[Rule Tuning] Compression DLL Loaded by Unusual Process (#3017)

rules_building_block/collection_archive_data_zip_imageload.toml

@@ -4,7 +4,7 @@ integration = ["endpoint"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/07/06"
+updated_date = "2023/08/16"
 
 [rule]
 author = ["Elastic"]
@@ -29,13 +29,22 @@ building_block_type = "default"
 query = '''
 library where 
   dll.name : ("System.IO.Compression.FileSystem.ni.dll", "System.IO.Compression.ni.dll") and
-  
-  /* FP Patterns */
-  not process.executable :
-      ("?:\\Program Files\\*",
-       "?:\\Program Files (x86)\\*",
-       "?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe",
-       "?:\\Windows\\System32\\sdiagnhost.exe")
+  not 
+  (
+    (
+      process.executable : (
+        "?:\\Program Files\\*",
+        "?:\\Program Files (x86)\\*",
+        "?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe",
+        "?:\\Windows\\System32\\sdiagnhost.exe",
+        "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
+        "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\DataCollection\\*\\OpenHandleCollector.exe"
+      ) and process.code_signature.trusted == true
+    ) or
+    (
+      process.name : "NuGet.exe" and process.code_signature.trusted == true and user.id : ("S-1-5-18", "S-1-5-20")
+    )
+  )
 '''
 
 [[rule.threat]]