From 8b2aed4fc00c351914cdfe55d728bf41b30093bc Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Thu, 14 Dec 2023 17:51:35 +0000
Subject: [PATCH] [Tuning] Suspicious Managed Code Hosting Process (#3338)

* Update defense_evasion_suspicious_managedcode_host_process.toml

* Update defense_evasion_suspicious_managedcode_host_process.toml
---
 ..._evasion_suspicious_managedcode_host_process.toml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml b/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml
index ec4a40ec4..bd44432f7 100644
--- a/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml
+++ b/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2023/10/09"
+updated_date = "2023/12/14"
 
 [rule]
 author = ["Elastic"]
@@ -13,7 +13,7 @@ Identifies a suspicious managed code hosting process which could indicate code i
 code execution.
 """
 from = "now-9m"
-index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
+index = ["winlogbeat-*", "logs-endpoint.events.file-*", "logs-windows.*"]
 language = "eql"
 license = "Elastic License v2"
 name = "Suspicious Managed Code Hosting Process"
@@ -22,13 +22,11 @@ risk_score = 73
 rule_id = "acf738b5-b5b2-4acc-bad9-1e18ee234f40"
 severity = "high"
 tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
+timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-sequence by process.entity_id with maxspan=5m
- [process where host.os.type == "windows" and event.type == "start" and
-  process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "wmic.exe", "regsvr32.exe", "svchost.exe", "dllhost.exe", "cmstp.exe")]
- [file where host.os.type == "windows" and event.type != "deletion" and
+file where host.os.type == "windows" and event.type != "deletion" and
   file.name : ("wscript.exe.log",
                "cscript.exe.log",
                "mshta.exe.log",
@@ -36,7 +34,7 @@ sequence by process.entity_id with maxspan=5m
                "svchost.exe.log",
                "dllhost.exe.log",
                "cmstp.exe.log",
-               "regsvr32.exe.log")]
+               "regsvr32.exe.log")
 '''