Skip to content

Commit 7fd9509

Browse files
w0rk3rtradebot-elastic
w0rk3r
authored and
tradebot-elastic
committed
[Rule Tuning] 3rd Party EDR Compatibility - Adjust CS Windows Paths (#5037)
* [Rule Tuning] 3rd Party EDR Compatibility - Adjust CS Windows Paths * ++ * Update defense_evasion_workfolders_control_execution.toml * Update privilege_escalation_uac_bypass_event_viewer.toml (cherry picked from commit b2bc602)
1 parent bd6a7ae commit 7fd9509

12 files changed

+74
-54
lines changed

‎rules/windows/defense_evasion_lolbas_win_cdb_utility.toml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2024/07/24"
33
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/28"
66

77
[rule]
88
author = ["Elastic"]
@@ -85,8 +85,10 @@ process where host.os.type == "windows" and event.type == "start" and
8585
not process.executable : (
8686
"?:\\Program Files (x86)\\*\\cdb.exe",
8787
"?:\\Program Files\\*\\cdb.exe",
88-
"\\Device\\HarddiskVolume?\\Program Files (x86)\\*\\cdb.exe",
89-
"\\Device\\HarddiskVolume?\\Program Files\\*\\cdb.exe"
88+
89+
/* Crowdstrike specific exclusion as it uses NT Object paths */
90+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*\\cdb.exe",
91+
"\\Device\\HarddiskVolume*\\Program Files\\*\\cdb.exe"
9092
)
9193
'''
9294

‎rules/windows/defense_evasion_masquerading_trusted_directory.toml‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/11/18"
33
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/05/05"
5+
updated_date = "2025/08/28"
66

77
[rule]
88
author = ["Elastic"]
@@ -85,7 +85,7 @@ query = '''
8585
process where host.os.type == "windows" and event.type == "start" and
8686
process.executable : (
8787
"C:\\*Program*Files*\\*.exe",
88-
"\\Device\\HarddiskVolume?\\*Program*Files*\\*.exe"
88+
"\\Device\\HarddiskVolume*\\*Program*Files*\\*.exe"
8989
) and
9090
not process.executable : (
9191
"?:\\Program Files\\*.exe",
@@ -97,15 +97,16 @@ process where host.os.type == "windows" and event.type == "start" and
9797
"?:\\Windows\\Temp\\.opera\\????????????\\CProgram?Files?(x86)Opera*\\*.exe"
9898
) and
9999
not (
100+
/* Crowdstrike specific exclusion as it uses NT Object paths */
100101
event.dataset == "crowdstrike.fdr" and
101102
process.executable : (
102-
"\\Device\\HarddiskVolume?\\Program Files\\*.exe",
103-
"\\Device\\HarddiskVolume?\\Program Files (x86)\\*.exe",
104-
"\\Device\\HarddiskVolume?\\Users\\*.exe",
105-
"\\Device\\HarddiskVolume?\\ProgramData\\*.exe",
106-
"\\Device\\HarddiskVolume?\\Windows\\Downloaded Program Files\\*.exe",
107-
"\\Device\\HarddiskVolume?\\Windows\\Temp\\.opera\\????????????\\CProgram?FilesOpera*\\*.exe",
108-
"\\Device\\HarddiskVolume?\\Windows\\Temp\\.opera\\????????????\\CProgram?Files?(x86)Opera*\\*.exe"
103+
"\\Device\\HarddiskVolume*\\Program Files\\*.exe",
104+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
105+
"\\Device\\HarddiskVolume*\\Users\\*.exe",
106+
"\\Device\\HarddiskVolume*\\ProgramData\\*.exe",
107+
"\\Device\\HarddiskVolume*\\Windows\\Downloaded Program Files\\*.exe",
108+
"\\Device\\HarddiskVolume*\\Windows\\Temp\\.opera\\????????????\\CProgram?FilesOpera*\\*.exe",
109+
"\\Device\\HarddiskVolume*\\Windows\\Temp\\.opera\\????????????\\CProgram?Files?(x86)Opera*\\*.exe"
109110
)
110111
)
111112
'''

‎rules/windows/defense_evasion_workfolders_control_execution.toml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2022/03/02"
33
integration = ["windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/28"
66

77
[rule]
88
author = ["Elastic", "Austin Songer"]
@@ -85,8 +85,10 @@ process where host.os.type == "windows" and event.type == "start" and
8585
not process.executable : (
8686
"?:\\Windows\\System32\\control.exe",
8787
"?:\\Windows\\SysWOW64\\control.exe",
88-
"\\Device\\HarddiskVolume?\\Windows\\System32\\control.exe",
89-
"\\Device\\HarddiskVolume?\\Windows\\SysWOW64\\control.exe"
88+
89+
/* Crowdstrike specific condition as it uses NT Object paths */
90+
"\\Device\\HarddiskVolume*\\Windows\\System32\\control.exe",
91+
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\control.exe"
9092
)
9193
'''
9294

‎rules/windows/defense_evasion_wsl_child_process.toml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2023/01/12"
33
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/28"
66

77
[rule]
88
author = ["Elastic"]
@@ -94,15 +94,16 @@ process where host.os.type == "windows" and event.type : "start" and
9494
"?:\\Windows\\Sys?????\\wslconfig.exe"
9595
) and
9696
not (
97+
/* Crowdstrike specific exclusion as it uses NT Object paths */
9798
event.dataset == "crowdstrike.fdr" and
9899
process.executable : (
99-
"\\Device\\HarddiskVolume?\\Program Files (x86)\\*",
100-
"\\Device\\HarddiskVolume?\\Program Files\\*",
101-
"\\Device\\HarddiskVolume?\\Program Files*\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemForLinux_*\\wsl*.exe",
102-
"\\Device\\HarddiskVolume?\\Windows\\System32\\conhost.exe",
103-
"\\Device\\HarddiskVolume?\\Windows\\System32\\lxss\\wslhost.exe",
104-
"\\Device\\HarddiskVolume?\\Windows\\System32\\WerFault.exe",
105-
"\\Device\\HarddiskVolume?\\Windows\\Sys?????\\wslconfig.exe"
100+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
101+
"\\Device\\HarddiskVolume*\\Program Files\\*",
102+
"\\Device\\HarddiskVolume*\\Program Files*\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemForLinux_*\\wsl*.exe",
103+
"\\Device\\HarddiskVolume*\\Windows\\System32\\conhost.exe",
104+
"\\Device\\HarddiskVolume*\\Windows\\System32\\lxss\\wslhost.exe",
105+
"\\Device\\HarddiskVolume*\\Windows\\System32\\WerFault.exe",
106+
"\\Device\\HarddiskVolume*\\Windows\\Sys?????\\wslconfig.exe"
106107
)
107108
)
108109
'''

‎rules/windows/defense_evasion_wsl_kalilinux.toml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2023/01/12"
33
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/28"
66

77
[rule]
88
author = ["Elastic"]
@@ -88,9 +88,11 @@ process where host.os.type == "windows" and event.type == "start" and
8888
"?:\\Users\\*\\AppData\\Local\\packages\\kalilinux*",
8989
"?:\\Users\\*\\AppData\\Local\\Microsoft\\WindowsApps\\kali.exe",
9090
"?:\\Program Files*\\WindowsApps\\KaliLinux.*\\kali.exe",
91-
"\\Device\\HarddiskVolume?\\Users\\*\\AppData\\Local\\packages\\kalilinux*",
92-
"\\Device\\HarddiskVolume?\\Users\\*\\AppData\\Local\\Microsoft\\WindowsApps\\kali.exe",
93-
"\\Device\\HarddiskVolume?\\Program Files*\\WindowsApps\\KaliLinux.*\\kali.exe"
91+
92+
/* Crowdstrike specific exclusion as it uses NT Object paths */
93+
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\packages\\kalilinux*",
94+
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Microsoft\\WindowsApps\\kali.exe",
95+
"\\Device\\HarddiskVolume*\\Program Files*\\WindowsApps\\KaliLinux.*\\kali.exe"
9496
)
9597
)
9698
'''

‎rules/windows/execution_com_object_xwizard.toml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2021/01/20"
33
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "system", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/28"
66

77
[rule]
88
author = ["Elastic"]
@@ -93,8 +93,10 @@ process where host.os.type == "windows" and event.type == "start" and
9393
not process.executable : (
9494
"C:\\Windows\\SysWOW64\\xwizard.exe",
9595
"C:\\Windows\\System32\\xwizard.exe",
96-
"\\Device\\HarddiskVolume?\\Windows\\SysWOW64\\xwizard.exe",
97-
"\\Device\\HarddiskVolume?\\Windows\\System32\\xwizard.exe"
96+
97+
/* Crowdstrike specific exclusion as it uses NT Object paths */
98+
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\xwizard.exe",
99+
"\\Device\\HarddiskVolume*\\Windows\\System32\\xwizard.exe"
98100
)
99101
)
100102
)

‎rules/windows/execution_via_mmc_console_file_unusual_path.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2024/06/19"
33
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/28"
66

77
[rule]
88
author = ["Elastic"]
@@ -84,7 +84,9 @@ query = '''
8484
process where host.os.type == "windows" and event.type == "start" and
8585
process.executable : (
8686
"?:\\Windows\\System32\\mmc.exe",
87-
"\\Device\\HarddiskVolume?\\Windows\\System32\\mmc.exe"
87+
88+
/* Crowdstrike specific condition as it uses NT Object paths */
89+
"\\Device\\HarddiskVolume*\\Windows\\System32\\mmc.exe"
8890
) and
8991
process.args : "*.msc" and
9092
not process.args : (

‎rules/windows/initial_access_execution_from_inetcache.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2024/02/14"
33
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/28"
66

77
[rule]
88
author = ["Elastic"]
@@ -91,7 +91,9 @@ process where host.os.type == "windows" and event.type == "start" and
9191
process.args : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" or
9292
process.executable : (
9393
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*",
94-
"\\Device\\HarddiskVolume?\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*"
94+
95+
/* Crowdstrike specific exclusion as it uses NT Object paths */
96+
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*"
9597
)
9698
)
9799
'''

‎rules/windows/initial_access_suspicious_ms_exchange_process.toml‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2021/03/04"
33
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/28"
66

77
[rule]
88
author = ["Elastic", "Austin Songer"]
@@ -105,15 +105,17 @@ process where host.os.type == "windows" and event.type == "start" and
105105
"D:\\Exchange\\Bin\\UMWorkerProcess.exe",
106106
"D:\\Exchange Server\\Bin\\UMWorkerProcess.exe",
107107
"E:\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe",
108-
"\\Device\\HarddiskVolume?\\Windows\\System32\\werfault.exe",
109-
"\\Device\\HarddiskVolume?\\Windows\\System32\\wermgr.exe",
110-
"\\Device\\HarddiskVolume?\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
111-
"\\Device\\HarddiskVolume?\\Program Files\\Microsoft\\Exchange Server\\Bin\\UMWorkerProcess.exe",
112-
"\\Device\\HarddiskVolume?\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
113-
"\\Device\\HarddiskVolume?\\ExchangeServer\\Bin\\UMWorkerProcess.exe",
114-
"\\Device\\HarddiskVolume?\\Exchange\\Bin\\UMWorkerProcess.exe",
115-
"\\Device\\HarddiskVolume?\\Exchange Server\\Bin\\UMWorkerProcess.exe",
116-
"\\Device\\HarddiskVolume?\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe"
108+
109+
/* Crowdstrike specific exclusion as it uses NT Object paths */
110+
"\\Device\\HarddiskVolume*\\Windows\\System32\\werfault.exe",
111+
"\\Device\\HarddiskVolume*\\Windows\\System32\\wermgr.exe",
112+
"\\Device\\HarddiskVolume*\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
113+
"\\Device\\HarddiskVolume*\\Program Files\\Microsoft\\Exchange Server\\Bin\\UMWorkerProcess.exe",
114+
"\\Device\\HarddiskVolume*\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
115+
"\\Device\\HarddiskVolume*\\ExchangeServer\\Bin\\UMWorkerProcess.exe",
116+
"\\Device\\HarddiskVolume*\\Exchange\\Bin\\UMWorkerProcess.exe",
117+
"\\Device\\HarddiskVolume*\\Exchange Server\\Bin\\UMWorkerProcess.exe",
118+
"\\Device\\HarddiskVolume*\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe"
117119
)
118120
'''
119121

‎rules/windows/persistence_adobe_hijack_persistence.toml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/02/18"
33
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/08/26"
5+
updated_date = "2025/08/28"
66

77
[transform]
88
[[transform.osquery]]
@@ -122,8 +122,8 @@ file where host.os.type == "windows" and event.type == "creation" and
122122
"?:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
123123
124124
/* Crowdstrike specific condition as it uses NT Object paths */
125-
"\\Device\\HarddiskVolume?\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
126-
"\\Device\\HarddiskVolume?\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe"
125+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
126+
"\\Device\\HarddiskVolume*\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe"
127127
) and
128128
not process.name : ("msiexec.exe", "AdobeARM.exe")
129129
'''

0 commit comments

Comments
 (0)