Skip to content

Commit e9dfd3f

Browse files
w0rk3rtradebot-elastic
w0rk3r
authored and
tradebot-elastic
committed
[Rule Tuning] Windows 3rd Party EDR Compatibility - Part 1 (#5016)
* [Rule Tuning] Windows 3rd Party EDR Compatibility - Part 1 * Update defense_evasion_amsi_bypass_dllhijack.toml * Update command_and_control_outlook_home_page.toml * Update command_and_control_outlook_home_page.toml * Update defense_evasion_amsi_bypass_dllhijack.toml * Update rules/windows/command_and_control_port_forwarding_added_registry.toml Co-authored-by: Samirbous <[email protected]> --------- Co-authored-by: Samirbous <[email protected]> (cherry picked from commit 9c2ceb2)
1 parent 25920a1 commit e9dfd3f

5 files changed

+46
-40
lines changed

‎rules/windows/command_and_control_outlook_home_page.toml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2024/08/01"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/06/12"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -18,6 +18,7 @@ index = [
1818
"endgame-*",
1919
"logs-m365_defender.event-*",
2020
"logs-sentinel_one_cloud_funnel.*",
21+
"logs-crowdstrike.fdr*",
2122
]
2223
language = "eql"
2324
license = "Elastic License v2"
@@ -60,9 +61,9 @@ references = [
6061
"https://cloud.google.com/blog/topics/threat-intelligence/breaking-the-rules-tough-outlook-for-home-page-attacks/",
6162
"https://github.com/trustedsec/specula",
6263
]
63-
risk_score = 47
64+
risk_score = 73
6465
rule_id = "ac5a2759-5c34-440a-b0c4-51fe674611d6"
65-
severity = "medium"
66+
severity = "high"
6667
tags = [
6768
"Domain: Endpoint",
6869
"OS: Windows",
@@ -75,6 +76,7 @@ tags = [
7576
"Data Source: Microsoft Defender for Endpoint",
7677
"Data Source: SentinelOne",
7778
"Resources: Investigation Guide",
79+
"Data Source: Crowdstrike",
7880
]
7981
timestamp_override = "event.ingested"
8082
type = "eql"
@@ -84,7 +86,7 @@ registry where host.os.type == "windows" and event.action != "deletion" and regi
8486
registry.path : (
8587
"*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Webview\\*",
8688
"*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Today\\*"
87-
) and registry.data.strings : "*://*"
89+
) and registry.data.strings : ("*://*", "*http*")
8890
'''
8991

9092

‎rules/windows/command_and_control_port_forwarding_added_registry.toml‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/11/25"
3-
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
3+
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -18,6 +18,7 @@ index = [
1818
"endgame-*",
1919
"logs-sentinel_one_cloud_funnel.*",
2020
"logs-m365_defender.event-*",
21+
"logs-crowdstrike.fdr*",
2122
]
2223
language = "eql"
2324
license = "Elastic License v2"
@@ -81,16 +82,14 @@ tags = [
8182
"Data Source: Sysmon",
8283
"Data Source: SentinelOne",
8384
"Data Source: Microsoft Defender for Endpoint",
85+
"Data Source: Crowdstrike",
8486
]
8587
timestamp_override = "event.ingested"
8688
type = "eql"
8789

8890
query = '''
89-
registry where host.os.type == "windows" and registry.path : (
90-
"HKLM\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*",
91-
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*",
92-
"MACHINE\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*"
93-
)
91+
registry where host.os.type == "windows" and event.type == "change" and
92+
registry.path : "*\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*" and registry.data.strings != null
9493
'''
9594

9695

‎rules/windows/credential_access_mimikatz_memssp_default_logs.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2020/08/31"
3-
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
3+
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -15,6 +15,7 @@ index = [
1515
"endgame-*",
1616
"logs-sentinel_one_cloud_funnel.*",
1717
"logs-m365_defender.event-*",
18+
"logs-crowdstrike.fdr*",
1819
]
1920
language = "eql"
2021
license = "Elastic License v2"
@@ -83,6 +84,7 @@ tags = [
8384
"Data Source: Sysmon",
8485
"Data Source: SentinelOne",
8586
"Data Source: Microsoft Defender for Endpoint",
87+
"Data Source: Crowdstrike",
8688
]
8789
timestamp_override = "event.ingested"
8890
type = "eql"

‎rules/windows/defense_evasion_amsi_bypass_dllhijack.toml‎

Lines changed: 25 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2023/01/17"
3-
integration = ["windows", "endpoint", "sentinel_one_cloud_funnel", "m365_defender"]
3+
integration = ["windows", "endpoint", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/05/05"
5+
updated_date = "2025/08/26"
66

77
[transform]
88
[[transform.osquery]]
@@ -44,6 +44,7 @@ index = [
4444
"endgame-*",
4545
"logs-sentinel_one_cloud_funnel.*",
4646
"logs-m365_defender.event-*",
47+
"logs-crowdstrike.fdr*",
4748
]
4849
language = "eql"
4950
license = "Elastic License v2"
@@ -111,38 +112,38 @@ tags = [
111112
"Data Source: Sysmon",
112113
"Data Source: SentinelOne",
113114
"Data Source: Microsoft Defender for Endpoint",
115+
"Data Source: Crowdstrike",
114116
]
115117
timestamp_override = "event.ingested"
116118
type = "eql"
117119

118120
query = '''
119121
file where host.os.type == "windows" and event.type != "deletion" and file.path != null and
120-
file.name : ("amsi.dll", "amsi") and
122+
file.name : ("amsi.dll", "amsi") and
123+
event.action != "A process changed a file creation time" and
121124
not file.path : (
122-
"?:\\$SysReset\\CloudImage\\Package_for_RollupFix*",
125+
"?:\\$SysReset\\CloudImage\\Package_for_RollupFix*\\amsi.dll",
123126
"?:\\Windows\\system32\\amsi.dll",
124127
"?:\\Windows\\Syswow64\\amsi.dll",
125-
"?:\\$WINDOWS.~BT\\DUImageSandbox\\*",
126-
"?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSXS\\*",
127-
"?:\\$WINDOWS.~BT\\NewOS\\Windows\\servicing\\LCU\\*",
128-
"?:\\$WINDOWS.~BT\\Work\\*\\*",
129-
"?:\\$WINDOWS.~BT\\Store\\Offline\\File\\C$\\Windows\\SoftwareDistribution\\Download.bak\\*",
130-
"?:\\Windows\\CbsTemp\\*\\f\\amsi.dll",
128+
"?:\\$WINDOWS.~BT\\*\\amsi.dll",
129+
"?:\\Windows\\CbsTemp\\*\\amsi.dll",
131130
"?:\\Windows\\SoftwareDistribution\\Download\\*",
132-
"?:\\Windows\\WinSxS\\amd64_microsoft-antimalware-scan-interface_*\\amsi.dll"
133-
) and
134-
not
135-
(
136-
process.executable : "C:\\Windows\\System32\\wbengine.exe" and
137-
file.path : (
138-
"\\Device\\HarddiskVolume??\\Windows\\system32\\amsi.dll",
139-
"\\Device\\HarddiskVolume??\\Windows\\syswow64\\amsi.dll",
140-
"\\Device\\HarddiskVolume??\\Windows\\WinSxS\\*\\amsi.dll",
141-
"\\\\?\\Volume{*}\\Windows\\WinSxS\\*\\amsi.dll",
142-
"\\\\?\\Volume{*}\\Windows\\system32\\amsi.dll",
143-
"\\\\?\\Volume{*}\\Windows\\syswow64\\amsi.dll"
144-
)
145-
)
131+
"?:\\Windows\\WinSxS\\*\\amsi.dll",
132+
"?:\\Windows\\servicing\\*\\amsi.dll",
133+
"\\\\?\\Volume{*}\\Windows\\WinSxS\\*\\amsi.dll",
134+
"\\\\?\\Volume{*}\\Windows\\system32\\amsi.dll",
135+
"\\\\?\\Volume{*}\\Windows\\syswow64\\amsi.dll",
136+
137+
/* Crowdstrike specific exclusion as it uses NT Object paths */
138+
"\\Device\\HarddiskVolume*\\Windows\\system32\\amsi.dll",
139+
"\\Device\\HarddiskVolume*\\Windows\\syswow64\\amsi.dll",
140+
"\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\amsi.dll",
141+
"\\Device\\HarddiskVolume*\\$SysReset\\CloudImage\\Package_for_RollupFix*\\amsi.dll",
142+
"\\Device\\HarddiskVolume*\\$WINDOWS.~BT\\*\\amsi.dll",
143+
"\\Device\\HarddiskVolume*\\Windows\\SoftwareDistribution\\Download\\*\\amsi.dll",
144+
"\\Device\\HarddiskVolume*\\Windows\\CbsTemp\\*\\amsi.dll",
145+
"\\Device\\HarddiskVolume*\\Windows\\servicing\\*\\amsi.dll"
146+
)
146147
'''
147148

148149

‎rules/windows/defense_evasion_amsienable_key_mod.toml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2021/06/01"
3-
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
44
maturity = "production"
5-
updated_date = "2025/03/20"
5+
updated_date = "2025/08/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -18,6 +18,7 @@ index = [
1818
"endgame-*",
1919
"logs-m365_defender.event-*",
2020
"logs-sentinel_one_cloud_funnel.*",
21+
"logs-crowdstrike.fdr*",
2122
]
2223
language = "eql"
2324
license = "Elastic License v2"
@@ -90,6 +91,7 @@ tags = [
9091
"Data Source: Sysmon",
9192
"Data Source: Microsoft Defender for Endpoint",
9293
"Data Source: SentinelOne",
94+
"Data Source: Crowdstrike",
9395
]
9496
timestamp_override = "event.ingested"
9597
type = "eql"

0 commit comments

Comments
 (0)