Merge pull request #786 from EccoTheFlintstone/perf_fix

various rules cleaning (slight perf improvements)

rules/windows/sysmon/sysmon_cmstp_execution.yml

@@ -31,6 +31,7 @@ detection:
     selection2:
         EventID: 12
         TargetObject: '*\cmmgr32.exe*'
+        EventType: 'CreateKey'
     # Registry Object Value Set
     selection3:
         EventID: 13

rules/windows/sysmon/sysmon_disable_security_events_logging_adding_reg_key_minint.yml

@@ -18,6 +18,7 @@ detection:
       - EventID: 12 # key create
         # Sysmon gives us HKLM\SYSTEM\CurrentControlSet\.. if ControlSetXX is the selected one
         TargetObject: 'HKLM\SYSTEM\CurrentControlSet\Control\MiniNt'
+        EventType: 'CreateKey'  # we don't want deletekey
       - EventID: 14  # key rename
         NewName: 'HKLM\SYSTEM\CurrentControlSet\Control\MiniNt'
     condition: selection

rules/windows/sysmon/sysmon_registry_persistence_key_linking.yml

@@ -16,6 +16,7 @@ logsource:
 detection:
     selection:
         EventID: 12
+        EventType: 'CreateKey'  # don't want DeleteKey events
         TargetObject: 'HKU\\*_Classes\CLSID\\*\TreatAs'
     condition: selection
 falsepositives:

rules/windows/sysmon/sysmon_susp_office_dotnet_assembly_dll_load.yml

@@ -16,12 +16,12 @@ detection:
     selection:
         EventID: 7
         Image:
-            - '*\winword.exe*'
-            - '*\powerpnt.exe*'
-            - '*\excel.exe*'
-            - '*\outlook.exe*'
+            - '*\winword.exe'
+            - '*\powerpnt.exe'
+            - '*\excel.exe'
+            - '*\outlook.exe'
         ImageLoaded:
-            - '*C:\Windows\assembly\*'
+            - 'C:\Windows\assembly\*'
     condition: selection
 falsepositives:
     - Alerts on legitimate macro usage as well, will need to filter as appropriate

rules/windows/sysmon/sysmon_susp_office_dotnet_gac_dll_load.yml

@@ -16,12 +16,12 @@ detection:
     selection:
         EventID: 7
         Image:
-            - '*\winword.exe*'
-            - '*\powerpnt.exe*'
-            - '*\excel.exe*'
-            - '*\outlook.exe*'
+            - '*\winword.exe'
+            - '*\powerpnt.exe'
+            - '*\excel.exe'
+            - '*\outlook.exe'
         ImageLoaded:
-            - '*C:\Windows\Microsoft.NET\assembly\GAC_MSIL*'
+            - 'C:\Windows\Microsoft.NET\assembly\GAC_MSIL*'
     condition: selection
 falsepositives:
     - Alerts on legitimate macro usage as well, will need to filter as appropriate

rules/windows/sysmon/sysmon_susp_office_kerberos_dll_load.yml

@@ -16,12 +16,12 @@ detection:
     selection:
         EventID: 7
         Image:
-            - '*\winword.exe*'
-            - '*\powerpnt.exe*'
-            - '*\excel.exe*'
-            - '*\outlook.exe*'
+            - '*\winword.exe'
+            - '*\powerpnt.exe'
+            - '*\excel.exe'
+            - '*\outlook.exe'
         ImageLoaded:
-            - '*\kerberos.dll*'
+            - '*\kerberos.dll'
     condition: selection
 falsepositives:
     - Alerts on legitimate macro usage as well, will need to filter as appropriate

rules/windows/sysmon/sysmon_susp_winword_vbadll_load.yml

@@ -16,14 +16,14 @@ detection:
     selection:
         EventID: 7
         Image:
-            - '*\winword.exe*'
-            - '*\powerpnt.exe*'
-            - '*\excel.exe*'
-            - '*\outlook.exe*'
+            - '*\winword.exe'
+            - '*\powerpnt.exe'
+            - '*\excel.exe'
+            - '*\outlook.exe'
         ImageLoaded:
-            - '*\VBE7.DLL*'
-            - '*\VBEUI.DLL*'
-            - '*\VBE7INTL.DLL*'
+            - '*\VBE7.DLL'
+            - '*\VBEUI.DLL'
+            - '*\VBE7INTL.DLL'
     condition: selection
 falsepositives:
     - Alerts on legitimate macro usage as well, will need to filter as appropriate

rules/windows/sysmon/sysmon_svchost_dll_search_order_hijack.yml

@@ -27,12 +27,9 @@ detection:
             - '*\tsvipsrv.dll'
             - '*\wlbsctrl.dll'
     filter:
-        EventID: 7
-        Image:
-            - '*\svchost.exe'
         ImageLoaded:
             - 'C:\Windows\WinSxS\*'        
     condition: selection and not filter
 falsepositives:
     - Pentest
-level: high
+level: high