[Rule Tuning] Windows DR Tuning - 3 (#3212)

* [Rule Tuning] Windows DR Tuning - 3

* Update credential_access_lsass_openprocess_api.toml

* Update credential_access_moving_registry_hive_via_smb.toml

rules/windows/credential_access_lsass_memdump_file_created.toml

@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/06/22"
+updated_date = "2023/10/23"
 
 [transform]
 [[transform.osquery]]
@@ -118,14 +118,28 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-file where host.os.type == "windows" and file.name : ("lsass*.dmp", "dumpert.dmp", "Andrew.dmp", "SQLDmpr*.mdmp", "Coredump.dmp") and
+file where host.os.type == "windows" and event.action != "deletion" and
+  file.name : ("lsass*.dmp", "dumpert.dmp", "Andrew.dmp", "SQLDmpr*.mdmp", "Coredump.dmp") and
 
- not (process.executable : ("?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\SqlDumper.exe", "?:\\Windows\\System32\\dllhost.exe") and
-      file.path : ("?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\ErrorDumps\\SQLDmpr*.mdmp",
-                   "?:\\*\\Reporting Services\\Logfiles\\SQLDmpr*.mdmp")) and
+  not (
+        process.executable : (
+          "?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\SqlDumper.exe",
+          "?:\\Windows\\System32\\dllhost.exe"
+        ) and
+        file.path : (
+          "?:\\*\\Reporting Services\\Logfiles\\SQLDmpr*.mdmp",
+          "?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\ErrorDumps\\SQLDmpr*.mdmp",
+          "?:\\Program Files\\Microsoft SQL Server\\*\\MSSQL\\LOG\\SQLDmpr*.mdmp"
+        )
+      ) and
 
- not (process.executable : "?:\\WINDOWS\\system32\\WerFault.exe" and
-      file.path : "?:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\CrashDumps\\lsass.exe.*.dmp")
+  not (
+        process.executable : "?:\\Windows\\system32\\WerFault.exe" and
+        file.path : (
+          "?:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\CrashDumps\\lsass.exe.*.dmp",
+          "?:\\Windows\\System32\\%LOCALAPPDATA%\\CrashDumps\\lsass.exe.*.dmp"
+        )
+  )
 '''
 
 

rules/windows/credential_access_lsass_memdump_handle_access.toml

@@ -4,7 +4,7 @@ integration = ["system", "windows"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/06/22"
+updated_date = "2023/10/23"
 
 [transform]
 [[transform.osquery]]
@@ -156,7 +156,8 @@ any where event.action == "File System" and event.code == "4656" and
         "?:\\Windows\\System32\\svchost.exe",
         "?:\\Windows\\System32\\msiexec.exe",
         "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
-        "?:\\Windows\\explorer.exe")
+        "?:\\Windows\\explorer.exe",
+        "?:\\Windows\\System32\\poqexec.exe")
 '''
 
 

rules/windows/credential_access_lsass_openprocess_api.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: Lsass access events added in Elastic Endpoint 8.7."
 min_stack_version = "8.7.0"
-updated_date = "2023/10/13"
+updated_date = "2023/10/23"
 
 [rule]
 author = ["Elastic"]
@@ -26,32 +26,48 @@ type = "eql"
 
 query = '''
 api where host.os.type == "windows" and 
- process.Ext.api.name in ("OpenProcess", "OpenThread") and Target.process.name : "lsass.exe" and 
- not process.executable : 
-             ("?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", 
-              "?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe", 
-              "?:\\Program Files*\\Windows Defender\\MsMpEng.exe", 
-              "?:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe", 
-              "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe", 
-              "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe",
-              "?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe", 
-              "?:\\Program Files (x86)\\N-able Technologies\\Reactive\\bin\\NableReactiveManagement.exe", 
-              "?:\\Program Files\\EA\\AC\\EAAntiCheat.GameService.exe", 
-              "?:\\Program Files\\Cisco\\AMP\\*\\sfc.exe", 
-              "?:\\Program Files\\TDAgent\\ossec-agent\\ossec-agent.exe", 
-              "?:\\Windows\\System32\\MRT.exe", 
-              "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\metricbeat.exe", 
-              "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\osqueryd.exe", 
-              "?:\\Windows\\System32\\msiexec.exe", 
-              "?:\\Program Files\\Common Files\\McAfee\\AVSolution\\mcshield.exe", 
-              "?:\\Program Files\\Fortinet\\FortiClient\\FortiProxy.exe", 
-              "?:\\Program Files\\LogicMonitor\\Agent\\bin\\sbshutdown.exe", 
-              "?:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe", 
-              "?:\\Program Files (x86)\\Blackpoint\\SnapAgent\\SnapAgent.exe", 
-              "?:\\Program Files\\ESET\\ESET Security\\ekrn.exe", 
-              "?:\\Program Files\\Huntress\\HuntressAgent.exe", 
-              "?:\\Program Files (x86)\\eScan\\reload.exe", 
-              "?:\\Program Files\\Topaz OFD\\Warsaw\\core.exe")
+  process.Ext.api.name in ("OpenProcess", "OpenThread") and Target.process.name : "lsass.exe" and 
+  not 
+  (
+    process.executable : (
+        "?:\\ProgramData\\GetSupportService*\\Updates\\Update_*.exe",
+        "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+        "?:\\Program Files (x86)\\Asiainfo Security\\OfficeScan Client\\NTRTScan.exe",
+        "?:\\Program Files (x86)\\Blackpoint\\SnapAgent\\SnapAgent.exe",
+        "?:\\Program Files (x86)\\eScan\\reload.exe",
+        "?:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe",
+        "?:\\Program Files (x86)\\Kaspersky Lab\\*\\avp.exe",
+        "?:\\Program Files (x86)\\N-able Technologies\\Reactive\\bin\\NableReactiveManagement.exe",
+        "?:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe",
+        "?:\\Program Files (x86)\\Trend Micro\\*\\CCSF\\TmCCSF.exe",
+        "?:\\Program Files*\\Windows Defender\\MsMpEng.exe",
+        "?:\\Program Files\\Bitdefender\\Endpoint Security\\EPSecurityService.exe",
+        "?:\\Program Files\\Cisco\\AMP\\*\\sfc.exe",
+        "?:\\Program Files\\Common Files\\McAfee\\AVSolution\\mcshield.exe",
+        "?:\\Program Files\\EA\\AC\\EAAntiCheat.GameService.exe",
+        "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\metricbeat.exe",
+        "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\osqueryd.exe",
+        "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\packetbeat.exe",
+        "?:\\Program Files\\ESET\\ESET Security\\ekrn.exe",
+        "?:\\Program Files\\Fortinet\\FortiClient\\FortiProxy.exe",
+        "?:\\Program Files\\Huntress\\HuntressAgent.exe",
+        "?:\\Program Files\\LogicMonitor\\Agent\\bin\\sbshutdown.exe",
+        "?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe",
+        "?:\\Program Files\\Qualys\\QualysAgent\\QualysAgent.exe",
+        "?:\\Program Files\\TDAgent\\ossec-agent\\ossec-agent.exe",
+        "?:\\Program Files\\Topaz OFD\\Warsaw\\core.exe",
+        "?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe",
+        "?:\\Windows\\AdminArsenal\\PDQDeployRunner\\*\\exec\\Sysmon64.exe",
+        "?:\\Windows\\Sysmon.exe",
+        "?:\\Windows\\Sysmon64.exe",
+        "?:\\Windows\\System32\\csrss.exe",
+        "?:\\Windows\\System32\\MRT.exe",
+        "?:\\Windows\\System32\\msiexec.exe",
+        "?:\\Windows\\System32\\RtkAudUService64.exe",
+        "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
+        "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe"
+    ) and process.code_signature.trusted == true
+  )
 '''
 
 

rules/windows/credential_access_moving_registry_hive_via_smb.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/06/22"
+updated_date = "2023/10/23"
 
 [rule]
 author = ["Elastic"]
@@ -72,7 +72,13 @@ query = '''
 file where host.os.type == "windows" and event.type == "creation" and
  /* regf file header */
  file.Ext.header_bytes : "72656766*" and file.size >= 30000 and
- process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-1-*")
+ process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-1-*") and
+ not file.path : (
+    "?:\\*\\UPM_Profile\\NTUSER.DAT",
+    "?:\\*\\UPM_Profile\\NTUSER.DAT.LASTGOOD.LOAD",
+    "?:\\Windows\\Netwrix\\Temp\\????????.???.offreg",
+    "?:\\*\\AppData\\Local\\Packages\\Microsoft.*\\Settings\\settings.dat*"
+ )
 '''
 
 

rules/windows/credential_access_persistence_network_logon_provider_modification.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/06/22"
+updated_date = "2023/10/23"
 
 [rule]
 author = ["Elastic"]
@@ -31,18 +31,24 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-registry where host.os.type == "windows" and registry.data.strings != null and
- registry.path : (
+registry where host.os.type == "windows" and registry.data.strings : "?*" and
+  registry.path : (
     "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath",
     "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath"
- ) and
- /* Excluding default NetworkProviders RDPNP, LanmanWorkstation and webclient. */
- not ( user.id : "S-1-5-18" and
-       registry.data.strings in
-                ("%SystemRoot%\\System32\\ntlanman.dll",
-                 "%SystemRoot%\\System32\\drprov.dll",
-                 "%SystemRoot%\\System32\\davclnt.dll")
-      )
+  ) and
+  /* Excluding default NetworkProviders RDPNP, LanmanWorkstation and webclient. */
+  not (
+    user.id : "S-1-5-18" and
+    registry.data.strings : (
+        "%SystemRoot%\\System32\\ntlanman.dll",
+        "%SystemRoot%\\System32\\drprov.dll",
+        "%SystemRoot%\\System32\\davclnt.dll",
+        "%SystemRoot%\\System32\\vmhgfs.dll",
+        "?:\\Program Files (x86)\\Citrix\\ICA Client\\x64\\pnsson.dll",
+        "?:\\Program Files\\Dell\\SARemediation\\agent\\DellMgmtNP.dll",
+        "?:\\Program Files (x86)\\CheckPoint\\Endpoint Connect\\\\epcgina.dll"
+    )
+  )
 '''