Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part 1 #3501

Merged
merged 4 commits into from
Mar 13, 2024
Merged

[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part 1 #3501

merged 4 commits into from
Mar 13, 2024

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Mar 8, 2024 •
edited

Issues

Resolves #3422

Summary

Implemented a lot of different changes in this PR, but some of them are:

  • Adds compatibility to system integration where possible
  • Adjusted the index for PowerShell rules to logs-windows.powershell*
  • Adjusted Sysmon-Only tag to Data Source: Sysmon
  • Adjusted Sysmon rules to use logs-windows.sysmon_operational-* instead of logs-windows.*
  • Adjusted rules that are compatible with sysmon to use optional fields in the Elastic Defend-specific fields so the rules run successfully
  • Drop Sysmon compatibility in rules that use unsupported fields in the core logic
  • Adjust registry rules to be compatible with sysmon
  • Adjusted Tags unit tests
  • And more...

This PR intentionally doesn't cover BBRs to include new data sources, as those rules need to be reviewed more closely to not cause performance problems.

@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint backport: auto labels Mar 8, 2024
@w0rk3r w0rk3r self-assigned this Mar 8, 2024
@botelastic botelastic bot added the bbr Building Block Rules label Mar 8, 2024
@w0rk3r w0rk3r mentioned this pull request Mar 8, 2024
Closed
Aegrah
Aegrah approved these changes Mar 11, 2024
View reviewed changes
Copy link
Contributor

@Aegrah Aegrah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:partywizard:

rules/windows/defense_evasion_disabling_windows_defender_powershell.toml
process.args : "Set-MpPreference" and process.args : ("-Disable*", "Disabled", "NeverSend", "-Exclusion*")
(
process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
?process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I barely ever see in used in Windows, due to case insensitivity. Of course, pe.original_file_name should always be the original file name, and if it's lowercase, in should be fine. Just pointing it out, that it might be a : candidate.

While continuing the review I noticed this in many rules, and I think it makes sense to use in and ==. So will leave it here as consideration, but LGTM!

@terrancedejesus
Copy link
Collaborator

Great work 🚀

I reviewed all of the changes, taking into consideration your notes from the original comment. My only questions are:

  • we are not loosing any potential detections for logs coming from logs-windows.forwarded* because we scoped in on sysmon_operational?
  • have we tested the the rules for any query adjustments that we made to ensure they are still on target for capturing the intended threat?

These seem like rather small questions and should not be a blocker, therefore I am approving.

@w0rk3r
Copy link
Contributor Author

w0rk3r commented Mar 13, 2024

we are not loosing any potential detections for logs coming from logs-windows.forwarded* because we scoped in on sysmon_operational?

The ones I've specified the sysmon index are non-process creation detections, which should only work with Sysmon data sources.

have we tested the the rules for any query adjustments that we made to ensure they are still on target for capturing the intended threat?

Yup, I tested a small subset of them, but not them all. It seemed enough to test if there were interferences in the results.

@w0rk3r w0rk3r merged commit f5254f3 into main Mar 13, 2024
14 checks passed
@w0rk3r w0rk3r deleted the compat_review branch March 13, 2024 13:27
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@w0rk3r @github-actions
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part…
446ec04 
… 1 (#3501)

* Initial commit

* Date bump

Removed changes from:
- rules/windows/credential_access_lsass_handle_via_malseclogon.toml
- rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml
- rules/windows/credential_access_suspicious_lsass_access_generic.toml
- rules/windows/credential_access_suspicious_lsass_access_memdump.toml
- rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml
- rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml
- rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml
- rules/windows/initial_access_exfiltration_first_time_seen_usb.toml
- rules/windows/persistence_sysmon_wmi_event_subscription.toml

(selectively cherry picked from commit f5254f3)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@w0rk3r @github-actions
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part…
9e95497 
… 1 (#3501)

* Initial commit

* Date bump

Removed changes from:
- rules/windows/credential_access_lsass_handle_via_malseclogon.toml
- rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml
- rules/windows/credential_access_suspicious_lsass_access_generic.toml
- rules/windows/credential_access_suspicious_lsass_access_memdump.toml
- rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml
- rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml
- rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml
- rules/windows/persistence_sysmon_wmi_event_subscription.toml

(selectively cherry picked from commit f5254f3)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@w0rk3r @github-actions
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part…
a289b59 
… 1 (#3501)

* Initial commit

* Date bump

Removed changes from:
- rules/windows/credential_access_lsass_handle_via_malseclogon.toml
- rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml
- rules/windows/credential_access_suspicious_lsass_access_generic.toml
- rules/windows/credential_access_suspicious_lsass_access_memdump.toml
- rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml
- rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml
- rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml
- rules/windows/persistence_sysmon_wmi_event_subscription.toml

(selectively cherry picked from commit f5254f3)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@w0rk3r @github-actions
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part…
8804ad6 
… 1 (#3501)

* Initial commit

* Date bump

Removed changes from:
- rules/windows/credential_access_lsass_handle_via_malseclogon.toml
- rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml
- rules/windows/credential_access_suspicious_lsass_access_generic.toml
- rules/windows/credential_access_suspicious_lsass_access_memdump.toml
- rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml
- rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml
- rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml
- rules/windows/persistence_sysmon_wmi_event_subscription.toml

(selectively cherry picked from commit f5254f3)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@w0rk3r @github-actions
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part…
8335f23 
… 1 (#3501)

* Initial commit

* Date bump

Removed changes from:
- rules/windows/credential_access_lsass_handle_via_malseclogon.toml
- rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml
- rules/windows/credential_access_suspicious_lsass_access_generic.toml
- rules/windows/credential_access_suspicious_lsass_access_memdump.toml
- rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml
- rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml
- rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml
- rules/windows/persistence_sysmon_wmi_event_subscription.toml

(selectively cherry picked from commit f5254f3)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@w0rk3r @github-actions
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part…
3708a38 
… 1 (#3501)

* Initial commit

* Date bump

(cherry picked from commit f5254f3)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@w0rk3r @github-actions
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part…
250e035 
… 1 (#3501)

* Initial commit

* Date bump

(cherry picked from commit f5254f3)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@w0rk3r @github-actions
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part…
b43003c 
… 1 (#3501)

* Initial commit

* Date bump

(cherry picked from commit f5254f3)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@w0rk3r @github-actions
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part…
22ed934 
… 1 (#3501)

* Initial commit

* Date bump

(cherry picked from commit f5254f3)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@w0rk3r @github-actions
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part…
0e3adc8 
… 1 (#3501)

* Initial commit

* Date bump

(cherry picked from commit f5254f3)
protectionsmachine pushed a commit that referenced this pull request Mar 13, 2024
@w0rk3r @github-actions
[Rule Tuning] Improve Compatibility in WIndows Detection Rules - Part…
9d046f9 
… 1 (#3501)

* Initial commit

* Date bump

(cherry picked from commit f5254f3)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Aegrah Aegrah Aegrah approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@brokensound77 brokensound77 Awaiting requested review from brokensound77 brokensound77 is a code owner

@Mikaayenson Mikaayenson Awaiting requested review from Mikaayenson Mikaayenson is a code owner

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

@Samirbous Samirbous Awaiting requested review from Samirbous

Assignees

@w0rk3r w0rk3r

Labels
backport: auto bbr Building Block Rules Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Rule Tuning] Compatible Windows Rule Index Updates with Winlog, Defend and System
3 participants
@w0rk3r @terrancedejesus @Aegrah