: Microsoft Defender for Endpoint",
7374
"Data Source: SentinelOne",
75+
"Data Source: Crowdstrike",
7476
"Resources: Investigation Guide",
7577
]
7678
timestamp_override = "event.ingested"
@@ -80,8 +82,10 @@ query = '''
8082
file where host.os.type == "windows" and event.type != "deletion" and
8183
file.name : "MPDW-constraints.js" and
8284
file.path : (
83-
"?:\\*\\Windows\\system32\\DriVerStoRe\\FiLeRePoSiToRy\\*\\MPDW-constraints.js",
84-
"?:\\*\\Windows\\WinSxS\\amd64_microsoft-windows-printing-printtopdf_*\\MPDW-constraints.js"
85+
"?:\\*\\Windows\\system32\\DriverStore\\FileRepository\\*\\MPDW-constraints.js",
86+
"?:\\*\\Windows\\WinSxS\\amd64_microsoft-windows-printing-printtopdf_*\\MPDW-constraints.js",
87+
"\\Device\\HarddiskVolume*\\*\\Windows\\system32\\DriverStore\\FileRepository\\*\\MPDW-constraints.js",
88+
"\\Device\\HarddiskVolume*\\*\\Windows\\WinSxS\\amd64_microsoft-windows-printing-printtopdf_*\\MPDW-constraints.js"
8589
)
8690
'''
8791

‎rules/windows/privilege_escalation_reg_service_imagepath_mod.toml‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2024/06/05"
3-
integration = ["endpoint", "windows"]
3+
integration = ["endpoint", "windows", "crowdstrike", "sentinel_one_cloud_funnel", "m365_defender"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -12,7 +12,15 @@ privileges from groups like Server Operators may change the ImagePath of service
1212
to execute commands.
1313
"""
1414
from = "now-9m"
15-
index = ["logs-endpoint.events.registry-*", "logs-windows.sysmon_operational-*", "winlogbeat-*"]
15+
index = [
16+
"logs-endpoint.events.registry-*",
17+
"logs-windows.sysmon_operational-*",
18+
"winlogbeat-*",
19+
"logs-crowdstrike.fdr*",
20+
"logs-sentinel_one_cloud_funnel.*",
21+
"logs-m365_defender.event-*",
22+
"endgame-*",
23+
]
1624
language = "eql"
1725
license = "Elastic License v2"
1826
name = "Potential Privilege Escalation via Service ImagePath Modification"
@@ -63,14 +71,18 @@ tags = [
6371
"Tactic: Privilege Escalation",
6472
"Data Source: Elastic Defend",
6573
"Data Source: Sysmon",
74+
"Data Source: Crowdstrike",
6675
"Resources: Investigation Guide",
76+
"Data Source: SentinelOne",
77+
"Data Source: Microsoft Defender for Endpoint",
78+
"Data Source: Elastic Endgame",
6779
]
6880
timestamp_override = "event.ingested"
6981
type = "eql"
7082

7183
query = '''
7284
registry where host.os.type == "windows" and event.type == "change" and process.executable != null and
73-
event.action == "modification" and registry.value == "ImagePath" and
85+
registry.value == "ImagePath" and
7486
registry.key : (
7587
"*\\ADWS", "*\\AppHostSvc", "*\\AppReadiness", "*\\AudioEndpointBuilder", "*\\AxInstSV", "*\\camsvc", "*\\CertSvc",
7688
"*\\COMSysApp", "*\\CscService", "*\\defragsvc", "*\\DeviceAssociationService", "*\\DeviceInstall", "*\\DevQueryBroker",

‎rules/windows/privilege_escalation_rogue_windir_environment_var.toml‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/11/26"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -18,6 +18,7 @@ index = [
1818
"winlogbeat-*",
1919
"logs-m365_defender.event-*",
2020
"logs-sentinel_one_cloud_funnel.*",
21+
"logs-crowdstrike.fdr*",
2122
]
2223
language = "eql"
2324
license = "Elastic License v2"
@@ -72,6 +73,7 @@ tags = [
7273
"Data Source: Sysmon",
7374
"Data Source: Microsoft Defender for Endpoint",
7475
"Data Source: SentinelOne",
76+
"Data Source: Crowdstrike",
7577
"Resources: Investigation Guide",
7678
]
7779
timestamp_override = "event.ingested"
@@ -81,16 +83,8 @@ query = '''
8183
registry where host.os.type == "windows" and event.type == "change" and
8284
registry.value : ("windir", "systemroot") and
8385
registry.path : (
84-
"HKEY_USERS\\*\\Environment\\windir",
85-
"HKEY_USERS\\*\\Environment\\systemroot",
86-
"HKU\\*\\Environment\\windir",
87-
"HKU\\*\\Environment\\systemroot",
88-
"HKCU\\*\\Environment\\windir",
89-
"HKCU\\*\\Environment\\systemroot",
90-
"\\REGISTRY\\USER\\*\\Environment\\windir",
91-
"\\REGISTRY\\USER\\*\\Environment\\systemroot",
92-
"USER\\*\\Environment\\windir",
93-
"USER\\*\\Environment\\systemroot"
86+
"*\\Environment\\windir",
87+
"*\\Environment\\systemroot"
9488
) and
9589
not registry.data.strings : ("C:\\windows", "%SystemRoot%")
9690
'''

‎rules/windows/privilege_escalation_unquoted_service_path.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2023/07/13"
3-
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows", "system"]
3+
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows", "system", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -19,6 +19,7 @@ index = [
1919
"logs-sentinel_one_cloud_funnel.*",
2020
"logs-system.security*",
2121
"logs-windows.sysmon_operational-*",
22+
"logs-crowdstrike.fdr*",
2223
]
2324
language = "eql"
2425
license = "Elastic License v2"
@@ -72,6 +73,7 @@ tags = [
7273
"Data Source: Elastic Endgame",
7374
"Data Source: Sysmon",
7475
"Data Source: Windows Security Event Logs",
76+
"Data Source: Crowdstrike",
7577
"Resources: Investigation Guide",
7678
]
7779
timestamp_override = "event.ingested"

0 commit comments

Comments
 (0)