[Rule Tuning] Microsoft IIS Service Account Password Dumped (#3935)

rules_building_block/credential_access_iis_apppoolsa_pwd_appcmd.toml

@@ -1,11 +1,13 @@
 [metadata]
+bypass_bbr_timing = true
 creation_date = "2020/08/18"
 integration = ["endpoint", "windows", "system"]
 maturity = "production"
-updated_date = "2024/05/21"
+updated_date = "2024/07/31"
 
 [rule]
 author = ["Elastic"]
+building_block_type = "default"
 description = """
 Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. An attacker
 with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd.
@@ -20,20 +22,11 @@ index = [
 ]
 language = "eql"
 license = "Elastic License v2"
-max_signals = 33
 name = "Microsoft IIS Service Account Password Dumped"
 references = ["https://blog.netspi.com/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/"]
-risk_score = 73
+risk_score = 21
 rule_id = "0564fb9d-90b9-4234-a411-82a546dc1343"
-setup = """## Setup
-
-If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
-events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
-Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
-`event.ingested` to @timestamp.
-For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
-"""
-severity = "high"
+severity = "low"
 tags = [
     "Domain: Endpoint",
     "OS: Windows",
@@ -41,6 +34,7 @@ tags = [
     "Tactic: Credential Access",
     "Data Source: Elastic Endgame",
     "Data Source: Elastic Defend",
+    "Rule Type: BBR",
 ]
 timestamp_override = "event.ingested"
 type = "eql"
@@ -48,7 +42,7 @@ type = "eql"
 query = '''
 process where host.os.type == "windows" and event.type == "start" and
    (process.name : "appcmd.exe" or ?process.pe.original_file_name == "appcmd.exe") and
-   process.args : "/list" and process.args : "/text*password"
+   process.args : "list" and process.args : "/text*"
 '''