Skip to content

Commit 8ab9845

Browse files
w0rk3rSamirbous
w0rk3r
and
Samirbous
authored
[Rule Tuning] Windows 3rd Party EDR Compatibility - Part 2 (#5017)
* [Rule Tuning] Windows 3rd Party EDR Compatibility - Part 2 * Update defense_evasion_code_signing_policy_modification_registry.toml * Update defense_evasion_communication_apps_suspicious_child_process.toml * Update rules/windows/defense_evasion_communication_apps_suspicious_child_process.toml * Update defense_evasion_communication_apps_suspicious_child_process.toml --------- Co-authored-by: Samirbous <[email protected]>
1 parent 00c6e78 commit 8ab9845

5 files changed

+39
-46
lines changed

‎rules/windows/defense_evasion_code_signing_policy_modification_registry.toml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2023/01/31"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[transform]
88
[[transform.osquery]]
@@ -37,6 +37,7 @@ index = [
3737
"endgame-*",
3838
"logs-m365_defender.event-*",
3939
"logs-sentinel_one_cloud_funnel.*",
40+
"logs-crowdstrike.fdr*",
4041
]
4142
language = "eql"
4243
license = "Elastic License v2"
@@ -103,14 +104,19 @@ tags = [
103104
"Data Source: Sysmon",
104105
"Data Source: Microsoft Defender for Endpoint",
105106
"Data Source: SentinelOne",
107+
"Data Source: Crowdstrike",
106108
]
107109
timestamp_override = "event.ingested"
108110
type = "eql"
109111

110112
query = '''
111113
registry where host.os.type == "windows" and event.type == "change" and
112-
registry.value: "BehaviorOnFailedVerify" and registry.data.strings : ("0", "0x00000000", "1", "0x00000001")
113-
114+
registry.value: "BehaviorOnFailedVerify" and registry.data.strings : ("0", "0x00000000", "1", "0x00000001") and
115+
not process.executable :
116+
("?:\\Windows\\System32\\svchost.exe",
117+
"?:\\Windows\\CCM\\CcmExec.exe",
118+
"\\Device\\HarddiskVolume*\\Windows\\system32\\svchost.exe",
119+
"\\Device\\HarddiskVolume*\\Windows\\CCM\\CcmExec.exe")
114120
/*
115121
Full registry key path omitted due to data source variations:
116122
"HKEY_USERS\\*\\Software\\Policies\\Microsoft\\Windows NT\\Driver Signing\\BehaviorOnFailedVerify"

‎rules/windows/defense_evasion_communication_apps_suspicious_child_process.toml‎

Lines changed: 17 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2023/08/04"
3-
integration = ["endpoint"]
3+
integration = ["endpoint", "sentinel_one_cloud_funnel"]
44
maturity = "production"
5-
updated_date = "2025/05/05"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -11,7 +11,7 @@ Identifies suspicious child processes of communications apps, which can indicate
1111
communication app or the exploitation of a vulnerability on the application causing it to execute code.
1212
"""
1313
from = "now-9m"
14-
index = ["logs-endpoint.events.process-*"]
14+
index = ["logs-endpoint.events.process-*", "logs-sentinel_one_cloud_funnel.*", "endgame-*"]
1515
language = "eql"
1616
license = "Elastic License v2"
1717
name = "Suspicious Communication App Child Process"
@@ -26,28 +26,31 @@ tags = [
2626
"Tactic: Persistence",
2727
"Data Source: Elastic Defend",
2828
"Resources: Investigation Guide",
29+
"Data Source: SentinelOne",
30+
"Data Source: Elastic Endgame",
2931
]
3032
timestamp_override = "event.ingested"
3133
type = "eql"
3234

3335
query = '''
34-
process where host.os.type == "windows" and event.type == "start" and
36+
process where host.os.type == "windows" and event.type == "start" and
37+
not process.executable :
38+
("?:\\Program Files\\*.exe",
39+
"?:\\Program Files (x86)\\*.exe",
40+
"?:\\Windows\\System32\\WerFault.exe",
41+
"?:\\Windows\\SysWOW64\\WerFault.exe") and
3542
(
3643
/* Slack */
3744
(process.parent.name : "slack.exe" and not
3845
(
3946
(
4047
process.executable : (
41-
"?:\\Program Files\\*",
42-
"?:\\Program Files (x86)\\*",
4348
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
4449
"?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
4550
"?:\\Users\\*\\AppData\\Roaming\\Zoom\\bin*\\Zoom.exe",
4651
"?:\\Windows\\System32\\rundll32.exe",
4752
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
4853
"?:\\Windows\\System32\\notepad.exe",
49-
"?:\\Windows\\System32\\WerFault.exe",
50-
"?:\\Windows\\SysWOW64\\WerFault.exe",
5154
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\opera.exe"
5255
) and process.code_signature.trusted == true
5356
) or
@@ -69,10 +72,6 @@ process where host.os.type == "windows" and event.type == "start" and
6972
(
7073
(
7174
process.executable : (
72-
"?:\\Program Files\\*",
73-
"?:\\Program Files (x86)\\*",
74-
"?:\\Windows\\System32\\WerFault.exe",
75-
"?:\\Windows\\SysWOW64\\WerFault.exe",
7675
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
7776
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
7877
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\opera.exe"
@@ -93,13 +92,10 @@ process where host.os.type == "windows" and event.type == "start" and
9392
(
9493
(
9594
process.executable : (
96-
"?:\\Program Files\\*",
97-
"?:\\Program Files (x86)\\*",
98-
"?:\\Windows\\System32\\WerFault.exe",
99-
"?:\\Windows\\SysWOW64\\WerFault.exe",
10095
"?:\\Windows\\BrowserCore\\BrowserCore.exe",
10196
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
102-
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe"
97+
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
98+
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe"
10399
) and process.code_signature.trusted == true
104100
) or
105101
(
@@ -119,13 +115,9 @@ process where host.os.type == "windows" and event.type == "start" and
119115
(
120116
(
121117
process.executable : (
122-
"?:\\Program Files\\*",
123-
"?:\\Program Files (x86)\\*",
124118
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
125119
"?:\\Windows\\System32\\reg.exe",
126-
"?:\\Windows\\SysWOW64\\reg.exe",
127-
"?:\\Windows\\System32\\WerFault.exe",
128-
"?:\\Windows\\SysWOW64\\WerFault.exe"
120+
"?:\\Windows\\SysWOW64\\reg.exe"
129121
) and process.code_signature.trusted == true
130122
) or
131123
(
@@ -155,10 +147,6 @@ process where host.os.type == "windows" and event.type == "start" and
155147
(
156148
(
157149
process.executable : (
158-
"?:\\Program Files\\*",
159-
"?:\\Program Files (x86)\\*",
160-
"?:\\Windows\\System32\\WerFault.exe",
161-
"?:\\Windows\\SysWOW64\\WerFault.exe",
162150
"?:\\Windows\\System32\\reg.exe",
163151
"?:\\Windows\\SysWOW64\\reg.exe"
164152
) and process.code_signature.trusted == true
@@ -181,13 +169,9 @@ process where host.os.type == "windows" and event.type == "start" and
181169
(
182170
(
183171
process.executable : (
184-
"?:\\Program Files\\*",
185-
"?:\\Program Files (x86)\\*",
186172
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
187173
"?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
188-
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
189-
"?:\\Windows\\System32\\WerFault.exe",
190-
"?:\\Windows\\SysWOW64\\WerFault.exe"
174+
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe"
191175
) and process.code_signature.trusted == true
192176
) or
193177
(
@@ -203,11 +187,8 @@ process where host.os.type == "windows" and event.type == "start" and
203187
(
204188
(
205189
process.executable : (
206-
"?:\\Program Files\\*",
207-
"?:\\Program Files (x86)\\*",
208-
"?:\\Windows\\System32\\WerFault.exe",
209-
"?:\\Windows\\SysWOW64\\WerFault.exe",
210-
"?:\\Windows\\splwow64.exe"
190+
"?:\\Windows\\splwow64.exe",
191+
"?:\\Windows\\System32\\spool\\drivers\\x64\\3\\*.EXE"
211192
) and process.code_signature.trusted == true
212193
) or
213194
(

‎rules/windows/defense_evasion_disable_nla.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2023/08/25"
3-
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows"]
3+
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -20,6 +20,7 @@ index = [
2020
"logs-m365_defender.event-*",
2121
"logs-sentinel_one_cloud_funnel.*",
2222
"logs-windows.sysmon_operational-*",
23+
"logs-crowdstrike.fdr*",
2324
]
2425
language = "eql"
2526
license = "Elastic License v2"
@@ -74,6 +75,7 @@ tags = [
7475
"Data Source: SentinelOne",
7576
"Data Source: Sysmon",
7677
"Resources: Investigation Guide",
78+
"Data Source: Crowdstrike",
7779
]
7880
timestamp_override = "event.ingested"
7981
type = "eql"

‎rules/windows/defense_evasion_dns_over_https_enabled.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2021/07/22"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Austin Songer"]
@@ -19,6 +19,7 @@ index = [
1919
"endgame-*",
2020
"logs-m365_defender.event-*",
2121
"logs-sentinel_one_cloud_funnel.*",
22+
"logs-crowdstrike.fdr*",
2223
]
2324
language = "eql"
2425
license = "Elastic License v2"
@@ -74,6 +75,7 @@ tags = [
7475
"Data Source: Microsoft Defender for Endpoint",
7576
"Data Source: SentinelOne",
7677
"Resources: Investigation Guide",
78+
"Data Source: Crowdstrike",
7779
]
7880
timestamp_override = "event.ingested"
7981
type = "eql"

‎rules/windows/defense_evasion_execution_msbuild_started_renamed.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/03/25"
3-
integration = ["endpoint", "windows", "m365_defender"]
3+
integration = ["endpoint", "windows", "m365_defender", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/05/05"
5+
updated_date = "2025/08/26"
66

77
[transform]
88
[[transform.osquery]]
@@ -44,6 +44,7 @@ index = [
4444
"logs-windows.sysmon_operational-*",
4545
"endgame-*",
4646
"logs-m365_defender.event-*",
47+
"logs-crowdstrike.fdr*",
4748
]
4849
language = "eql"
4950
license = "Elastic License v2"
@@ -112,6 +113,7 @@ tags = [
112113
"Data Source: Elastic Defend",
113114
"Data Source: Sysmon",
114115
"Data Source: Microsoft Defender for Endpoint",
116+
"Data Source: Crowdstrike",
115117
]
116118
timestamp_override = "event.ingested"
117119
type = "eql"

0 commit comments

Comments
 (0)