Convert windows rules from KQL to EQL #1114

brokensound77 · 2021-04-14T20:14:14Z

Issues

resolves #1113

Summary

Converts all windows KQL rules to EQL for case resiliency.

For reviewers

The most important thing for this review (in order)

Ensure logic wasn't unintentionally changed as a result of a conversion
Verify all necessary case-insensitive syntax was applied (where necessary) (== to : and in to :)
everything else

rules/windows/defense_evasion_execution_via_trusted_developer_utilities.toml

rules/windows/credential_access_credential_dumping_msbuild.toml

rules/windows/defense_evasion_execution_msbuild_started_by_script.toml

rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml

rules/windows/privilege_escalation_printspooler_suspicious_spl_file.toml

…details

rules/windows/persistence_user_account_added_to_privileged_group_ad.toml

rules/windows/execution_via_compiled_html_file.toml

…le_activity.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

…s & removed endpoint index

rw-access · 2021-04-15T07:40:23Z

@Samirbous thanks for all the enhancements to the rules! From a quick glance they look good, but are beyond the original scope of this PR.

For some more context and sharing my process:

One of the biggest downsides of scope and having multiple contributors making commits to a PR is that it's hard for them to coordinate and they have different goals in mind for what "done" means. It also makes it difficult as a reviewer because merging a PR is always all-or-nothing so additional changes could slow the merge.

That said, in thinking that we might want to move your commits to a new PR (don't worry this can be done fairly painlessly and I'll be glad to help make it happen), so that we can get the KQL -> EQL conversion done first. Then it'll be easier to sort through all of the helpful contributions you made.

Samirbous · 2021-04-15T08:05:08Z

@Samirbous thanks for all the enhancements to the rules! From a quick glance they look good, but are beyond the original scope of this PR.

For some more context and sharing my process:

One of the biggest downsides of scope and having multiple contributors making commits to a PR is that it's hard for them to coordinate and they have different goals in mind for what "done" means. It also makes it difficult as a reviewer because merging a PR is always all-or-nothing so additional changes could slow the merge.

That said, in thinking that we might want to move your commits to a new PR (don't worry this can be done fairly painlessly and I'll be glad to help make it happen), so that we can get the KQL -> EQL conversion done first. Then it'll be easier to sort through all of the helpful contributions you made.

@rw-access As long as they will be incorporated automagically I'm fine with that (most tuning were related to kql -> eql like replacing driver letter C with ?, few were quick adjustment to wrong syntax/logic like a rule with file where process.parent.name ... or process where dll.name ... ).

rules/windows/defense_evasion_clearing_windows_event_logs.toml

rules/windows/discovery_net_command_system_account.toml

rules/windows/persistence_system_shells_via_services.toml

rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml

rules/windows/defense_evasion_encoding_or_decoding_files_via_certutil.toml

rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml

rules/windows/execution_command_shell_started_by_svchost.toml

rules/windows/persistence_user_account_creation.toml

rules/windows/privilege_escalation_printspooler_suspicious_spl_file.toml

rules/windows/defense_evasion_unusual_system_vp_child_program.toml

rules/cross-platform/impact_hosts_file_modified.toml

rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml

rules/windows/defense_evasion_modification_of_boot_config.toml

rw-access

looks good after the suggestions are applied

…-to-eql # Conflicts: # rules/_deprecated/defense_evasion_execution_via_trusted_developer_utilities.toml # rules/_deprecated/discovery_process_discovery_via_tasklist_command.toml # rules/_deprecated/execution_command_shell_started_by_powershell.toml

rules/cross-platform/impact_hosts_file_modified.toml

rules/windows/defense_evasion_encoding_or_decoding_files_via_certutil.toml

rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml

rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml

rules/windows/execution_command_shell_started_by_svchost.toml

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>

dstepanic

LGTM

brokensound77 added 2 commits April 14, 2021 12:48

Convert windows rules from KQL to EQL

64cb5f1

correct manual conversion errors

0c560eb

brokensound77 added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules v7.13.0 7.13 rules release package labels Apr 14, 2021

brokensound77 requested review from bm11100, dstepanic and rw-access April 14, 2021 20:14

replaced C drive letter with ?

81a1100

brokensound77 requested a review from Samirbous April 14, 2021 20:23

Samirbous added 7 commits April 14, 2021 22:25

removed arg duplicate, : is case insensitive

00ec7d6

converted to sequence for more context and resilience

d66e5b2

removed duplicate file.name covered by case sensit

423f0d2

replaced C with ?

3e5b09f

add original file name check

7183618

added original file name check and mshta as parent

f28c907

replaced C drive letter with ?

226ea71

Samirbous reviewed Apr 14, 2021

View reviewed changes

rules/windows/defense_evasion_execution_via_trusted_developer_utilities.toml Outdated Show resolved Hide resolved

Samirbous added 2 commits April 14, 2021 22:53

added wildcard for resilience to extra spaces or ^

8e8cc8e

added ofn and case sens check for args

41a5558

rw-access reviewed Apr 14, 2021

View reviewed changes

Samirbous added 4 commits April 14, 2021 23:00

converted to sequence for more context about process args and parent …

64fb26f

…details

replaced C with ? and excluded WerFault case of crash

47a41ea

quite severe alert

479b563

case insensitive

4c24603

Samirbous reviewed Apr 14, 2021

View reviewed changes

rules/windows/persistence_user_account_added_to_privileged_group_ad.toml Outdated Show resolved Hide resolved

Samirbous added 2 commits April 14, 2021 23:10

replaced C with ?

91283fb

added ofn

cace056

Samirbous reviewed Apr 14, 2021

View reviewed changes

rules/windows/execution_via_compiled_html_file.toml Show resolved Hide resolved

excluded npcap scheduled task (noisy)

9f16b8e

Samirbous and others added 6 commits April 15, 2021 08:54

spaces

a075345

Update rules/windows/defense_evasion_system_critical_proc_abnormal_fi…

d636c9c

…le_activity.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

changed rule logic to match on rule description

09fbab4

bumped severity

931d398

bumped severity to medium & added Exchange Organization Administrator…

7d8e9c4

…s & removed endpoint index

added unload process.arg and increased severity to medium

b189d04

excluded programfiles tend to be noisy for hosts changes on windows

e88e7fe

dstepanic reviewed Apr 15, 2021

View reviewed changes

rules/windows/defense_evasion_clearing_windows_event_logs.toml Show resolved Hide resolved

bm11100 mentioned this pull request Apr 15, 2021

[Deprecation] Deprecate inherently noisy rules based on testing #1122

Merged

bm11100 reviewed Apr 15, 2021

View reviewed changes

rules/windows/discovery_net_command_system_account.toml Outdated Show resolved Hide resolved

bm11100 reviewed Apr 15, 2021

View reviewed changes

rules/windows/persistence_system_shells_via_services.toml Outdated Show resolved Hide resolved

bm11100 reviewed Apr 15, 2021

View reviewed changes

rules/windows/defense_evasion_unusual_system_vp_child_program.toml Outdated Show resolved Hide resolved

rw-access reviewed Apr 22, 2021

View reviewed changes

rules/cross-platform/impact_hosts_file_modified.toml Outdated Show resolved Hide resolved

rw-access reviewed Apr 22, 2021

View reviewed changes

rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml Outdated Show resolved Hide resolved

rw-access reviewed Apr 22, 2021

View reviewed changes

rules/windows/defense_evasion_modification_of_boot_config.toml Show resolved Hide resolved

rw-access reviewed Apr 22, 2021

View reviewed changes

brokensound77 commented Apr 30, 2021

View reviewed changes

small tweaks to queries from feedback

145679d

Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com>

brokensound77 requested review from bm11100, Samirbous and dstepanic April 30, 2021 17:27

dstepanic approved these changes Apr 30, 2021

View reviewed changes

bm11100 approved these changes Apr 30, 2021

View reviewed changes

brokensound77 merged commit 82ec6ac into elastic:main Apr 30, 2021

brokensound77 deleted the convert-windows-kql-to-eql branch April 30, 2021 19:21

TotalKnob mentioned this pull request Aug 8, 2022

[Rule Tuning] SUNBURST Command and Control Activity #2229

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Convert windows rules from KQL to EQL #1114

Convert windows rules from KQL to EQL #1114

brokensound77 commented Apr 14, 2021

rw-access commented Apr 15, 2021

Samirbous commented Apr 15, 2021 •

edited

Loading

rw-access left a comment

dstepanic left a comment

Convert windows rules from KQL to EQL #1114

Convert windows rules from KQL to EQL #1114

Conversation

brokensound77 commented Apr 14, 2021

Issues

Summary

For reviewers

rw-access commented Apr 15, 2021

Samirbous commented Apr 15, 2021 • edited Loading

rw-access left a comment

Choose a reason for hiding this comment

dstepanic left a comment

Choose a reason for hiding this comment

Samirbous commented Apr 15, 2021 •

edited

Loading