Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Rule Tuning] Windows DR Tuning - 6 #3246

Merged
merged 6 commits into from
Dec 12, 2023
Merged

[Rule Tuning] Windows DR Tuning - 6 #3246

merged 6 commits into from
Dec 12, 2023

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Oct 26, 2023 •
edited
Loading

Issues

Part of #3186
Resolves #3104

Summary

Tunes the following rules:

  • Suspicious Endpoint Security Parent Process
  • Program Files Directory Masquerading
  • MsBuild Making Network Connections
  • Unusual Network Activity from a Windows System Binary
  • Process Termination followed by Deletion

Deletes (instead of deprecating as these never went into any releases) the following development rules that aren't relevant as they are duplicates of production rules:

  • MsXsl Making Network Connections (Dup of Network Connection via MsXsl)
  • MsBuild Network Connection Sequence (Dup of MsBuild Making Network Connections)

@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint backport: auto labels Oct 26, 2023
@w0rk3r w0rk3r self-assigned this Oct 26, 2023
w0rk3r
w0rk3r commented Oct 26, 2023
View reviewed changes
Copy link
Contributor Author

@w0rk3r w0rk3r left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some comments to make the review easier

rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml Show resolved Hide resolved
rules/windows/defense_evasion_masquerading_trusted_directory.toml Show resolved Hide resolved
rules/windows/defense_evasion_masquerading_trusted_directory.toml Show resolved Hide resolved
rules/windows/defense_evasion_network_connection_from_windows_binary.toml Outdated Show resolved Hide resolved
This was referenced Oct 27, 2023
Closed
Closed
@terrancedejesus
Copy link
Contributor

@w0rk3r - Still updating repository if we can wait for this until afterwards.

@w0rk3r
Copy link
Contributor Author

w0rk3r commented Dec 11, 2023

@terrancedejesus thanks for the ping, I still have some testing/adjusts to do on this one before merge

@w0rk3r w0rk3r merged commit 6f4c323 into main Dec 12, 2023
13 checks passed
@w0rk3r w0rk3r deleted the rt_7 branch December 12, 2023 14:37
protectionsmachine pushed a commit that referenced this pull request Dec 12, 2023
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 6 (#3246)
80e8b95 
* [Rule Tuning] Windows DR Tuning - 6

* Update defense_evasion_masquerading_as_elastic_endpoint_process.toml

* Update defense_evasion_network_connection_from_windows_binary.toml

---------

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit 6f4c323)
protectionsmachine pushed a commit that referenced this pull request Dec 12, 2023
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 6 (#3246)
dc432c5 
* [Rule Tuning] Windows DR Tuning - 6

* Update defense_evasion_masquerading_as_elastic_endpoint_process.toml

* Update defense_evasion_network_connection_from_windows_binary.toml

---------

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit 6f4c323)
protectionsmachine pushed a commit that referenced this pull request Dec 12, 2023
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 6 (#3246)
6705f9c 
* [Rule Tuning] Windows DR Tuning - 6

* Update defense_evasion_masquerading_as_elastic_endpoint_process.toml

* Update defense_evasion_network_connection_from_windows_binary.toml

---------

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit 6f4c323)
protectionsmachine pushed a commit that referenced this pull request Dec 12, 2023
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 6 (#3246)
73a79b3 
* [Rule Tuning] Windows DR Tuning - 6

* Update defense_evasion_masquerading_as_elastic_endpoint_process.toml

* Update defense_evasion_network_connection_from_windows_binary.toml

---------

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit 6f4c323)
protectionsmachine pushed a commit that referenced this pull request Dec 12, 2023
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 6 (#3246)
59d517e 
* [Rule Tuning] Windows DR Tuning - 6

* Update defense_evasion_masquerading_as_elastic_endpoint_process.toml

* Update defense_evasion_network_connection_from_windows_binary.toml

---------

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit 6f4c323)
protectionsmachine pushed a commit that referenced this pull request Dec 12, 2023
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 6 (#3246)
54ff6d7 
* [Rule Tuning] Windows DR Tuning - 6

* Update defense_evasion_masquerading_as_elastic_endpoint_process.toml

* Update defense_evasion_network_connection_from_windows_binary.toml

---------

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit 6f4c323)
protectionsmachine pushed a commit that referenced this pull request Dec 12, 2023
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 6 (#3246)
243a7fe 
* [Rule Tuning] Windows DR Tuning - 6

* Update defense_evasion_masquerading_as_elastic_endpoint_process.toml

* Update defense_evasion_network_connection_from_windows_binary.toml

---------

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit 6f4c323)
protectionsmachine pushed a commit that referenced this pull request Dec 12, 2023
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 6 (#3246)
c55eb80 
* [Rule Tuning] Windows DR Tuning - 6

* Update defense_evasion_masquerading_as_elastic_endpoint_process.toml

* Update defense_evasion_network_connection_from_windows_binary.toml

---------

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit 6f4c323)
protectionsmachine pushed a commit that referenced this pull request Dec 12, 2023
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 6 (#3246)
f3d2a73 
* [Rule Tuning] Windows DR Tuning - 6

* Update defense_evasion_masquerading_as_elastic_endpoint_process.toml

* Update defense_evasion_network_connection_from_windows_binary.toml

---------

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit 6f4c323)
protectionsmachine pushed a commit that referenced this pull request Dec 12, 2023
@w0rk3r @github-actions
[Rule Tuning] Windows DR Tuning - 6 (#3246)
046321b 
* [Rule Tuning] Windows DR Tuning - 6

* Update defense_evasion_masquerading_as_elastic_endpoint_process.toml

* Update defense_evasion_network_connection_from_windows_binary.toml

---------

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit 6f4c323)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Aegrah Aegrah Aegrah approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@shashank-elastic shashank-elastic shashank-elastic approved these changes

@brokensound77 brokensound77 Awaiting requested review from brokensound77

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

@imays11 imays11 Awaiting requested review from imays11

@Samirbous Samirbous Awaiting requested review from Samirbous

Assignees

@w0rk3r w0rk3r

Labels
backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Rule Tuning] Unusual Network Activity from a Windows System Binary
5 participants
@w0rk3r @terrancedejesus @Aegrah @shashank-elastic @DefSecSentinel