Skip to content

Commit d06383a

Browse files
w0rk3rtradebot-elastic
w0rk3r
authored and
tradebot-elastic
committed
[Rule Tuning] Communication App Rules (#5487)
* [Rule Tuning] Communication App Rules * Update defense_evasion_masquerading_business_apps_installer.toml * Update defense_evasion_masquerading_business_apps_installer.toml * Update defense_evasion_masquerading_communication_apps.toml * Update defense_evasion_masquerading_business_apps_installer.toml --------- Co-authored-by: Samirbous <[email protected]> (cherry picked from commit 5ec8e3e)
1 parent 7a29f99 commit d06383a

4 files changed

+54
-45
lines changed

‎rules/windows/command_and_control_common_webservices.toml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2020/11/04"
33
integration = ["endpoint", "sentinel_one_cloud_funnel"]
44
maturity = "production"
5-
updated_date = "2025/12/01"
5+
updated_date = "2025/12/17"
66

77
[transform]
88
[[transform.investigate]]
@@ -296,7 +296,8 @@ network where host.os.type == "windows" and
296296
) or
297297
298298
/* Zoom */
299-
(process.name : "Zoom.exe" and (process.code_signature.subject_name : "Zoom Video Communications, Inc." and
299+
(process.name : "Zoom.exe" and (
300+
process.code_signature.subject_name : ("Zoom Video Communications, Inc.", "Zoom Communications, Inc.") and
300301
process.code_signature.trusted == true) and dns.question.name : ("www.googleapis.com", "graph.microsoft.com")
301302
) or
302303

‎rules/windows/defense_evasion_communication_apps_suspicious_child_process.toml‎

Lines changed: 29 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2023/08/04"
33
integration = ["endpoint", "sentinel_one_cloud_funnel"]
44
maturity = "production"
5-
updated_date = "2025/08/26"
5+
updated_date = "2025/12/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -33,25 +33,36 @@ timestamp_override = "event.ingested"
3333
type = "eql"
3434

3535
query = '''
36-
process where host.os.type == "windows" and event.type == "start" and
37-
not process.executable :
38-
("?:\\Program Files\\*.exe",
36+
process where host.os.type == "windows" and event.type == "start" and
37+
process.parent.name : (
38+
"slack.exe", "CiscoCollabHost.exe", "WebexHost.exe", "Teams.exe",
39+
"Discord.exe", "Whatsapp.exe", "Zoom.exe", "thunderbird.exe"
40+
) and
41+
not process.executable : (
42+
"?:\\Program Files\\*.exe",
3943
"?:\\Program Files (x86)\\*.exe",
4044
"?:\\Windows\\System32\\WerFault.exe",
41-
"?:\\Windows\\SysWOW64\\WerFault.exe") and
45+
"?:\\Windows\\SysWOW64\\WerFault.exe"
46+
) and
47+
48+
/* Common Signed Browser Processes */
49+
not (
50+
process.executable : (
51+
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
52+
"?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
53+
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
54+
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\opera.exe"
55+
) and process.code_signature.trusted == true
56+
) and
4257
(
4358
/* Slack */
4459
(process.parent.name : "slack.exe" and not
4560
(
4661
(
4762
process.executable : (
48-
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
49-
"?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
5063
"?:\\Users\\*\\AppData\\Roaming\\Zoom\\bin*\\Zoom.exe",
5164
"?:\\Windows\\System32\\rundll32.exe",
52-
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
53-
"?:\\Windows\\System32\\notepad.exe",
54-
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\opera.exe"
65+
"?:\\Windows\\System32\\notepad.exe"
5566
) and process.code_signature.trusted == true
5667
) or
5768
(
@@ -70,20 +81,11 @@ process where host.os.type == "windows" and event.type == "start" and
7081
/* WebEx */
7182
(process.parent.name : ("CiscoCollabHost.exe", "WebexHost.exe") and not
7283
(
73-
(
74-
process.executable : (
75-
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
76-
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
77-
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\opera.exe"
78-
) and process.code_signature.trusted == true
79-
) or
80-
(
81-
process.code_signature.subject_name : (
82-
"Cisco Systems, Inc.",
83-
"Cisco WebEx LLC",
84-
"Cisco Systems Inc."
85-
) and process.code_signature.trusted == true
86-
)
84+
process.code_signature.subject_name : (
85+
"Cisco Systems, Inc.",
86+
"Cisco WebEx LLC",
87+
"Cisco Systems Inc."
88+
) and process.code_signature.trusted == true
8789
)
8890
) or
8991
@@ -93,8 +95,6 @@ process where host.os.type == "windows" and event.type == "start" and
9395
(
9496
process.executable : (
9597
"?:\\Windows\\BrowserCore\\BrowserCore.exe",
96-
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
97-
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
9898
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe"
9999
) and process.code_signature.trusted == true
100100
) or
@@ -115,7 +115,6 @@ process where host.os.type == "windows" and event.type == "start" and
115115
(
116116
(
117117
process.executable : (
118-
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
119118
"?:\\Windows\\System32\\reg.exe",
120119
"?:\\Windows\\SysWOW64\\reg.exe"
121120
) and process.code_signature.trusted == true
@@ -169,14 +168,13 @@ process where host.os.type == "windows" and event.type == "start" and
169168
(
170169
(
171170
process.executable : (
172-
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
173-
"?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
174-
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe"
171+
"?:\\Users\\*\\AppData\\Local\\BraveSoftware\\Brave-Browser\\Application\\brave.exe"
175172
) and process.code_signature.trusted == true
176173
) or
177174
(
178175
process.code_signature.subject_name : (
179-
"Zoom Video Communications, Inc."
176+
"Zoom Video Communications, Inc.",
177+
"Zoom Communications, Inc."
180178
) and process.code_signature.trusted == true
181179
)
182180
)

‎rules/windows/defense_evasion_masquerading_business_apps_installer.toml‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2023/09/01"
33
integration = ["endpoint"]
44
maturity = "production"
5-
updated_date = "2025/08/26"
5+
updated_date = "2025/12/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -25,21 +25,21 @@ severity = "low"
2525
tags = [
2626
"Domain: Endpoint",
2727
"Data Source: Elastic Defend",
28+
"Data Source: Elastic Endgame",
2829
"OS: Windows",
2930
"Use Case: Threat Detection",
3031
"Tactic: Defense Evasion",
3132
"Tactic: Initial Access",
3233
"Tactic: Execution",
33-
"Resources: Investigation Guide",
34-
"Data Source: Elastic Endgame",
34+
"Resources: Investigation Guide"
3535
]
3636
timestamp_override = "event.ingested"
3737
type = "eql"
3838

3939
query = '''
40-
process where host.os.type == "windows" and
40+
process where host.os.type == "windows" and
4141
event.type == "start" and process.executable : "?:\\Users\\*\\Downloads\\*" and
42-
not process.code_signature.status : ("errorCode_endpoint*", "errorUntrustedRoot", "errorChaining") and
42+
not process.code_signature.status like ("errorCode_endpoint*", "errorUntrustedRoot", "errorChaining") and process.hash.sha256 != null and
4343
(
4444
/* Slack */
4545
(process.name : "*slack*.exe" and not
@@ -69,13 +69,17 @@ process where host.os.type == "windows" and
6969
(process.code_signature.subject_name in (
7070
"WhatsApp LLC",
7171
"WhatsApp, Inc",
72-
"24803D75-212C-471A-BC57-9EF86AB91435"
72+
"24803D75-212C-471A-BC57-9EF86AB91435",
73+
/* WhatsApp Installer - MS Store */
74+
"Microsoft Corporation"
7375
) and process.code_signature.trusted == true)
7476
) or
7577
7678
/* Zoom */
7779
(process.name : ("*zoom*installer*.exe", "*zoom*setup*.exe", "zoom.exe") and not
78-
(process.code_signature.subject_name == "Zoom Video Communications, Inc." and process.code_signature.trusted == true)
80+
(process.code_signature.subject_name in (
81+
"Zoom Video Communications, Inc.", "Zoom Communications, Inc."
82+
) and process.code_signature.trusted == true)
7983
) or
8084
8185
/* Outlook */

‎rules/windows/defense_evasion_masquerading_communication_apps.toml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2023/05/05"
33
integration = ["endpoint", "sentinel_one_cloud_funnel"]
44
maturity = "production"
5-
updated_date = "2025/08/26"
5+
updated_date = "2025/12/17"
66

77
[rule]
88
author = ["Elastic"]
@@ -33,7 +33,8 @@ type = "eql"
3333

3434
query = '''
3535
process where host.os.type == "windows" and
36-
event.type == "start" and
36+
event.type == "start" and
37+
not process.code_signature.status like "errorCode_endpoint*" and process.hash.sha256 != null and
3738
(
3839
/* Slack */
3940
(process.name : "slack.exe" and not
@@ -50,7 +51,8 @@ process where host.os.type == "windows" and
5051
5152
/* Teams */
5253
(process.name : "Teams.exe" and not
53-
(process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
54+
(process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true) and
55+
process.executable != "C:\\Program Files (x86)\\Teams Installer\\Teams.exe"
5456
) or
5557
5658
/* Discord */
@@ -60,7 +62,8 @@ process where host.os.type == "windows" and
6062
6163
/* RocketChat */
6264
(process.name : "Rocket.Chat.exe" and not
63-
(process.code_signature.subject_name : "Rocket.Chat Technologies Corp." and process.code_signature.trusted == true)
65+
(process.code_signature.subject_name : "Rocket.Chat Technologies Corp." and process.code_signature.trusted == true) and
66+
process.executable != "C:\\Program Files\\rocketchat\\Rocket.Chat.exe"
6467
) or
6568
6669
/* Mattermost */
@@ -79,7 +82,10 @@ process where host.os.type == "windows" and
7982
8083
/* Zoom */
8184
(process.name : "Zoom.exe" and not
82-
(process.code_signature.subject_name : "Zoom Video Communications, Inc." and process.code_signature.trusted == true)
85+
(process.code_signature.subject_name : (
86+
"Zoom Video Communications, Inc.",
87+
"Zoom Communications, Inc."
88+
) and process.code_signature.trusted == true)
8389
) or
8490
8591
/* Outlook */

0 commit comments

Comments
 (0)