[Rule Tuning] Windows BBR Tuning - 4

rules_building_block/discovery_posh_generic.toml

@@ -4,7 +4,7 @@ integration = ["windows"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/10/19"
+updated_date = "2024/01/12"
 
 
 [rule]
@@ -47,9 +47,6 @@ building_block_type = "default"
 query = '''
 event.category:process and host.os.type:windows and
   powershell.file.script_block_text : (
-    (
-      ("Get-ItemProperty" or "Get-Item") and "-Path"
-    ) or
     (
       "Get-ADDefaultDomainPasswordPolicy" or
       "Get-ADDomain" or "Get-ComputerInfo" or
@@ -132,6 +129,14 @@ event.category:process and host.os.type:windows and
       )
     )
   ) and
+  not powershell.file.script_block_text : (
+    (
+      "__cmdletization_BindCommonParameters" and
+      "Microsoft.PowerShell.Core\Export-ModuleMember" and
+      "Microsoft.PowerShell.Cmdletization.Cim.CimCmdletAdapter"
+    ) or
+    "CmdletsToExport=@(\"Add-Content\","
+  ) and
   not user.id : ("S-1-5-18" or "S-1-5-19" or "S-1-5-20") and
   not file.path : (
         ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psd1 or

rules_building_block/discovery_posh_password_policy.toml

@@ -4,7 +4,7 @@ integration = ["windows"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/10/19"
+updated_date = "2024/01/12"
 
 [rule]
 author = ["Elastic"]
@@ -76,6 +76,10 @@ event.category: "process" and host.os.type:windows and
 ) and not powershell.file.script_block_text : (
     "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
   )
+  and not 
+  (
+    powershell.file.script_block_text : ("43c15630-959c-49e4-a977-758c5cc93408" and "CmdletsToExport" and "ActiveDirectory.Types.ps1xml")
+  )
   and not user.id : "S-1-5-18"
 '''
 

rules_building_block/discovery_system_time_discovery.toml

@@ -4,7 +4,7 @@ integration = ["windows", "endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/09/21"
+updated_date = "2024/01/12"
 bypass_bbr_timing = true
 
 [rule]
@@ -36,8 +36,10 @@ type = "eql"
 query = '''
 process where host.os.type == "windows" and event.type == "start" and
 (
- ((process.name: "net.exe" or (process.name : "net1.exe" and not process.parent.name : "net.exe")) and 
-   process.args : "time") or 
+ (
+    (process.name: "net.exe" or (process.name : "net1.exe" and not process.parent.name : "net.exe")) and 
+    process.args : "time" and not process.args : "/set"
+ ) or 
  (process.name: "w32tm.exe" and process.args: "/tz") or 
  (process.name: "tzutil.exe" and process.args: "/g")
 ) and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20")

rules_building_block/execution_settingcontent_ms_file_creation.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/08/24"
+updated_date = "2024/01/12"
 
 [rule]
 author = ["Elastic"]
@@ -31,7 +31,8 @@ type = "eql"
 
 query = '''
 file where host.os.type == "windows" and event.type == "creation" and
-  file.extension : "settingcontent-ms"
+  file.extension : "settingcontent-ms" and
+  not file.path : "?:\\Users\\*\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_*\\LocalState\\Indexed\\Settings\\*"
 '''
 
 [[rule.threat]]

rules_building_block/execution_unsigned_service_executable.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "Multiple field support in the New Terms rule type was added in Elastic 8.6"
 min_stack_version = "8.6.0"
-updated_date = "2023/09/19"
+updated_date = "2024/01/12"
 bypass_bbr_timing = true
 
 [rule]
@@ -36,7 +36,8 @@ type = "new_terms"
 query = '''
 host.os.type:windows and event.category:process and event.type:start and 
 process.parent.executable:"C:\\Windows\\System32\\services.exe" and 
-(process.code_signature.exists:false or process.code_signature.trusted:false)
+(process.code_signature.exists:false or process.code_signature.trusted:false) and
+not process.code_signature.status : (errorCode_endpoint* or "errorChaining")
 '''
 
 [[rule.threat]]