Skip to content

Commit e916de5

Browse files
w0rk3rtradebot-elastic
w0rk3r
authored and
tradebot-elastic
committed
[Rule Tuning] Windows 3rd Party EDR Compatibility - Part 10 (#5025)
* [Rule Tuning] Windows 3rd Party EDR Compatibility - Part 10 * Update rules/windows/execution_shared_modules_local_sxs_dll.toml * pending adjustments * Update execution_windows_cmd_shell_susp_args.toml (cherry picked from commit a31b3a3)
1 parent 1491a4a commit e916de5

5 files changed

+102
-68
lines changed

‎rules/windows/execution_shared_modules_local_sxs_dll.toml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/10/28"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -19,6 +19,7 @@ index = [
1919
"endgame-*",
2020
"logs-m365_defender.event-*",
2121
"logs-sentinel_one_cloud_funnel.*",
22+
"logs-crowdstrike.fdr*",
2223
]
2324
language = "eql"
2425
license = "Elastic License v2"
@@ -41,13 +42,19 @@ tags = [
4142
"Data Source: Sysmon",
4243
"Data Source: Microsoft Defender for Endpoint",
4344
"Data Source: SentinelOne",
45+
"Data Source: Crowdstrike",
4446
"Resources: Investigation Guide",
4547
]
4648
timestamp_override = "event.ingested"
4749
type = "eql"
4850

4951
query = '''
50-
file where host.os.type == "windows" and file.extension : "dll" and file.path : "C:\\*\\*.exe.local\\*.dll"
52+
file where host.os.type == "windows" and file.extension : "dll" and
53+
file.path : (
54+
"C:\\*\\*.exe.local\\*.dll",
55+
/* Crowdstrike specific condition as it uses NT Object paths */
56+
"\\Device\\HarddiskVolume*\\*\\*.exe.local\\*.dll"
57+
)
5158
'''
5259

5360

‎rules/windows/execution_suspicious_psexesvc.toml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/08/14"
3-
integration = ["endpoint", "windows", "m365_defender"]
3+
integration = ["endpoint", "windows", "m365_defender", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/05/05"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -17,6 +17,7 @@ index = [
1717
"logs-windows.sysmon_operational-*",
1818
"endgame-*",
1919
"logs-m365_defender.event-*",
20+
"logs-crowdstrike.fdr*",
2021
]
2122
language = "eql"
2223
license = "Elastic License v2"
@@ -61,11 +62,12 @@ tags = [
6162
"Use Case: Threat Detection",
6263
"Tactic: Execution",
6364
"Tactic: Defense Evasion",
64-
"Data Source: Elastic Endgame",
6565
"Resources: Investigation Guide",
66+
"Data Source: Elastic Endgame",
6667
"Data Source: Elastic Defend",
6768
"Data Source: Sysmon",
6869
"Data Source: Microsoft Defender for Endpoint",
70+
"Data Source: Crowdstrike",
6971
]
7072
timestamp_override = "event.ingested"
7173
type = "eql"

‎rules/windows/execution_windows_cmd_shell_susp_args.toml‎

Lines changed: 76 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2024/09/06"
3-
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender"]
3+
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/09/01"
66

77
[rule]
88
author = ["Elastic"]
@@ -12,12 +12,14 @@ is often observed during malware installation.
1212
"""
1313
from = "now-9m"
1414
index = [
15+
"logs-crowdstrike.fdr*",
1516
"logs-m365_defender.event-*",
1617
"logs-sentinel_one_cloud_funnel.*",
1718
"logs-system.security*",
1819
"logs-windows.forwarded*",
1920
"logs-windows.sysmon_operational-*",
2021
"winlogbeat-*",
22+
"endgame-*",
2123
]
2224
language = "eql"
2325
license = "Elastic License v2"
@@ -65,76 +67,93 @@ tags = [
6567
"OS: Windows",
6668
"Use Case: Threat Detection",
6769
"Tactic: Execution",
70+
"Resources: Investigation Guide",
6871
"Data Source: Windows Security Event Logs",
6972
"Data Source: Sysmon",
7073
"Data Source: SentinelOne",
7174
"Data Source: Microsoft Defender for Endpoint",
72-
"Resources: Investigation Guide",
75+
"Data Source: Elastic Endgame",
76+
"Data Source: Crowdstrike",
7377
]
7478
timestamp_override = "event.ingested"
7579
type = "eql"
7680

7781
query = '''
7882
process where host.os.type == "windows" and event.type == "start" and
79-
process.name : "cmd.exe" and
80-
(
81-
82-
process.command_line : ("*).Run(*", "*GetObject*", "* curl*regsvr32*", "*echo*wscript*", "*echo*ZONE.identifier*",
83-
"*ActiveXObject*", "*dir /s /b *echo*", "*unescape(*", "*findstr*TVNDRgAAAA*", "*findstr*passw*", "*start*\\\\*\\DavWWWRoot\\*",
84-
"* explorer*%CD%*", "*%cd%\\*.js*", "*attrib*%CD%*", "*/?cMD<*", "*/AutoIt3ExecuteScript*..*", "*&cls&cls&cls&cls&cls&*",
85-
"*&#*;&#*;&#*;&#*;*", "* &&s^eT*", "*& ChrW(*", "*&explorer /root*", "*start __ & __\\*", "*findstr /V /L *forfiles*",
86-
"*=wscri& set *", "*http*!COmpUternaME!*", "*start *.pdf * start /min cmd.exe /c *\\\\*", "*pip install*System.Net.WebClient*",
87-
"*Invoke-WebReques*Start-Process*", "*-command (Invoke-webrequest*", "*copy /b *\\\\* ping *-n*", "*echo*.ToCharArray*") or
88-
89-
(process.args : "echo" and process.parent.name : ("wscript.exe", "mshta.exe")) or
90-
91-
process.args : ("1>?:\\*.vbs", "1>?:\\*.js") or
92-
93-
(process.args : "explorer.exe" and process.args : "type" and process.args : ">" and process.args : "start") or
94-
95-
(process.parent.name : "explorer.exe" and
96-
process.command_line :
97-
("*&&S^eT *",
98-
"*&& set *&& set *&& set *&& set *&& set *&& call*",
99-
"**\\u00??\\u00??\\u00??\\u00??\\u00??\\u00??\\u00??\\u00??*")) or
100-
101-
(process.parent.name : "explorer.exe" and process.args : "copy" and process.args : "&&" and process.args : "\\\\*@*\\*")
83+
process.name : "cmd.exe" and
84+
(
85+
process.command_line : (
86+
"*).Run(*", "*GetObject*", "* curl*regsvr32*", "*echo*wscript*", "*echo*ZONE.identifier*",
87+
"*ActiveXObject*", "*dir /s /b *echo*", "*unescape(*", "*findstr*TVNDRgAAAA*", "*findstr*passw*", "*start*\\\\*\\DavWWWRoot\\*",
88+
"* explorer*%CD%*", "*%cd%\\*.js*", "*attrib*%CD%*", "*/?cMD<*", "*/AutoIt3ExecuteScript*..*", "*&cls&cls&cls&cls&cls&*",
89+
"*&#*;&#*;&#*;&#*;*", "* &&s^eT*", "*& ChrW(*", "*&explorer /root*", "*start __ & __\\*", "*findstr /V /L *forfiles*",
90+
"*=wscri& set *", "*http*!COmpUternaME!*", "*start *.pdf * start /min cmd.exe /c *\\\\*", "*pip install*System.Net.WebClient*",
91+
"*Invoke-WebReques*Start-Process*", "*-command (Invoke-webrequest*", "*copy /b *\\\\* ping *-n*", "*echo*.ToCharArray*"
92+
) or
93+
94+
(process.args : "echo" and process.parent.name : ("wscript.exe", "mshta.exe")) or
95+
96+
process.args : ("1>?:\\*.vbs", "1>?:\\*.js") or
97+
98+
(process.args : "explorer.exe" and process.args : "type" and process.args : ">" and process.args : "start") or
99+
100+
(
101+
process.parent.name : "explorer.exe" and
102+
process.command_line : (
103+
"*&&S^eT *",
104+
"*&& set *&& set *&& set *&& set *&& set *&& call*",
105+
"**\\u00??\\u00??\\u00??\\u00??\\u00??\\u00??\\u00??\\u00??*"
106+
)
107+
) or
108+
109+
(process.parent.name : "explorer.exe" and process.args : "copy" and process.args : "&&" and process.args : "\\\\*@*\\*")
102110
) and
103111
104112
/* false positives */
105113
not (process.args : "%TEMP%\\Spiceworks\\*" and process.parent.name : "wmiprvse.exe") and
106-
not process.parent.executable :
107-
("?:\\Perl64\\bin\\perl.exe",
108-
"?:\\Program Files\\nodejs\\node.exe",
109-
"?:\\Program Files\\HP\\RS\\pgsql\\bin\\pg_dumpall.exe",
110-
"?:\\Program Files (x86)\\PRTG Network Monitor\\64 bit\\PRTG Server.exe",
111-
"?:\\Program Files (x86)\\Spiceworks\\bin\\spiceworks-finder.exe",
112-
"?:\\Program Files (x86)\\Zuercher Suite\\production\\leds\\leds.exe",
113-
"?:\\Program Files\\Tripwire\\Agent\\Plugins\\twexec\\twexec.exe",
114-
"D:\\Agents\\?\\_work\\_tasks\\*\\SonarScanner.MSBuild.exe",
115-
"?:\\Program Files\\Microsoft VS Code\\Code.exe",
116-
"?:\\programmiweb\\NetBeans-*\\netbeans\\bin\\netbeans64.exe",
117-
"?:\\Program Files (x86)\\Public Safety Suite Professional\\production\\leds\\leds.exe",
118-
"?:\\Program Files (x86)\\Tier2Tickets\\button_gui.exe",
119-
"?:\\Program Files\\NetBeans-*\\netbeans\\bin\\netbeans*.exe",
120-
"?:\\Program Files (x86)\\Public Safety Suite Professional\\production\\leds\\leds.exe",
121-
"?:\\Program Files (x86)\\Tier2Tickets\\button_gui.exe",
122-
"?:\\Program Files (x86)\\Helpdesk Button\\button_gui.exe",
123-
"?:\\VTSPortable\\VTS\\jre\\bin\\javaw.exe",
124-
"?:\\Program Files\\Bot Framework Composer\\Bot Framework Composer.exe",
125-
"?:\\Program Files\\KMSYS Worldwide\\eQuate\\*\\SessionMgr.exe",
126-
"?:\\Program Files (x86)\\Craneware\\Pricing Analyzer\\Craneware.Pricing.Shell.exe",
127-
"?:\\Program Files (x86)\\jumpcloud-agent-app\\jumpcloud-agent-app.exe",
128-
"?:\\Program Files\\PostgreSQL\\*\\bin\\pg_dumpall.exe",
129-
"?:\\Program Files (x86)\\Vim\\vim*\\vimrun.exe") and
114+
not ?process.parent.executable : (
115+
"?:\\Perl64\\bin\\perl.exe",
116+
"?:\\Program Files\\nodejs\\node.exe",
117+
"?:\\Program Files\\HP\\RS\\pgsql\\bin\\pg_dumpall.exe",
118+
"?:\\Program Files (x86)\\PRTG Network Monitor\\64 bit\\PRTG Server.exe",
119+
"?:\\Program Files (x86)\\Spiceworks\\bin\\spiceworks-finder.exe",
120+
"?:\\Program Files (x86)\\Zuercher Suite\\production\\leds\\leds.exe",
121+
"?:\\Program Files\\Tripwire\\Agent\\Plugins\\twexec\\twexec.exe",
122+
"D:\\Agents\\?\\_work\\_tasks\\*\\SonarScanner.MSBuild.exe",
123+
"?:\\Program Files\\Microsoft VS Code\\Code.exe",
124+
"?:\\programmiweb\\NetBeans-*\\netbeans\\bin\\netbeans64.exe",
125+
"?:\\Program Files (x86)\\Public Safety Suite Professional\\production\\leds\\leds.exe",
126+
"?:\\Program Files (x86)\\Tier2Tickets\\button_gui.exe",
127+
"?:\\Program Files\\NetBeans-*\\netbeans\\bin\\netbeans*.exe",
128+
"?:\\Program Files (x86)\\Public Safety Suite Professional\\production\\leds\\leds.exe",
129+
"?:\\Program Files (x86)\\Tier2Tickets\\button_gui.exe",
130+
"?:\\Program Files (x86)\\Helpdesk Button\\button_gui.exe",
131+
"?:\\VTSPortable\\VTS\\jre\\bin\\javaw.exe",
132+
"?:\\Program Files\\Bot Framework Composer\\Bot Framework Composer.exe",
133+
"?:\\Program Files\\KMSYS Worldwide\\eQuate\\*\\SessionMgr.exe",
134+
"?:\\Program Files (x86)\\Craneware\\Pricing Analyzer\\Craneware.Pricing.Shell.exe",
135+
"?:\\Program Files (x86)\\jumpcloud-agent-app\\jumpcloud-agent-app.exe",
136+
"?:\\Program Files\\PostgreSQL\\*\\bin\\pg_dumpall.exe",
137+
"?:\\Program Files (x86)\\Vim\\vim*\\vimrun.exe") and
138+
not (
139+
/* Crowdstrike doesn't populate process.parent.executable */
140+
event.dataset == "crowdstrike.fdr" and
141+
process.parent.name : (
142+
"perl.exe", "node.exe", "pg_dumpall.exe", "PRTG Server.exe", "spiceworks-finder.exe", "leds.exe", "twexec.exe",
143+
"SonarScanner.MSBuild.exe", "Code.exe", "netbeans64.exe", "javaw.exe", "Bot Framework Composer.exe", "SessionMgr.exe",
144+
"Craneware.Pricing.Shell.exe", "jumpcloud-agent-app.exe", "vimrun.exe"
145+
)
146+
) and
130147
not (process.args : "?:\\Program Files\\Citrix\\Secure Access Client\\nsauto.exe" and process.parent.name : "userinit.exe") and
131-
not process.args :
132-
("?:\\Program Files (x86)\\PCMatic\\PCPitstopScheduleService.exe",
133-
"?:\\Program Files (x86)\\AllesTechnologyAgent\\*",
134-
"https://auth.axis.com/oauth2/oauth-authorize*") and
135-
not process.command_line :
136-
("\"cmd\" /c %NETBEANS_MAVEN_COMMAND_LINE%",
137-
"?:\\Windows\\system32\\cmd.exe /q /d /s /c \"npm.cmd ^\"install^\" ^\"--no-bin-links^\" ^\"--production^\"\"") and
148+
not process.args : (
149+
"?:\\Program Files (x86)\\PCMatic\\PCPitstopScheduleService.exe",
150+
"?:\\Program Files (x86)\\AllesTechnologyAgent\\*",
151+
"https://auth.axis.com/oauth2/oauth-authorize*"
152+
) and
153+
not process.command_line : (
154+
"\"cmd\" /c %NETBEANS_MAVEN_COMMAND_LINE%",
155+
"?:\\Windows\\system32\\cmd.exe /q /d /s /c \"npm.cmd ^\"install^\" ^\"--no-bin-links^\" ^\"--production^\"\""
156+
) and
138157
not (process.name : "cmd.exe" and process.args : "%TEMP%\\Spiceworks\\*" and process.args : "http*/dataloader/persist_netstat_data") and
139158
not (process.args == "echo" and process.args == "GEQ" and process.args == "1073741824")
140159
'''

‎rules/windows/execution_windows_powershell_susp_args.toml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2024/09/06"
3-
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
3+
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/08/04"
5+
updated_date = "2025/09/01"
66

77
[rule]
88
author = ["Elastic"]
@@ -12,13 +12,15 @@ installation leveraging PowerShell.
1212
"""
1313
from = "now-9m"
1414
index = [
15+
"logs-endpoint.events.process-*",
1516
"logs-crowdstrike.fdr*",
1617
"logs-m365_defender.event-*",
1718
"logs-sentinel_one_cloud_funnel.*",
1819
"logs-system.security*",
1920
"logs-windows.forwarded*",
2021
"logs-windows.sysmon_operational-*",
2122
"winlogbeat-*",
23+
"endgame-*",
2224
]
2325
language = "eql"
2426
license = "Elastic License v2"
@@ -67,10 +69,12 @@ tags = [
6769
"Use Case: Threat Detection",
6870
"Tactic: Execution",
6971
"Data Source: Windows Security Event Logs",
72+
"Data Source: Elastic Defend",
7073
"Data Source: Sysmon",
7174
"Data Source: SentinelOne",
7275
"Data Source: Microsoft Defender for Endpoint",
7376
"Data Source: Crowdstrike",
77+
"Data Source: Elastic Endgame",
7478
"Resources: Investigation Guide",
7579
]
7680
timestamp_override = "event.ingested"

‎rules/windows/initial_access_rdp_file_mail_attachment.toml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2024/11/05"
3-
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -20,6 +20,7 @@ index = [
2020
"logs-windows.forwarded*",
2121
"logs-windows.sysmon_operational-*",
2222
"winlogbeat-*",
23+
"logs-crowdstrike.fdr*",
2324
]
2425
language = "eql"
2526
license = "Elastic License v2"
@@ -79,6 +80,7 @@ tags = [
7980
"Data Source: Microsoft Defender for Endpoint",
8081
"Data Source: Sysmon",
8182
"Data Source: SentinelOne",
83+
"Data Source: Crowdstrike",
8284
"Resources: Investigation Guide",
8385
]
8486
timestamp_override = "event.ingested"
@@ -92,7 +94,7 @@ process where host.os.type == "windows" and event.type == "start" and
9294
"?:\\Users\\*\\AppData\\Local\\Temp\\7z*.rdp",
9395
"?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*.rdp",
9496
"?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*.rdp",
95-
"C:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\*.rdp")
97+
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\*.rdp")
9698
'''
9799

98100

0 commit comments

Comments
 (0)