Skip to content

[Rule Tuning] 3rd Party EDR Compatibility - Adjust CS Windows Paths #5037

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Sep 1, 2025
Merged

[Rule Tuning] 3rd Party EDR Compatibility - Adjust CS Windows Paths #5037

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b32e74c
[Rule Tuning] 3rd Party EDR Compatibility - Adjust CS Windows Paths
w0rk3r Aug 28, 2025
d70c6dd
++
w0rk3r Aug 28, 2025
82ebfa3
Update defense_evasion_workfolders_control_execution.toml
w0rk3r Aug 29, 2025
6a019fb
Merge branch 'main' into cs_paths
w0rk3r Sep 1, 2025
7a38bd1
Update privilege_escalation_uac_bypass_event_viewer.toml
w0rk3r Sep 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions rules/windows/defense_evasion_lolbas_win_cdb_utility.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2024/07/24"
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -85,8 +85,10 @@ process where host.os.type == "windows" and event.type == "start" and
not process.executable : (
"?:\\Program Files (x86)\\*\\cdb.exe",
"?:\\Program Files\\*\\cdb.exe",
"\\Device\\HarddiskVolume?\\Program Files (x86)\\*\\cdb.exe",
"\\Device\\HarddiskVolume?\\Program Files\\*\\cdb.exe"

/* Crowdstrike specific exclusion as it uses NT Object paths */
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*\\cdb.exe",
"\\Device\\HarddiskVolume*\\Program Files\\*\\cdb.exe"
)
'''

Expand Down
19 changes: 10 additions & 9 deletions rules/windows/defense_evasion_masquerading_trusted_directory.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/11/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/05/05"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -85,7 +85,7 @@ query = '''
process where host.os.type == "windows" and event.type == "start" and
process.executable : (
"C:\\*Program*Files*\\*.exe",
"\\Device\\HarddiskVolume?\\*Program*Files*\\*.exe"
"\\Device\\HarddiskVolume*\\*Program*Files*\\*.exe"
) and
not process.executable : (
"?:\\Program Files\\*.exe",
Expand All @@ -97,15 +97,16 @@ process where host.os.type == "windows" and event.type == "start" and
"?:\\Windows\\Temp\\.opera\\????????????\\CProgram?Files?(x86)Opera*\\*.exe"
) and
not (
/* Crowdstrike specific exclusion as it uses NT Object paths */
event.dataset == "crowdstrike.fdr" and
process.executable : (
"\\Device\\HarddiskVolume?\\Program Files\\*.exe",
"\\Device\\HarddiskVolume?\\Program Files (x86)\\*.exe",
"\\Device\\HarddiskVolume?\\Users\\*.exe",
"\\Device\\HarddiskVolume?\\ProgramData\\*.exe",
"\\Device\\HarddiskVolume?\\Windows\\Downloaded Program Files\\*.exe",
"\\Device\\HarddiskVolume?\\Windows\\Temp\\.opera\\????????????\\CProgram?FilesOpera*\\*.exe",
"\\Device\\HarddiskVolume?\\Windows\\Temp\\.opera\\????????????\\CProgram?Files?(x86)Opera*\\*.exe"
"\\Device\\HarddiskVolume*\\Program Files\\*.exe",
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
"\\Device\\HarddiskVolume*\\Users\\*.exe",
"\\Device\\HarddiskVolume*\\ProgramData\\*.exe",
"\\Device\\HarddiskVolume*\\Windows\\Downloaded Program Files\\*.exe",
"\\Device\\HarddiskVolume*\\Windows\\Temp\\.opera\\????????????\\CProgram?FilesOpera*\\*.exe",
"\\Device\\HarddiskVolume*\\Windows\\Temp\\.opera\\????????????\\CProgram?Files?(x86)Opera*\\*.exe"
)
)
'''
Expand Down
8 changes: 5 additions & 3 deletions rules/windows/defense_evasion_workfolders_control_execution.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2022/03/02"
integration = ["windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/28"

[rule]
author = ["Elastic", "Austin Songer"]
Expand Down Expand Up @@ -85,8 +85,10 @@ process where host.os.type == "windows" and event.type == "start" and
not process.executable : (
"?:\\Windows\\System32\\control.exe",
"?:\\Windows\\SysWOW64\\control.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\control.exe",
"\\Device\\HarddiskVolume?\\Windows\\SysWOW64\\control.exe"

/* Crowdstrike specific condition as it uses NT Object paths */
"\\Device\\HarddiskVolume*\\Windows\\System32\\control.exe",
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\control.exe"
)
'''

Expand Down
17 changes: 9 additions & 8 deletions rules/windows/defense_evasion_wsl_child_process.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2023/01/12"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -94,15 +94,16 @@ process where host.os.type == "windows" and event.type : "start" and
"?:\\Windows\\Sys?????\\wslconfig.exe"
) and
not (
/* Crowdstrike specific exclusion as it uses NT Object paths */
event.dataset == "crowdstrike.fdr" and
process.executable : (
"\\Device\\HarddiskVolume?\\Program Files (x86)\\*",
"\\Device\\HarddiskVolume?\\Program Files\\*",
"\\Device\\HarddiskVolume?\\Program Files*\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemForLinux_*\\wsl*.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\conhost.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\lxss\\wslhost.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\WerFault.exe",
"\\Device\\HarddiskVolume?\\Windows\\Sys?????\\wslconfig.exe"
"\\Device\\HarddiskVolume*\\Program Files (x86)\\*",
"\\Device\\HarddiskVolume*\\Program Files\\*",
"\\Device\\HarddiskVolume*\\Program Files*\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemForLinux_*\\wsl*.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\conhost.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\lxss\\wslhost.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\WerFault.exe",
"\\Device\\HarddiskVolume*\\Windows\\Sys?????\\wslconfig.exe"
)
)
'''
Expand Down
10 changes: 6 additions & 4 deletions rules/windows/defense_evasion_wsl_kalilinux.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2023/01/12"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -88,9 +88,11 @@ process where host.os.type == "windows" and event.type == "start" and
"?:\\Users\\*\\AppData\\Local\\packages\\kalilinux*",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\WindowsApps\\kali.exe",
"?:\\Program Files*\\WindowsApps\\KaliLinux.*\\kali.exe",
"\\Device\\HarddiskVolume?\\Users\\*\\AppData\\Local\\packages\\kalilinux*",
"\\Device\\HarddiskVolume?\\Users\\*\\AppData\\Local\\Microsoft\\WindowsApps\\kali.exe",
"\\Device\\HarddiskVolume?\\Program Files*\\WindowsApps\\KaliLinux.*\\kali.exe"

/* Crowdstrike specific exclusion as it uses NT Object paths */
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\packages\\kalilinux*",
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Microsoft\\WindowsApps\\kali.exe",
"\\Device\\HarddiskVolume*\\Program Files*\\WindowsApps\\KaliLinux.*\\kali.exe"
)
)
'''
Expand Down
8 changes: 5 additions & 3 deletions rules/windows/execution_com_object_xwizard.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2021/01/20"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "system", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -93,8 +93,10 @@ process where host.os.type == "windows" and event.type == "start" and
not process.executable : (
"C:\\Windows\\SysWOW64\\xwizard.exe",
"C:\\Windows\\System32\\xwizard.exe",
"\\Device\\HarddiskVolume?\\Windows\\SysWOW64\\xwizard.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\xwizard.exe"

/* Crowdstrike specific exclusion as it uses NT Object paths */
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\xwizard.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\xwizard.exe"
)
)
)
Expand Down
6 changes: 4 additions & 2 deletions rules/windows/execution_via_mmc_console_file_unusual_path.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2024/06/19"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -84,7 +84,9 @@ query = '''
process where host.os.type == "windows" and event.type == "start" and
process.executable : (
"?:\\Windows\\System32\\mmc.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\mmc.exe"

/* Crowdstrike specific condition as it uses NT Object paths */
"\\Device\\HarddiskVolume*\\Windows\\System32\\mmc.exe"
) and
process.args : "*.msc" and
not process.args : (
Expand Down
6 changes: 4 additions & 2 deletions rules/windows/initial_access_execution_from_inetcache.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2024/02/14"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -91,7 +91,9 @@ process where host.os.type == "windows" and event.type == "start" and
process.args : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" or
process.executable : (
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*",
"\\Device\\HarddiskVolume?\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*"

/* Crowdstrike specific exclusion as it uses NT Object paths */
"\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*"
)
)
'''
Expand Down
22 changes: 12 additions & 10 deletions rules/windows/initial_access_suspicious_ms_exchange_process.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2021/03/04"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/28"

[rule]
author = ["Elastic", "Austin Songer"]
Expand Down Expand Up @@ -105,15 +105,17 @@ process where host.os.type == "windows" and event.type == "start" and
"D:\\Exchange\\Bin\\UMWorkerProcess.exe",
"D:\\Exchange Server\\Bin\\UMWorkerProcess.exe",
"E:\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\werfault.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\wermgr.exe",
"\\Device\\HarddiskVolume?\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume?\\Program Files\\Microsoft\\Exchange Server\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume?\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume?\\ExchangeServer\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume?\\Exchange\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume?\\Exchange Server\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume?\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe"

/* Crowdstrike specific exclusion as it uses NT Object paths */
"\\Device\\HarddiskVolume*\\Windows\\System32\\werfault.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\wermgr.exe",
"\\Device\\HarddiskVolume*\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume*\\Program Files\\Microsoft\\Exchange Server\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume*\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume*\\ExchangeServer\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume*\\Exchange\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume*\\Exchange Server\\Bin\\UMWorkerProcess.exe",
"\\Device\\HarddiskVolume*\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe"
)
'''

Expand Down
6 changes: 3 additions & 3 deletions rules/windows/persistence_adobe_hijack_persistence.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2025/08/28"

[transform]
[[transform.osquery]]
Expand Down Expand Up @@ -122,8 +122,8 @@ file where host.os.type == "windows" and event.type == "creation" and
"?:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",

/* Crowdstrike specific condition as it uses NT Object paths */
"\\Device\\HarddiskVolume?\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
"\\Device\\HarddiskVolume?\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe"
"\\Device\\HarddiskVolume*\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
"\\Device\\HarddiskVolume*\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe"
) and
not process.name : ("msiexec.exe", "AdobeARM.exe")
'''
Expand Down
10 changes: 6 additions & 4 deletions rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/08/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/28"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -90,9 +90,11 @@ process where host.os.type == "windows" and event.type == "start" and
"C:\\Windows\\System32\\cleanmgr.exe",
"C:\\Windows\\SysWOW64\\cleanmgr.exe",
"C:\\Windows\\System32\\taskhostw.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\cleanmgr.exe",
"\\Device\\HarddiskVolume?\\Windows\\SysWOW64\\cleanmgr.exe",
"\\Device\\HarddiskVolume?\\Windows\\System32\\taskhostw.exe"

/* Crowdstrike specific exclusion as it uses NT Object paths */
"\\Device\\HarddiskVolume*\\Windows\\System32\\cleanmgr.exe",
"\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\cleanmgr.exe",
"\\Device\\HarddiskVolume*\\Windows\\System32\\taskhostw.exe"
)
'''

Expand Down
8 changes: 5 additions & 3 deletions rules/windows/privilege_escalation_uac_bypass_event_viewer.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/03/17"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/09/01"

[transform]
[[transform.osquery]]
Expand Down Expand Up @@ -134,8 +134,10 @@ process where host.os.type == "windows" and event.type == "start" and
"?:\\Windows\\System32\\mmc.exe",
"?:\\Windows\\SysWOW64\\WerFault.exe",
"?:\\Windows\\System32\\WerFault.exe",
"?\\Device\\HarddiskVolume?\\Windows\\Sys?????\\mmc.exe",
"?\\Device\\HarddiskVolume?\\Windows\\Sys?????\\WerFault.exe"

/* Crowdstrike specific exclusion as it uses NT Object paths */
"?\\Device\\HarddiskVolume*\\Windows\\Sys?????\\mmc.exe",
"?\\Device\\HarddiskVolume*\\Windows\\Sys?????\\WerFault.exe"
)
'''

Expand Down
Loading