Skip to content

[Rule Tuning] Windows High Severity - 3 #5094

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 5 commits into from
Sep 15, 2025
Merged

[Rule Tuning] Windows High Severity - 3 #5094

merged 5 commits into from
Sep 15, 2025

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Sep 12, 2025

Issues

Part of https://github.com/elastic/ia-trade-team/issues/678

Summary

Logic adjusts to exclude FPs or cover FNs.

@w0rk3r w0rk3r self-assigned this Sep 12, 2025
@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint backport: auto labels Sep 12, 2025
@github-actions GitHub Actions
Copy link
Contributor

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic
Copy link

tradebot-elastic commented Sep 12, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential System Tampering via File Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Execution of File Written or Modified by PDF Reader (eql)
  • ❌ Command and Scripting Interpreter via Windows Scripts (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Public IP Discovery via DNS Query (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Microsoft Management Console File from Unusual Path (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

w0rk3r
w0rk3r commented Sep 12, 2025
View reviewed changes
rules/windows/discovery_host_public_ip_address_lookup.toml
?process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or
?process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe", "?\\Device\\HarddiskVolume?\\Users\\*.exe", "?\\Device\\HarddiskVolume?\\ProgramData\\*.exe")
?process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe")
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CS doesn't populate this one

Samirbous
Samirbous reviewed Sep 12, 2025
View reviewed changes
rules/windows/execution_pdf_written_file.toml Outdated
file.name : "rdrcef.exe")
] by host.id, file.path
[process where host.os.type == "windows" and event.type == "start"] by host.id, process.executable
[file where host.os.type == "windows" and event.type != "deletion" and
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this rule need to be drepacted or simplified for performance (sequence by file.path with process.executable) and the scenario is very low in term of occurrence likelihood as well as the FP rate is high?

Maybe remove the sequence and just limit to file event alone ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

File + new_terms? Tbh I'm fine with deprecating this one

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

++ for deprecate

Copy link
Contributor Author

@w0rk3r w0rk3r Sep 12, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added the preffix and reverted the changes, will deprecate it in a few releases from now.

@tradebot-elastic
Copy link

tradebot-elastic commented Sep 12, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential System Tampering via File Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Deprecated - Execution of File Written or Modified by PDF Reader (eql)
  • ❌ Command and Scripting Interpreter via Windows Scripts (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Public IP Discovery via DNS Query (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Microsoft Management Console File from Unusual Path (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Sep 12, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential System Tampering via File Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Deprecated - Execution of File Written or Modified by PDF Reader (eql)
  • ❌ Command and Scripting Interpreter via Windows Scripts (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Public IP Discovery via DNS Query (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Microsoft Management Console File from Unusual Path (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@w0rk3r w0rk3r requested a review from Samirbous September 12, 2025 18:39
@tradebot-elastic
Copy link

tradebot-elastic commented Sep 13, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential System Tampering via File Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Deprecated - Execution of File Written or Modified by PDF Reader (eql)
  • ❌ Command and Scripting Interpreter via Windows Scripts (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Public IP Discovery via DNS Query (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Microsoft Management Console File from Unusual Path (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Sep 15, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential System Tampering via File Modification (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ Deprecated - Execution of File Written or Modified by PDF Reader (eql)
  • ❌ Command and Scripting Interpreter via Windows Scripts (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ System Public IP Discovery via DNS Query (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Microsoft Management Console File from Unusual Path (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@w0rk3r w0rk3r merged commit d69ede2 into main Sep 15, 2025
22 of 32 checks passed
@w0rk3r w0rk3r deleted the rule_review_4 branch September 15, 2025 15:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aegrah Aegrah Aegrah approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@Mikaayenson Mikaayenson Awaiting requested review from Mikaayenson

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

@Samirbous Samirbous Awaiting requested review from Samirbous

Assignees

@w0rk3r w0rk3r

Labels

backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@w0rk3r @tradebot-elastic @Samirbous @Aegrah @terrancedejesus