Skip to content

[Rule Tuning] Windows 3rd Party EDR Compatibility - Part 7 #5022

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 28, 2025
Merged

[Rule Tuning] Windows 3rd Party EDR Compatibility - Part 7 #5022

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
102dc64
[Rule Tuning] Windows 3rd Party EDR Compatibility - Part 7
w0rk3r Aug 26, 2025
f002f9f
Merge branch 'main' into 3rd_party_edr_7
w0rk3r Aug 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion rules/windows/defense_evasion_script_via_html_app.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/09/09"
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender"]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender"]
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender"]

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI CS can also be added by making the exclusion by parent.executable optional this rule is related to one of the top TTPs https://github.com/elastic/detection-rules/pull/5001/files#diff-8c40e59c5638910d4a38ec146c0076b58f27eddc05eca33cae6bed157b3baf84R3 (should be addressed by this PR)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As the changes doesn't conflict between our PRs, I'll keep this one as is and we can add Defend and CS at yours

maturity = "production"
updated_date = "2025/07/21"
updated_date = "2025/08/26"

[rule]
author = ["Elastic"]
Expand All @@ -18,6 +18,7 @@ index = [
"logs-windows.forwarded*",
"logs-windows.sysmon_operational-*",
"winlogbeat-*",
"endgame-*",
]
language = "eql"
license = "Elastic License v2"
Expand Down Expand Up @@ -68,6 +69,7 @@ tags = [
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Resources: Investigation Guide",
"Data Source: Elastic Endgame",
]
timestamp_override = "event.ingested"
type = "eql"
Expand Down
6 changes: 4 additions & 2 deletions rules/windows/defense_evasion_sdelete_like_filename_rename.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/08/18"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/26"

[rule]
author = ["Elastic"]
Expand All @@ -18,6 +18,7 @@ index = [
"endgame-*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
Expand Down Expand Up @@ -69,6 +70,7 @@ tags = [
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"
Expand Down
6 changes: 4 additions & 2 deletions rules/windows/defense_evasion_sip_provider_mod.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2021/01/20"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/26"

[rule]
author = ["Elastic"]
Expand All @@ -19,6 +19,7 @@ index = [
"winlogbeat-*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
Expand Down Expand Up @@ -71,6 +72,7 @@ tags = [
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
Expand Down
12 changes: 5 additions & 7 deletions rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/12/14"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/26"

[rule]
author = ["Elastic"]
Expand All @@ -18,6 +18,7 @@ index = [
"endgame-*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
Expand Down Expand Up @@ -74,6 +75,7 @@ tags = [
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
Expand All @@ -90,11 +92,7 @@ registry where host.os.type == "windows" and event.type == "change" and registry
"SolarWinds.Collector.Service*.exe",
"SolarwindsDiagnostics*.exe"
) and
registry.path : (
"HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Start",
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\Start",
"MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\Start"
) and
Comment on lines -93 to -97
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@w0rk3r CS regmod paths is \\REGISTRY\\MACHINE\\SYSTEM\\* why remove this in favor of a generic wildcard?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To simplify the query, unless this could cause any FPs. Performance should be similar or better as doing multiple wildcards 3 times should be expensive

registry.path : "*\\SYSTEM\\*ControlSet*\\Services\\*\\Start" and
registry.data.strings : ("4", "0x00000004")
'''

Expand Down
8 changes: 5 additions & 3 deletions rules/windows/defense_evasion_suspicious_short_program_name.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/11/15"
integration = ["endpoint", "windows", "m365_defender"]
integration = ["endpoint", "windows", "m365_defender", "crowdstrike"]
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@w0rk3r I would suggest to also add sentinel1 and 4688 compat here by removing this sub-condition from the query length(process.pe.original_file_name) > 5 (any short program like a.exe is suspicious)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this is better as a separated rule? Sounds like a diff logic

maturity = "production"
updated_date = "2025/05/05"
updated_date = "2025/08/26"

[transform]
[[transform.osquery]]
Expand Down Expand Up @@ -44,6 +44,7 @@ index = [
"logs-windows.sysmon_operational-*",
"endgame-*",
"logs-m365_defender.event-*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
Expand Down Expand Up @@ -105,10 +106,11 @@ tags = [
"Use Case: Threat Detection",
"Tactic: Defense Evasion",
"Data Source: Elastic Endgame",
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"
Expand Down
Loading