Skip to content

Commit 1f99eb0

Browse files
rabbitstackrabbitstack
committed
fix(rules): Reduce false positives
Reduce false positives in various rules by adding exceptions for process executables or file paths.
1 parent 965c28e commit 1f99eb0

12 files changed

+78
-44
lines changed

‎rules/credentail_access_file_access_to_sam_database.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: File access to SAM database
22
id: e3dace20-4962-4381-884e-40dcdde66626
3-
version: 1.0.2
3+
version: 1.0.3
44
description: |
55
Identifies access to the Security Account Manager on-disk database.
66
labels:
@@ -28,7 +28,8 @@ condition: >
2828
(
2929
'?:\\Program Files\\*',
3030
'?:\\Program Files (x86)\\*',
31-
'?:\\Windows\\System32\\lsass.exe'
31+
'?:\\Windows\\System32\\lsass.exe',
32+
'?:\\Windows\\System32\\srtasks.exe'
3233
)
3334
3435
min-engine-version: 2.4.0

‎rules/credential_access_potential_sam_hive_dumping.yml‎

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Potential SAM hive dumping
22
id: 2f326557-0291-4eb1-a87a-7a17b7d941cb
3-
version: 1.0.3
3+
version: 1.0.4
44
description:
55
Identifies access to the Security Account Manager registry hives.
66
labels:
@@ -22,18 +22,11 @@ condition: >
2222
|spawn_process and not (ps.exe imatches
2323
(
2424
'?:\\Program Files\\*.exe',
25-
'?:\\Program Files (x86)\\*.exe'
25+
'?:\\Program Files (x86)\\*.exe',
26+
'?:\\Windows\\System32\\svchost.exe'
2627
)
2728
or
28-
(ps.child.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.child.args intersects ('-k', 'DcomLaunch'))
29-
or
30-
(ps.child.cmdline imatches '?:\\Windows\\System32\\svchost.exe -k defragsvc')
31-
or
32-
(ps.child.cmdline imatches '?:\\Windows\\System32\\svchost.exe -k netsvcs -p -s BITS')
33-
or
34-
(ps.child.cmdline imatches '?:\\Windows\\System32\\svchost.exe -k wusvcs -p -s WaaSMedicSvc')
35-
or
36-
(ps.child.cmdline imatches '?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe ExecuteQueuedItems /LegacyServiceBehavior')
29+
(ps.child.cmdline imatches '"?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe" ExecuteQueuedItems /LegacyServiceBehavior')
3730
)
3831
| by ps.child.uuid
3932
|open_registry
@@ -70,7 +63,10 @@ condition: >
7063
'?:\\Windows\\System32\\lpremove.exe',
7164
'?:\\Windows\\System32\\LogonUI.exe',
7265
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',
73-
'?:\\Windows\\System32\\ApplicationFrameHost.exe'
66+
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MpDefenderCoreService.exe',
67+
'?:\\Windows\\System32\\ApplicationFrameHost.exe',
68+
'?:\\Windows\\System32\\wbem\\WMIADAP.exe',
69+
'?:\\Windows\\System32\\cleanmgr.exe'
7470
)
7571
| by ps.uuid
7672

‎rules/credential_access_suspicious_vault_client_dll_load.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Suspicious Vault client DLL load
22
id: 64af2e2e-2309-4079-9c0f-985f1dd930f5
3-
version: 1.0.0
3+
version: 1.0.1
44
description: |
55
Identifies loading of the Vault client DLL by an unusual process. Adversaries can abuse the functions provided
66
by the Credential Vault Client Library to enumerate or harvest saved credentials.
@@ -42,11 +42,15 @@ condition: >
4242
or
4343
(ps.exe imatches ('?:\\Program Files\\WindowsApps\\Microsoft.*.exe', '?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe'))
4444
or
45-
(ps.child.exe imatches '?:\\WINDOWS\\System32\\svchost.exe' and ps.child.args intersects ('-k', 'wusvcs', '-p', '-s', 'WaaSMedicSvc'))
45+
(ps.child.exe imatches '?:\\WINDOWS\\system32\\BackgroundTaskHost.exe' and ps.child.args imatches ('-ServerName:*'))
4646
or
47-
(ps.child.exe imatches '?:\\WINDOWS\\System32\\svchost.exe' and ps.child.args intersects ('-k', 'netsvcs', '-p', '-s', 'TokenBroker'))
47+
(ps.child.exe imatches '?:\\Windows\\System32\\SecurityHealth\\*\\SecurityHealthHost.exe')
4848
or
49-
(ps.child.exe imatches '?:\\WINDOWS\\system32\\BackgroundTaskHost.exe' and ps.child.args not in ('-ServerName:BackgroundTaskHost.WebAccountProvider'))
49+
(ps.child.exe imatches '?:\\WINDOWS\\uus\\*\\MoUsoCoreWorker.exe')
50+
or
51+
(ps.exe imatches '?:\\Windows\\System32\\services.exe')
52+
or
53+
(ps.exe imatches '?:\\Program Files\\Microsoft OneDrive\\OneDriveStandaloneUpdater.exe')
5054
)
5155
| by ps.child.uuid
5256
|load_dll and image.name ~= 'vaultcli.dll'| by ps.uuid

‎rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: .NET assembly loaded by unmanaged process
22
id: 34be8bd1-1143-4fa8-bed4-ae2566b1394a
3-
version: 1.0.5
3+
version: 1.0.6
44
description: |
55
Identifies the loading of the .NET assembly by an unmanaged process. Adversaries can load the CLR runtime
66
inside unmanaged process and execute the assembly via the ICLRRuntimeHost::ExecuteInDefaultAppDomain method.
@@ -30,7 +30,11 @@ condition: >
3030
ps.exe not imatches
3131
(
3232
'?:\\Program Files\\WindowsApps\\*\\CrossDeviceService.exe',
33-
'?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe'
33+
'?:\\Program Files\\WindowsApps\\*\\WidgetService.exe',
34+
'?:\\Program Files\\WindowsApps\\*\\PhoneExperienceHost.exe',
35+
'?:\\Program Files\\WindowsApps\\*\\WindowsSandboxServer.exe',
36+
'?:\\Program Files\\Conexant\\SAII\\SmartAudio.exe',
37+
'?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe'
3438
)
3539
3640
output: >

‎rules/defense_evasion_hidden_registry_key_creation.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Hidden registry key creation
22
id: 65deda38-9b1d-42a0-9f40-a68903e81b49
3-
version: 1.1.3
3+
version: 1.1.4
44
description: |
55
Identifies the creation of a hidden registry key. Adversaries can utilize the
66
native NtSetValueKey API to create a hidden registry key and conceal payloads
@@ -29,7 +29,14 @@ condition: >
2929
'?:\\Windows\\System32\\sppsvc.exe',
3030
'?:\\Windows\\System32\\compattelrunner.exe',
3131
'?:\\Windows\\explorer.exe',
32-
'?:\\Windows\\System32\\lsass.exe'
32+
'?:\\Windows\\System32\\lsass.exe',
33+
'?:\\Windows\\System32\\svchost.exe'
34+
)
35+
and
36+
ps.parent.exe not imatches
37+
(
38+
'?:\\WINDOWS\\uus\\*\\wuaucltcore.exe',
39+
'?:\\WINDOWS\\System32\\svchost.exe'
3340
)
3441
3542
output: >

‎rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Potential process injection via tainted memory section
22
id: 8e4182f3-02e7-4e95-afc3-93d18c9a9c09
3-
version: 1.0.2
3+
version: 1.0.3
44
description: |
55
Identifies potential process injection when the adversary creates and maps a memory
66
section with RW protection rights followed by mapping of the same memory section in
@@ -28,14 +28,21 @@ condition: >
2828
'?:\\Program Files (x86)\\*.exe',
2929
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',
3030
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\NisSrv.exe',
31+
'?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MpDefenderCoreService.exe',
3132
'?:\\WINDOWS\\System32\\csrss.exe',
3233
'?:\\WINDOWS\\Explorer.exe',
3334
'?:\\WINDOWS\\System32\\svchost.exe',
3435
'?:\\WINDOWS\\System32\\lsass.exe',
35-
'?:\\WINDOWS\\System32\\SecurityHealthService.exe'
36+
'?:\\WINDOWS\\System32\\SecurityHealthService.exe',
37+
'?:\\WINDOWS\\System32\\services.exe'
3638
)
3739
| as e1
38-
|map_view_of_section and file.view.protection = 'READONLY|EXECUTE' and file.key = $e1.file.key and kevt.pid != $e1.kevt.pid|
40+
|map_view_of_section and file.view.protection = 'READONLY|EXECUTE' and file.key = $e1.file.key and kevt.pid != $e1.kevt.pid and ps.exe not imatches
41+
(
42+
'?:\\Program Files\\Mozilla Firefox\\firefox.exe',
43+
'?:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe'
44+
)
45+
|
3946
action:
4047
- name: kill
4148

‎rules/defense_evasion_process_execution_from_self_deleting_binary.yml‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Process execution from a self-deleting binary
22
id: 0f0da517-b22c-4d14-9adc-36baeb621cf7
3-
version: 1.0.3
3+
version: 1.0.4
44
description: |
55
Identifies the execution of the process from a self-deleting binary. The attackers can
66
abuse undocumented API functions to create a process from a file-backed section. The file
@@ -22,18 +22,16 @@ condition: >
2222
maxspan 1m
2323
|delete_file and file.info.is_disposition_delete_file
2424
and
25-
ps.exe not imatches
25+
ps.exe not imatches
2626
(
2727
'?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe',
28-
'?:\\WINDOWS\\uus\\packages\\preview\\*\\wuaucltcore.exe'
28+
'?:\\WINDOWS\\uus\\packages\\preview\\*\\wuaucltcore.exe',
29+
'?:\\WINDOWS\\uus\\packages\\preview\\*\\MoUsoCoreWorker.exe',
30+
'?:\\WINDOWS\\System32\\svchost.exe',
31+
'?:\\WINDOWS\\winsxs\\*\\TiWorker.exe'
2932
)
30-
and
31-
ps.cmdline not imatches
32-
(
33-
'?:\\Windows\\system32\\svchost.exe -k wsappx -p -s AppXSvc'
34-
)
35-
and
36-
file.path not imatches
33+
and
34+
file.path not imatches
3735
(
3836
'?:\\Windows\\SoftwareDistribution\\Download\\*',
3937
'?:\\Windows\\uus\\packages\\preview\\*'

‎rules/defense_evasion_suspicious_access_to_the_hosts_file.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Suspicious access to the hosts file
22
id: f7b2c9d3-99e7-41d5-bb4a-6ea1a5f7f9e2
3-
version: 1.0.1
3+
version: 1.0.2
44
description: >
55
Identifies suspicious process accessing the Windows hosts file for potential tampering.
66
Adversaries can hijack the hosts files to block traffic to download/update servers or redirect the
@@ -23,7 +23,9 @@ condition: >
2323
'?:\\Windows\\servicing\\TrustedInstaller.exe',
2424
'?:\\Windows\\System32\\svchost.exe',
2525
'?:\\Windows\\System32\\MicrosoftEdgeUpdate.exe',
26-
'?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'
26+
'?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe',
27+
'?:\\Program Files\\Mozilla Firefox\\firefox.exe',
28+
'?:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe'
2729
)
2830
| by ps.child.uuid
2931
|open_file and file.path imatches '?:\\Windows\\System32\\drivers\\etc\\hosts'| by ps.uuid

‎rules/defense_evasion_suspicious_dll_loaded_via_memory_section_mapping.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Suspicious DLL loaded via memory section mapping
22
id: b06653fb-227e-4e63-9a69-55a5a90c79e5
3-
version: 1.0.0
3+
version: 1.0.1
44
description: |
55
Identifies the mapping of a memory section with RX protection followed by unsigned DLL loading.
66
Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses
@@ -21,7 +21,13 @@ condition: >
2121
sequence
2222
maxspan 2m
2323
by ps.uuid
24-
|map_view_of_section and file.view.protection = 'READONLY|EXECUTE' and kevt.pid != 4 and file.view.size >= 4096|
24+
|map_view_of_section and file.view.protection = 'READONLY|EXECUTE' and kevt.pid != 4 and file.view.size >= 4096
25+
and
26+
ps.exe not imatches
27+
(
28+
'?:\\Program Files\\Mozilla Firefox\\firefox.exe'
29+
)
30+
|
2531
|(load_unsigned_or_untrusted_dll)|
2632
action:
2733
- name: kill

‎rules/defense_evasion_suspicious_object_symbolic_link_creation.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: Suspicious object symbolic link creation
22
id: f9306355-1f5f-4a06-9779-195aa681db80
3-
version: 1.0.1
3+
version: 1.0.2
44
description: |
55
Identifies the creation of the object symbolic link inside the object manager namespace
66
by untrusted or unusual processes.
@@ -26,9 +26,13 @@ condition: >
2626
'?:\\WINDOWS\\system32\\svchost.exe',
2727
'?:\\Program Files\\*',
2828
'?:\\Program Files (x86)\\*',
29-
'?:\\Windows\\System32\\vmwp.exe'
29+
'?:\\Windows\\System32\\vmwp.exe',
30+
'?:\\Windows\\System32\\spoolsv.exe',
31+
'?:\\Windows\\System32\\csrss.exe'
3032
)
3133
)
34+
and
35+
kevt.arg[target] not imatches '\\Sessions\\*\\AppContainerNamedObjects\\*'
3236
3337
output: >
3438
Suspicious object symbolic link %kevt.arg[target] created by process %ps.exe

0 commit comments

Comments
 (0)