Skip to content

Commit a49c00a

Browse files
w0rk3rtradebot-elastic
w0rk3r
authored and
tradebot-elastic
committed
[Rule Tuning] Windows 3rd Party EDR Compatibility - Part 12 (#5027)
* [Rule Tuning] Windows 3rd Party EDR Compatibility - Part 12 * Update rules/windows/persistence_app_compat_shim.toml Co-authored-by: Samirbous <[email protected]> --------- Co-authored-by: Samirbous <[email protected]> (cherry picked from commit 7eec833)
1 parent 52b0235 commit a49c00a

5 files changed

+36
-34
lines changed

‎rules/windows/persistence_app_compat_shim.toml‎

Lines changed: 19 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/09/02"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -18,6 +18,7 @@ index = [
1818
"logs-m365_defender.event-*",
1919
"logs-sentinel_one_cloud_funnel.*",
2020
"endgame-*",
21+
"logs-crowdstrike.fdr*",
2122
]
2223
language = "eql"
2324
license = "Elastic License v2"
@@ -70,24 +71,29 @@ tags = [
7071
"Data Source: Microsoft Defender for Endpoint",
7172
"Data Source: SentinelOne",
7273
"Data Source: Elastic Endgame",
74+
"Data Source: Crowdstrike",
7375
"Resources: Investigation Guide",
7476
]
7577
timestamp_override = "event.ingested"
7678
type = "eql"
7779

7880
query = '''
7981
registry where host.os.type == "windows" and event.type == "change" and
80-
registry.path : (
81-
"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb",
82-
"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb",
83-
"MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb"
84-
) and
85-
not process.executable :
86-
("?:\\Program Files (x86)\\DesktopCentral_Agent\\swrepository\\1\\swuploads\\SAP-SLC\\SAPSetupSLC02_14-80001954\\Setup\\NwSapSetup.exe",
87-
"?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
88-
"?:\\Program Files (x86)\\SAP\\SAPsetup\\setup\\NwSapSetup.exe",
89-
"?:\\Program Files (x86)\\SAP\\SapSetup\\OnRebootSvc\\NWSAPSetupOnRebootInstSvc.exe",
90-
"?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\kavfs.exe")
82+
registry.path : "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb" and
83+
not process.executable : (
84+
"?:\\Program Files (x86)\\DesktopCentral_Agent\\*\\Setup\\NwSapSetup.exe",
85+
"?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
86+
"?:\\Program Files (x86)\\SAP\\SAPsetup\\setup\\NwSapSetup.exe",
87+
"?:\\Program Files (x86)\\SAP\\SapSetup\\OnRebootSvc\\NWSAPSetupOnRebootInstSvc.exe",
88+
"?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\kavfs.exe",
89+
90+
/* Crowdstrike specific exclusion as it uses NT Object paths */
91+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\DesktopCentral_Agent\\*\\Setup\\NwSapSetup.exe",
92+
"\\Device\\HarddiskVolume*\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe",
93+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\SAP\\SAPsetup\\setup\\NwSapSetup.exe",
94+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\SAP\\SapSetup\\OnRebootSvc\\NWSAPSetupOnRebootInstSvc.exe",
95+
"\\Device\\HarddiskVolume*\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\kavfs.exe"
96+
)
9197
'''
9298

9399

‎rules/windows/persistence_appcertdlls_registry.toml‎

Lines changed: 5 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/11/18"
3-
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
3+
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -18,6 +18,7 @@ index = [
1818
"endgame-*",
1919
"logs-sentinel_one_cloud_funnel.*",
2020
"logs-m365_defender.event-*",
21+
"logs-crowdstrike.fdr*",
2122
]
2223
language = "eql"
2324
license = "Elastic License v2"
@@ -59,14 +60,6 @@ AppCert DLLs are dynamic link libraries that can be configured to load with ever
5960
- Implement enhanced monitoring and logging for the specific registry paths and related process creation activities to detect any future unauthorized changes promptly."""
6061
risk_score = 47
6162
rule_id = "513f0ffd-b317-4b9c-9494-92ce861f22c7"
62-
setup = """## Setup
63-
64-
If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
65-
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
66-
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
67-
`event.ingested` to @timestamp.
68-
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
69-
"""
7063
severity = "medium"
7164
tags = [
7265
"Domain: Endpoint",
@@ -79,18 +72,15 @@ tags = [
7972
"Data Source: Sysmon",
8073
"Data Source: SentinelOne",
8174
"Data Source: Microsoft Defender for Endpoint",
75+
"Data Source: Crowdstrike",
8276
"Resources: Investigation Guide",
8377
]
8478
timestamp_override = "event.ingested"
8579
type = "eql"
8680

8781
query = '''
8882
registry where host.os.type == "windows" and event.type == "change" and
89-
registry.path : (
90-
"HKLM\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*",
91-
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*",
92-
"MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*"
93-
)
83+
registry.path : "*\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*"
9484
'''
9585

9686

‎rules/windows/persistence_evasion_hidden_local_account_creation.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/12/18"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -19,6 +19,7 @@ index = [
1919
"endgame-*",
2020
"logs-m365_defender.event-*",
2121
"logs-sentinel_one_cloud_funnel.*",
22+
"logs-crowdstrike.fdr*",
2223
]
2324
language = "eql"
2425
license = "Elastic License v2"
@@ -68,6 +69,7 @@ tags = [
6869
"Data Source: Sysmon",
6970
"Data Source: Microsoft Defender for Endpoint",
7071
"Data Source: SentinelOne",
72+
"Data Source: Crowdstrike",
7173
]
7274
timestamp_override = "event.ingested"
7375
type = "eql"

‎rules/windows/persistence_evasion_registry_ifeo_injection.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/11/17"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -18,6 +18,7 @@ index = [
1818
"winlogbeat-*",
1919
"logs-m365_defender.event-*",
2020
"logs-sentinel_one_cloud_funnel.*",
21+
"logs-crowdstrike.fdr*",
2122
]
2223
language = "eql"
2324
license = "Elastic License v2"
@@ -73,6 +74,7 @@ tags = [
7374
"Data Source: Sysmon",
7475
"Data Source: Microsoft Defender for Endpoint",
7576
"Data Source: SentinelOne",
77+
"Data Source: Crowdstrike",
7678
"Resources: Investigation Guide",
7779
]
7880
timestamp_override = "event.ingested"

‎rules/windows/persistence_evasion_registry_startup_shell_folder_modified.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2021/03/15"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[transform]
88
[[transform.osquery]]
@@ -44,6 +44,7 @@ index = [
4444
"winlogbeat-*",
4545
"logs-m365_defender.event-*",
4646
"logs-sentinel_one_cloud_funnel.*",
47+
"logs-crowdstrike.fdr*",
4748
]
4849
language = "eql"
4950
license = "Elastic License v2"
@@ -119,6 +120,7 @@ tags = [
119120
"Data Source: Sysmon",
120121
"Data Source: Microsoft Defender for Endpoint",
121122
"Data Source: SentinelOne",
123+
"Data Source: Crowdstrike",
122124
]
123125
timestamp_override = "event.ingested"
124126
type = "eql"

0 commit comments

Comments
 (0)