[Meta] Windows Detection Rules Tuning

[w0rk3r]

Summary

This Meta will focus on tuning the existing Windows rules, focusing on reducing the ruleset's general noise.

Tasks

Preview Give feedback

1. Analyze the rules for tuning opportunities
2. Evaluate whether to convert them to new_terms to reduce alert volume
3. PRs to Detection Rules
4. Check detection_rules issues for tuning requests

Community Issues

• [Rule Tuning] Suspicious PowerShell Engine ImageLoad  #2840
• [Rule Tuning] Whoami Process Activity #3081
• [Rule Tuning] Remote File Copy to a Hidden Share #3103
• [Rule Tuning] Unusual Network Activity from a Windows System Binary #3104
• https://github.com/elastic/sdh-protections/issues/449
• [Rule Tuning] Startup or Run Key Registry Modification #3357
• [Rule Tuning] User Added to Privileged Group #3373

PRs - First Iteration

• [Rule Tuning] Potential Masquerading as Browser Process #3180
• [Promote] Potential Masquerading as Communication Apps #3181
• [Rule Tuning] Potential Masquerading as System32 DLL #3184
• [Promote] Expired or Revoked Driver Loaded #3185
• [Rule Tuning] Windows DR Tuning - 1 #3198
• [Rule Tuning] Windows DR Tuning - 2 #3209
• [Rule Tuning] Windows DR Tuning - 3 #3212
• [Rule Tuning] Windows DR Tuning - 4 #3214
• [Rule Tuning] Potential Privilege Escalation via InstallerFileTakeOver #3215
• [Rule Tuning] Windows DR Tuning - 5 #3229
• [Rule Tuning] Windows DR Tuning - 6 #3246

PRs - 2nd Iteration (Sprint 11 & 12)

• [Rule Tuning] Windows DR Tuning - 7 #3344
• [Rule Tuning] Windows DR Tuning - 8 #3353
• [Rule Tuning] Windows DR Tuning - 9 #3354
• [Rule Tuning] Windows DR Tuning - 10 #3355
• [Rule Tuning] Windows DR Tuning - 11 #3359
• [Rule Tuning] Windows DR Tuning - 12 #3364
• [Rule Tuning] Startup or Run Key Registry Modification #3367
• [Rule Tuning] Windows DR Tuning - 13 #3369

PRs - 3rd Iteration (Sprint 13)

• [Rule Tuning] Windows DR Tuning - 14 #3376
• [Rule Tuning] Windows DR Tuning - 15 #3377
• [Rule Tuning] Windows BBR Tuning - 1 #3380
• [Rule Tuning] Windows BBR Tuning - 2 #3381
• [Rule Tuning] Windows BBR Tuning - 3 #3382
• [Rule Tuning] Windows BBR Tuning - 4 #3384
• [Rule Tuning] Windows BBR Tuning - 5 #3385
• [Rule Tuning] Windows BBR Tuning - 6 #3386