Skip to content

[Rule Tuning] Windows High Severity - 1 #5092

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 5 commits into from
Sep 15, 2025
Merged

[Rule Tuning] Windows High Severity - 1 #5092

merged 5 commits into from
Sep 15, 2025

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Sep 12, 2025

Issues

Part of https://github.com/elastic/ia-trade-team/issues/678

Summary

Logic adjusts to exclude FPs or cover FNs.

@w0rk3r w0rk3r self-assigned this Sep 12, 2025
@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint backport: auto labels Sep 12, 2025
@github-actions GitHub Actions
Copy link
Contributor

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic
Copy link

tradebot-elastic commented Sep 12, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ✅ Potential Credential Access via Windows Utilities (eql)
  • ✅ Potential DLL Side-Loading via Trusted Microsoft Programs (eql)
  • ❌ Potential File Download via a Headless Browser (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Outlook Home Page Registry Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Modification of WDigest Security Provider (eql)

w0rk3r
w0rk3r commented Sep 12, 2025
View reviewed changes
w0rk3r
w0rk3r commented Sep 12, 2025
View reviewed changes
rules/windows/credential_access_cmdline_dump_tool.toml
(
(?process.pe.original_file_name : "RUNDLL32.EXE" or process.name : "RUNDLL32.exe") and
(process.args : "MiniDump*" or process.command_line : "*comsvcs.dll*#24*")
(process.args : "*MiniDump*" or process.command_line : "*comsvcs*#*24*")
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://x.com/Wietze/status/1542107456507203586

w0rk3r
w0rk3r commented Sep 12, 2025
View reviewed changes
rules/windows/credential_access_cmdline_dump_tool.toml
(
(?process.pe.original_file_name : "ntdsutil.exe" or process.name : "ntdsutil.exe") and
process.args : "create*full*") or
process.args : "cr*fu*") or
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image

https://www.huntress.com/blog/credential-theft-expanding-your-reach

w0rk3r
w0rk3r commented Sep 12, 2025
View reviewed changes
rules/windows/credential_access_mod_wdigest_security_provider.toml
"HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential",
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential"
) and registry.data.strings : ("1", "0x00000001") and
registry where host.os.type == "windows" and event.type in ("creation", "change") and
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In a previous tuning, I've set the event.type to creation, so it wasn't matching the registry modification events. I can remove the creation, but I've kept it there to cover for some dataset that may set it to creation in 3rd party EDRs.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we have other rules with same change ? (event.action set to creation for registry events)

Copy link
Contributor Author

@w0rk3r w0rk3r Sep 12, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have it in my backlog to review ruleset looking for other occurrences today with another logic error I saw

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just checked, this was the only occurrence.

w0rk3r
w0rk3r commented Sep 12, 2025
View reviewed changes
rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wasn't fully excluding legitimate paths for winword.exe

Samirbous
Samirbous reviewed Sep 12, 2025
View reviewed changes
rules/windows/credential_access_mod_wdigest_security_provider.toml
"HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential",
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential"
) and registry.data.strings : ("1", "0x00000001") and
registry where host.os.type == "windows" and event.type in ("creation", "change") and
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we have other rules with same change ? (event.action set to creation for registry events)

@tradebot-elastic
Copy link

tradebot-elastic commented Sep 12, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ✅ Potential Credential Access via Windows Utilities (eql)
  • ✅ Potential DLL Side-Loading via Trusted Microsoft Programs (eql)
  • ❌ Potential File Download via a Headless Browser (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Outlook Home Page Registry Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Modification of WDigest Security Provider (eql)

@tradebot-elastic
Copy link

tradebot-elastic commented Sep 12, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ✅ Potential Credential Access via Windows Utilities (eql)
  • ✅ Potential DLL Side-Loading via Trusted Microsoft Programs (eql)
  • ❌ Potential File Download via a Headless Browser (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Outlook Home Page Registry Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Modification of WDigest Security Provider (eql)

@w0rk3r w0rk3r requested a review from Samirbous September 12, 2025 12:43
@tradebot-elastic
Copy link

tradebot-elastic commented Sep 12, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ✅ Potential Credential Access via Windows Utilities (eql)
  • ✅ Potential DLL Side-Loading via Trusted Microsoft Programs (eql)
  • ❌ Potential File Download via a Headless Browser (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Outlook Home Page Registry Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Modification of WDigest Security Provider (eql)

@tradebot-elastic
Copy link

tradebot-elastic commented Sep 15, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ✅ Potential Credential Access via Windows Utilities (eql)
  • ✅ Potential DLL Side-Loading via Trusted Microsoft Programs (eql)
  • ❌ Potential File Download via a Headless Browser (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Outlook Home Page Registry Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Modification of WDigest Security Provider (eql)

@w0rk3r w0rk3r merged commit 7910f46 into main Sep 15, 2025
12 checks passed
@w0rk3r w0rk3r deleted the rule_review_2 branch September 15, 2025 14:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aegrah Aegrah Aegrah approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@Mikaayenson Mikaayenson Awaiting requested review from Mikaayenson

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

@Samirbous Samirbous Awaiting requested review from Samirbous

Assignees

@w0rk3r w0rk3r

Labels

backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@w0rk3r @tradebot-elastic @Samirbous @Aegrah @terrancedejesus