Skip to content

Commit a23649d

Browse files
w0rk3rw0rk3r
committed
[Rule Tuning] Windows Misc Tuning
1 parent 5c1ee12 commit a23649d

7 files changed

+85
-32
lines changed

‎rules/windows/command_and_control_common_webservices.toml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/11/04"
33
integration = ["endpoint", "sentinel_one_cloud_funnel"]
44
maturity = "production"
5-
updated_date = "2025/11/04"
5+
updated_date = "2025/12/01"
66

77
[transform]
88
[[transform.investigate]]
@@ -291,8 +291,9 @@ network where host.os.type == "windows" and
291291
dns.question.name : ("*.sharepoint.com", "graph.microsoft.com", "g.live.com", "login.live.com")
292292
) or
293293
294-
(process.code_signature.subject_name : "Python Software Foundation" and process.code_signature.trusted == true and
295-
dns.question.name : "files.pythonhosted.org") or
294+
(process.code_signature.subject_name : ("Python Software Foundation", "Anaconda, Inc.") and
295+
process.code_signature.trusted == true and dns.question.name : "files.pythonhosted.org"
296+
) or
296297
297298
/* Zoom */
298299
(process.name : "Zoom.exe" and (process.code_signature.subject_name : "Zoom Video Communications, Inc." and

‎rules/windows/execution_suspicious_powershell_imgload.toml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/11/17"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/09/18"
5+
updated_date = "2025/12/01"
66

77
[rule]
88
author = ["Elastic"]
@@ -92,12 +92,13 @@ host.os.type:windows and event.category:library and
9292
process.code_signature.trusted:true
9393
) and
9494
not (
95-
process.executable: C\:\\Windows\\AdminArsenal\\PDQInventory-Scanner\\service-*\\exec\\PDQInventoryScanner.exe and
95+
proces
96+
processs.executable: C\:\\Windows\\AdminArsenal\\PDQInventory-Scanner\\service-*\\exec\\PDQInventoryScanner.exe and
9697
process.code_signature.subject_name:"PDQ.com Corporation" and
9798
process.code_signature.trusted:true
9899
) and
99100
not (
100-
process.executable: C\:\\Windows\\Temp\\\{*\}\\_is*.exe and
101+
process.name: (_is*.exe or "DellInstaller_x64.exe") and
101102
process.code_signature.subject_name:("Dell Technologies Inc." or "Dell Inc" or "Dell Inc.") and
102103
process.code_signature.trusted:true
103104
) and
@@ -106,6 +107,11 @@ host.os.type:windows and event.category:library and
106107
process.code_signature.subject_name:("Chocolatey Software, Inc." or "Chocolatey Software, Inc") and
107108
process.code_signature.trusted:true
108109
) and
110+
not (
111+
process.name: "Docker Desktop Installer.exe" and
112+
process.code_signature.subject_name:"Docker Inc" and
113+
process.code_signature.trusted:true
114+
) and
109115
not process.executable : (
110116
"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" or
111117
"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"

‎rules/windows/persistence_browser_extension_install.toml‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2023/08/22"
33
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows"]
44
maturity = "production"
5-
updated_date = "2025/05/05"
5+
updated_date = "2025/12/01"
66

77
[rule]
88
author = ["Elastic"]
@@ -84,7 +84,24 @@ file where host.os.type == "windows" and event.type : "creation" and
8484
not
8585
(
8686
process.name : "firefox.exe" and
87-
file.name : ("langpack-*@firefox.mozilla.org.xpi", "*@dictionaries.addons.mozilla.org.xpi")
87+
file.name : (
88+
"langpack-*@firefox.mozilla.org.xpi",
89+
"*@dictionaries.addons.mozilla.org.xpi",
90+
"[email protected]",
91+
"[email protected]",
92+
/* AdBlockPlus */
93+
"{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi",
94+
/* Bitwarden */
95+
"{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi",
96+
"[email protected]",
97+
/* 1Password */
98+
"{d634138d-c276-4fc8-924b-40a0ea21d284}.xpi",
99+
"[email protected]",
100+
/* Grammarly */
101+
"[email protected]",
102+
"[email protected]",
103+
"[email protected]"
104+
)
88105
)
89106
) or
90107
/* Chromium-Based Browsers */

‎rules/windows/persistence_via_application_shimming.toml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/02/18"
33
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/12/01"
66

77
[rule]
88
author = ["Elastic"]
@@ -85,7 +85,17 @@ query = '''
8585
process where host.os.type == "windows" and event.type == "start" and process.name : "sdbinst.exe" and
8686
process.args : "?*" and
8787
not (process.args : "-m" and process.args : "-bg") and
88-
not process.args : "-mm"
88+
not process.args : (
89+
"-mm",
90+
"?:\\Program Files\\WindowsApps\\Microsoft.ApplicationCompatibilityEnhancements_*\\sdb\\sysMergeInboxStoreApp.sdb",
91+
"\"?:\\Program Files\\WindowsApps\\Microsoft.ApplicationCompatibilityEnhancements_*\\sdb\\sysMergeInboxStoreApp.sdb\"",
92+
"?:\\Program Files\\WindowsApps\\Microsoft.ApplicationCompatibilityEnhancements_*\\sdb\\msiMergeInboxStoreApp.sdb",
93+
"\"?:\\Program Files\\WindowsApps\\Microsoft.ApplicationCompatibilityEnhancements_*\\sdb\\msiMergeInboxStoreApp.sdb\"",
94+
"?:\\Program Files (x86)\\Citrix\\ICA Client\\CitrixWorkspaceLegacySWDA.sdb",
95+
"Citrix Workspace",
96+
"C:\\Program Files\\IIS Express\\iisexpressshim.sdb",
97+
"C:\\Program Files (x86)\\IIS Express\\iisexpressshim.sdb"
98+
)
8999
'''
90100

91101

‎rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml‎

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,14 @@
22
creation_date = "2022/10/20"
33
integration = ["windows", "system"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/12/01"
66

77
[rule]
88
author = ["Elastic"]
99
description = """
10-
Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries
11-
may create a new process with a different token to escalate privileges and bypass access controls.
10+
Identifies a process running with a non-SYSTEM account that enables the SeDebugPrivilege privilege. Adversaries may
11+
enable this privilege to debug and modify other processes, typically reserved for system-level tasks, to escalate
12+
privileges and bypass access controls.
1213
"""
1314
from = "now-9m"
1415
index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
@@ -94,21 +95,26 @@ any where host.os.type == "windows" and event.provider: "Microsoft-Windows-Secur
9495
/* exclude processes with System Integrity */
9596
not winlog.event_data.SubjectUserSid : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
9697
97-
not winlog.event_data.ProcessName :
98-
("?:\\Windows\\System32\\msiexec.exe",
99-
"?:\\Windows\\SysWOW64\\msiexec.exe",
100-
"?:\\Windows\\System32\\lsass.exe",
101-
"?:\\Windows\\WinSxS\\*",
102-
"?:\\Program Files\\*",
103-
"?:\\Program Files (x86)\\*",
104-
"?:\\Windows\\System32\\MRT.exe",
105-
"?:\\Windows\\System32\\cleanmgr.exe",
106-
"?:\\Windows\\System32\\taskhostw.exe",
107-
"?:\\Windows\\System32\\mmc.exe",
108-
"?:\\Users\\*\\AppData\\Local\\Temp\\*-*\\DismHost.exe",
109-
"?:\\Windows\\System32\\auditpol.exe",
110-
"?:\\Windows\\System32\\wbem\\WmiPrvSe.exe",
111-
"?:\\Windows\\SysWOW64\\wbem\\WmiPrvSe.exe")
98+
not winlog.event_data.ProcessName : (
99+
"?:\\Program Files (x86)\\*",
100+
"?:\\Program Files\\*",
101+
"?:\\Users\\*\\AppData\\Local\\Temp\\*-*\\DismHost.exe",
102+
"?:\\Windows\\System32\\auditpol.exe",
103+
"?:\\Windows\\System32\\cleanmgr.exe",
104+
"?:\\Windows\\System32\\lsass.exe",
105+
"?:\\Windows\\System32\\mmc.exe",
106+
"?:\\Windows\\System32\\MRT.exe",
107+
"?:\\Windows\\System32\\msiexec.exe",
108+
"?:\\Windows\\System32\\sdiagnhost.exe",
109+
"?:\\Windows\\System32\\ServerManager.exe",
110+
"?:\\Windows\\System32\\taskhostw.exe",
111+
"?:\\Windows\\System32\\wbem\\WmiPrvSe.exe",
112+
"?:\\Windows\\System32\\WerFault.exe",
113+
"?:\\Windows\\SysWOW64\\msiexec.exe",
114+
"?:\\Windows\\SysWOW64\\wbem\\WmiPrvSe.exe",
115+
"?:\\Windows\\SysWOW64\\WerFault.exe",
116+
"?:\\Windows\\WinSxS\\*"
117+
)
112118
'''
113119

114120

‎rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2021/07/06"
33
integration = ["endpoint", "windows", "system", "crowdstrike", "sentinel_one_cloud_funnel", "m365_defender"]
44
maturity = "production"
5-
updated_date = "2025/08/28"
5+
updated_date = "2025/12/01"
66

77
[rule]
88
author = ["Elastic"]
@@ -105,10 +105,22 @@ process where host.os.type == "windows" and event.type == "start" and
105105
not process.executable : (
106106
"?:\\Program Files (x86)\\CutePDF Writer\\CPWriter2.exe",
107107
"?:\\Program Files (x86)\\GPLGS\\gswin32c.exe",
108+
"?:\\Program Files (x86)\\Acro Software\\CutePDF Writer\\CPWSave.exe",
109+
"?:\\Program Files (x86)\\Acro Software\\CutePDF Writer\\CPWriter2.exe",
110+
"?:\\Program Files (x86)\\CutePDF Writer\\CPWSave.exe",
111+
"?:\\Program Files (x86)\\TSplus\\UniversalPrinter\\CPWriter2.exe",
112+
"?:\\Program Files\\Seagull\\Printer Drivers\\Packages\\*\\DriverEnvironmentSetup.exe",
113+
"?:\\Windows\\system32\\CNAB4RPD.EXE",
108114
109115
/* Crowdstrike specific condition as it uses NT Object paths */
110116
"\\Device\\HarddiskVolume*\\Program Files (x86)\\CutePDF Writer\\CPWriter2.exe",
111-
"\\Device\\HarddiskVolume*\\Program Files (x86)\\GPLGS\\gswin32c.exe"
117+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\GPLGS\\gswin32c.exe",
118+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\Acro Software\\CutePDF Writer\\CPWSave.exe",
119+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\Acro Software\\CutePDF Writer\\CPWriter2.exe",
120+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\CutePDF Writer\\CPWSave.exe",
121+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\TSplus\\UniversalPrinter\\CPWriter2.exe",
122+
"\\Device\\HarddiskVolume*\\Program Files\\Seagull\\Printer Drivers\\Packages\\*\\DriverEnvironmentSetup.exe",
123+
"\\Device\\HarddiskVolume*\\Windows\\system32\\CNAB4RPD.EXE"
112124
)
113125
'''
114126

‎rules/windows/privilege_escalation_via_ppid_spoofing.toml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2022/10/20"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/01/15"
5+
updated_date = "2025/12/01"
66

77
[rule]
88
author = ["Elastic"]
@@ -58,7 +58,8 @@ process where host.os.type == "windows" and event.action == "start" and
5858
not (process.parent.executable : "?:\\Windows\\System32\\Utilman.exe" and
5959
process.executable : ("?:\\Windows\\System32\\osk.exe",
6060
"?:\\Windows\\System32\\Narrator.exe",
61-
"?:\\Windows\\System32\\Magnify.exe")) and
61+
"?:\\Windows\\System32\\Magnify.exe",
62+
"?:\\Windows\\System32\\VoiceAccess.exe")) and
6263
6364
not process.parent.executable : "?:\\Windows\\System32\\AtBroker.exe" and
6465

0 commit comments

Comments
 (0)