[Rule Tuning] Windows BBR Tuning - 3 (#3382)

* [Rule Tuning] Windows BBR Tuning - 3 * Update defense_evasion_service_disabled_registry.toml --------- Co-authored-by: Samirbous <[email protected]> Removed changes from: - rules_building_block/discovery_internet_capabilities.toml (selectively cherry picked from commit 5334601)
elastic · Feb 14, 2024 · bdb8453 · bdb8453
1 parent 0c45c02
commit bdb8453
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 7 deletions.
diff --git a/rules_building_block/defense_evasion_powershell_clear_logs_script.toml b/rules_building_block/defense_evasion_powershell_clear_logs_script.toml
@@ -4,7 +4,7 @@ integration = ["windows"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/10/13"
+updated_date = "2024/01/11"
 
 [rule]
 author = ["Elastic"]
@@ -57,6 +57,9 @@ event.category:process and host.os.type:windows and
   ) and
   not file.path : (
     ?\:\\\\*\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\Modules\\\\Microsoft.PowerShell.Management\\\\*.psd1
+  ) and
+  not powershell.file.script_block_text : (
+    "CmdletsToExport=@(\"Add-Content\""
   )
 '''
 

diff --git a/rules_building_block/defense_evasion_service_disabled_registry.toml b/rules_building_block/defense_evasion_service_disabled_registry.toml
@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/08/29"
+updated_date = "2024/01/11"
 
 [rule]
 author = ["Elastic"]
@@ -44,6 +44,7 @@ registry where host.os.type == "windows" and event.type == "change" and
     (
       process.name : "services.exe" and user.id : "S-1-5-18"
     )
+  and not registry.path : "HKLM\\SYSTEM\\ControlSet001\\Services\\MrxSmb10\\Start"
 '''
 
 

diff --git a/rules_building_block/defense_evasion_services_exe_path.toml b/rules_building_block/defense_evasion_services_exe_path.toml
@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/08/29"
+updated_date = "2024/01/11"
 
 [rule]
 author = ["Elastic"]
@@ -35,8 +35,8 @@ building_block_type = "default"
 type = "eql"
 
 query = '''
-process where event.type == "start" and
-  process.name : "sc.exe" and process.args : "*binPath*"
+process where event.type == "start" and process.name : "sc.exe" and
+  process.args : "*config*" and process.args : "*binPath*"
 '''
 
 

diff --git a/rules_building_block/defense_evasion_unusual_process_extension.toml b/rules_building_block/defense_evasion_unusual_process_extension.toml
@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/10/09"
+updated_date = "2024/01/11"
 
 [rule]
 author = ["Elastic"]
@@ -43,7 +43,11 @@ process where host.os.type == "windows" and event.type == "start" and
     (process.name : "C9632CF058AE4321B6B0B5EA39B710FE" and process.code_signature.subject_name == "Dell Inc") or
     (process.name : "*.upd" and process.code_signature.subject_name == "Bloomberg LP") or
     (process.name: "FD552E21-686E-413C-931D-3B82A9D29F3B" and process.code_signature.subject_name: "Adobe Inc.") or
-    (process.name: "3B91051C-AE82-43C9-BCEF-0309CD2DD9EB" and process.code_signature.subject_name: "McAfee, LLC")
+    (process.name: "3B91051C-AE82-43C9-BCEF-0309CD2DD9EB" and process.code_signature.subject_name: "McAfee, LLC") or
+    (process.name: "soffice.bin" and process.code_signature.subject_name: "The Document Foundation") or
+    (process.name: ("VeeamVixProxy_*", "{????????-????-????-????-????????????}") and process.code_signature.subject_name: "Veeam Software Group GmbH") or
+    (process.name: "1cv8p64.bin" and process.code_signature.subject_name: "LLC 1C-Soft") or
+    (process.name: "AGSRunner.bin" and process.code_signature.subject_name: "Intel Corporation")
   )
 '''