From 518d146cb033d0795aff56be66bea0ecd717233d Mon Sep 17 00:00:00 2001
From: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Date: Wed, 5 Oct 2022 13:45:36 -0400
Subject: [PATCH] [Rule Tuning] Exclude Elastic Agent from "Potential Process
 Herpaderping Attempt" (#2342)

* adjusted query to filter out Elastic or Trend Micro EXE activity

* added wildcard to drive letter and fixed unit test failure
---
 .../defense_evasion_potential_processherpaderping.toml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/rules/windows/defense_evasion_potential_processherpaderping.toml b/rules/windows/defense_evasion_potential_processherpaderping.toml
index 40e8e9e85..561dca02b 100644
--- a/rules/windows/defense_evasion_potential_processherpaderping.toml
+++ b/rules/windows/defense_evasion_potential_processherpaderping.toml
@@ -3,7 +3,7 @@ creation_date = "2020/10/27"
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2022/08/24"
+updated_date = "2022/10/05"
 
 [rule]
 author = ["Elastic"]
@@ -25,7 +25,13 @@ type = "eql"
 
 query = '''
 sequence with maxspan=5s
-   [process where event.type == "start" and not process.parent.executable : "C:\\Windows\\SoftwareDistribution\\*.exe"] by host.id, process.executable, process.parent.entity_id
+   [process where event.type == "start" and not process.parent.executable :
+      (
+         "?:\\Windows\\SoftwareDistribution\\*.exe",
+         "?:\\Program Files\\Elastic\\Agent\\data\\*.exe",
+         "?:\\Program Files (x86)\\Trend Micro\\*.exe"
+      )
+   ] by host.id, process.executable, process.parent.entity_id
    [file where event.type == "change" and event.action == "overwrite" and file.extension == "exe"] by host.id, file.path, process.entity_id
 '''