Skip to content

[Rule Tuning] Windows - Small Adjusts for Compatibility #5032

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Aug 28, 2025
Merged

[Rule Tuning] Windows - Small Adjusts for Compatibility #5032

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
88cf6cc
[Rule Tuning] Windows - Small Adjusts for Compatibility
w0rk3r Aug 27, 2025
9c51206
Merge branch 'main' into 3rd_party_edr_compat_review
w0rk3r Aug 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions rules/windows/command_and_control_tool_transfer_via_curl.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/02/03"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/27"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -97,7 +97,7 @@ process where host.os.type == "windows" and event.type == "start" and
"mshta.exe", "hh.exe", "mmc.exe"
) and
not (
user.id == "S-1-5-18" and
?user.id == "S-1-5-18" and
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SentinelOne doesn't have this field. Marking it as optional so the query runs.

/* Don't apply the user.id exclusion to Sysmon for compatibility */
not event.dataset : ("windows.sysmon_operational", "windows.sysmon")
) and
Expand Down
6 changes: 2 additions & 4 deletions rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/01/31"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/08/13"
updated_date = "2025/08/27"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -90,13 +90,11 @@ registry where host.os.type == "windows" and event.type == "change" and
"\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\EnableScriptBlockLogging",
"MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\EnableScriptBlockLogging"
) and registry.data.strings : ("0", "0x00000000") and
not (
process.executable : (
not process.executable : (
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\DeviceEnroller.exe",
"?:\\Windows\\system32\\omadmclient.exe",
"?:\\Program Files (x86)\\N-able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe"
) and user.id == "S-1-5-18"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SentinelOne doesn't have this field. Adjusting the query to support it.

)
'''

Expand Down
13 changes: 2 additions & 11 deletions rules/windows/impact_backup_file_deletion.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2021/10/01"
integration = ["endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/27"

[rule]
author = ["Elastic"]
Expand All @@ -14,7 +14,7 @@ false_positives = [
"Certain utilities that delete files for disk cleanup or Administrators manually removing backup files.",
]
from = "now-9m"
index = ["logs-endpoint.events.file-*", "endgame-*", "logs-sentinel_one_cloud_funnel.*"]
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Endgame doesn't populate process signature information for file events.

index = ["logs-endpoint.events.file-*", "logs-sentinel_one_cloud_funnel.*"]
language = "eql"
license = "Elastic License v2"
name = "Third-party Backup Files Deleted via Unexpected Process"
Expand Down Expand Up @@ -60,22 +60,13 @@ This rule identifies file deletions performed by a process that does not belong
references = ["https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love"]
risk_score = 47
rule_id = "11ea6bec-ebde-4d71-a8e9-784948f8e3e9"
setup = """## Setup

If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
`event.ingested` to @timestamp.
For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
"""
severity = "medium"
tags = [
"Domain: Endpoint",
"OS: Windows",
"Use Case: Threat Detection",
"Tactic: Impact",
"Resources: Investigation Guide",
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: SentinelOne",
]
Expand Down
Loading