Skip to content

[Rule Tuning] Node.js Pre or Post-Install Script Execution to Cross-Platform #5403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 11 commits into from
Dec 4, 2025
Merged

[Rule Tuning] Node.js Pre or Post-Install Script Execution to Cross-Platform #5403

merged 11 commits into from
Dec 4, 2025

Conversation

@terrancedejesus
Copy link
Contributor

@terrancedejesus terrancedejesus commented Dec 3, 2025 •
edited
Loading

Fixes #5402

Pull Request

Issue link(s):

Summary - What I changed

Adjusts the rule to be cross-platform with macos added. Adds Shai-Hulud 2.0 reference and T1204.005 as another mapping. Please see the issue for more details.

How To Test

Emulated with custom NPM package that leveraged pre-install hook to gather CSP CLI creds locally. Query results in related issue.

Screenshot 2025-12-03 at 9 34 30 AM

Checklist

  • Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
  • Added the meta:rapid-merge label if planning to merge within 24 hours
  • Secret and sensitive material has been managed correctly
  • Automated testing was updated or added to match the most common scenarios
  • Documentation and comments were added for features that require explanation

Contributor checklist

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@terrancedejesus terrancedejesus self-assigned this Dec 3, 2025
@terrancedejesus terrancedejesus added Rule: Tuning tweaking or tuning an existing rule Domain: Endpoint Integration: Endpoint Elastic Endpoint Security labels Dec 3, 2025
@terrancedejesus terrancedejesus marked this pull request as ready for review December 3, 2025 14:55
@github-actions
Copy link
Contributor

github-actions bot commented Dec 3, 2025

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@terrancedejesus
Copy link
Contributor Author

terrancedejesus commented Dec 3, 2025

@Aegrah @w0rk3r - Not sure about the crowdstrike compatibility here.

@Aegrah
Copy link
Contributor

Aegrah commented Dec 3, 2025

@terrancedejesus these should be compatible with CrowdStrike, as there are no incompatible fields.

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@terrancedejesus @Aegrah
Update rules/cross-platform/execution_nodejs_pre_or_post_install_scri…
d1ac0d3 
…pt_execution.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Aegrah
Aegrah reviewed Dec 3, 2025
View reviewed changes
rules/cross-platform/execution_nodejs_pre_or_post_install_script_execution.toml Outdated
Comment on lines 62 to 68
sequence by host.id with maxspan=10s
[process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "ProcessRollup2") and process.name == "node" and process.args == "install"] by process.entity_id
[process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "ProcessRollup2") and process.parent.name == "node"] by process.parent.entity_id
[process where host.os.type in ("linux", "macos") and event.type == "start" and event.action in ("exec", "ProcessRollup2") and process.name == "node" and process.args == "install"] by process.entity_id
[process where host.os.type in ("linux", "macos") and event.type == "start" and event.action in ("exec", "ProcessRollup2") and process.parent.name == "node"] by process.parent.entity_id
Copy link
Contributor

@Aegrah Aegrah Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wrote this logic while testing for Linux; I would assume it to be compatible with macOS as well; but it was not tested. cc @DefSecSentinel

Copy link
Contributor Author

@terrancedejesus terrancedejesus Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No worries, I tested the query on the data generated from my macbook when emulating this.

Aegrah
Aegrah approved these changes Dec 3, 2025
View reviewed changes
Copy link
Contributor

@Aegrah Aegrah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 3, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Node.js Pre or Post-Install Script Execution (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@terrancedejesus terrancedejesus merged commit 7a884eb into main Dec 4, 2025
13 checks passed
@terrancedejesus terrancedejesus deleted the terrancedejesus/issue5402 branch December 4, 2025 14:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aegrah Aegrah Aegrah approved these changes

@shashank-elastic shashank-elastic shashank-elastic approved these changes

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

@Samirbous Samirbous Awaiting requested review from Samirbous

Assignees

@terrancedejesus terrancedejesus

Labels

backport: auto Domain: Endpoint Integration: Endpoint Elastic Endpoint Security Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Rule Tuning] Node.js Pre or Post-Install Script Execution to Cross-Platform

5 participants

@terrancedejesus @tradebot-elastic @Aegrah @shashank-elastic