security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

[Rule Tuning] Update MDE tags to "Microsoft Defender XDR" (#5927)

Browse Source 
* [Rule Tuning] Fix MS Defender XDR tag

* bump upodated_date
This commit is contained in:
Jonhnathan
2026-04-20 18:38:09 -03:00
committed by GitHub
parent b2e4925c7f
commit 8d25a7ddce
255 changed files with 575 additions and 575 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pyproject.toml
+1 -1
View File
@@ -1,6 +1,6 @@
[project]
name = "detection_rules"
version = "1.6.18"
version = "1.6.19"
description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
readme = "README.md"
requires-python = ">=3.12"
rules/cross-platform/command_and_control_tunnel_qemu.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2026/02/09"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -75,7 +75,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Windows Security Event Logs",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
rules/cross-platform/credential_access_gitleaks_execution.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/11/28"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -81,7 +81,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/cross-platform/credential_access_trufflehog_execution.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/09/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -83,7 +83,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/cross-platform/defense_evasion_genai_process_compiling_executables.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/12/04"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "auditd_manager"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -69,7 +69,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Auditd Manager",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Resources: Investigation Guide",
"Domain: LLM",
rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/12/04"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -70,7 +70,7 @@ tags = [
"Tactic: Defense Evasion",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Resources: Investigation Guide",
"Domain: LLM",
rules/cross-platform/execution_register_github_actions_runner.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/11/26"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -76,7 +76,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/cross-platform/execution_via_github_actions_runner.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/11/26"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -76,7 +76,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/collection_email_powershell_exchange_mailbox.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/12/15"
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -85,7 +85,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Windows Security Event Logs",
"Data Source: Crowdstrike",
"Data Source: Sysmon",
rules/windows/collection_winrar_encryption.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/12/04"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/01/12"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -73,7 +73,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
]
timestamp_override = "event.ingested"
rules/windows/command_and_control_certreq_postdata.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/01/13"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -118,7 +118,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/command_and_control_dns_tunneling_nslookup.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/11"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -71,7 +71,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Sysmon",
]
rules/windows/command_and_control_headless_browser.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2024/05/10"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -38,7 +38,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Sysmon",
"Data Source: Crowdstrike",
rules/windows/command_and_control_multiple_rmm_vendors_same_host.toml
+3 -3
View File
@@ -9,7 +9,7 @@ integration = [
"crowdstrike",
]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -29,7 +29,7 @@ note = """## Triage and analysis
### Investigating Multiple Remote Management Tool Vendors on Same Host
This rule aggregates process start events by `host.id`, host name, and a nine-minute time bucket. Data can come from
Elastic Defend, Sysmon, Winlogbeat, Windows Security / forwarded events, Microsoft Defender for Endpoint, SentinelOne,
Elastic Defend, Sysmon, Winlogbeat, Windows Security / forwarded events, Microsoft Defender XDR, SentinelOne,
CrowdStrike FDR, or Elastic Endgame—where ECS process fields are populated. Each known RMM-related process name maps
to one **vendor** label (e.g. TeamViewer, AnyDesk, ScreenConnect). If **two or more different vendor labels** appear in
the same bucket, the rule signals.
@@ -69,7 +69,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: CrowdStrike",
"Data Source: Windows Security Event Logs",
"Data Source: Elastic Endgame",
rules/windows/command_and_control_outlook_home_page.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2024/08/01"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -39,7 +39,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Resources: Investigation Guide",
"Data Source: Crowdstrike",
rules/windows/command_and_control_port_forwarding_added_registry.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/25"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -81,7 +81,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
rules/windows/command_and_control_rdp_tunnel_plink.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/10/14"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -39,7 +39,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Windows Security Event Logs",
"Data Source: Crowdstrike",
"Data Source: Sysmon",
rules/windows/command_and_control_remcos_rat_iocs.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/08/20"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -40,7 +40,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint"
"Data Source: Microsoft Defender XDR"
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/09/03"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[transform]
[[transform.investigate]]
@@ -153,7 +153,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Sysmon",
"Data Source: Crowdstrike",
rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/09/03"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[transform]
[[transform.investigate]]
@@ -151,7 +151,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/command_and_control_rmm_after_msi_install.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2026/03/18"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/20"
[rule]
author = ["Elastic"]
@@ -59,7 +59,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
"Data Source: Windows Security Event Logs",
"Data Source: Elastic Endgame"
rules/windows/command_and_control_rmm_netsupport_susp_path.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/08/20"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -40,7 +40,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Windows Security Event Logs",
"Data Source: Crowdstrike",
]
rules/windows/command_and_control_screenconnect_childproc.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2024/03/27"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -39,7 +39,7 @@ ScreenConnect, a remote access tool, facilitates legitimate remote support but c
- Examine the child process name and arguments, such as powershell.exe with encoded commands or cmd.exe with /c, to identify potentially malicious actions or commands being executed.
- Check the network activity associated with the suspicious process, especially if the process arguments include network-related terms like *http* or *downloadstring*, to determine if there is any unauthorized data exfiltration or command and control communication.
- Investigate the user account under which the suspicious process was executed to assess if the account has been compromised or is being misused.
- Correlate the event with other security alerts or logs from data sources like Elastic Defend or Microsoft Defender for Endpoint to gather additional context and identify any related malicious activities.
- Correlate the event with other security alerts or logs from data sources like Elastic Defend or Microsoft Defender XDR to gather additional context and identify any related malicious activities.
- Review the system's recent activity and changes, such as new scheduled tasks or services created by schtasks.exe or sc.exe, to identify any persistence mechanisms that may have been established by the attacker.
### False positive analysis
@@ -75,7 +75,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Windows Security Event Logs",
"Data Source: Crowdstrike",
]
rules/windows/command_and_control_tool_transfer_via_curl.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/02/03"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/04/10"
updated_date = "2026/04/20"
[rule]
author = ["Elastic"]
@@ -73,7 +73,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
"Data Source: Sysmon",
rules/windows/command_and_control_tunnel_cloudflared.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2026/03/18"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -64,7 +64,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
"Data Source: Elastic Endgame",
"Data Source: Windows Security Event Logs"
rules/windows/command_and_control_tunnel_vscode.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2024/09/09"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/18"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -39,7 +39,7 @@ Visual Studio Code (VScode) offers a remote tunnel feature enabling developers t
- Check the parent process name to ensure it is not "Code.exe" when the process name is "code-tunnel.exe" with the "status" argument, as this is an exception in the rule.
- Investigate the origin of the process by examining the user account and machine from which the process was initiated to determine if it aligns with expected usage patterns.
- Analyze network logs to identify any unusual or unauthorized connections to GitHub or remote VScode instances that may suggest malicious activity.
- Correlate the event with other security alerts or logs from data sources like Elastic Endgame, Sysmon, or Microsoft Defender for Endpoint to gather additional context on the activity.
- Correlate the event with other security alerts or logs from data sources like Elastic Endgame, Sysmon, or Microsoft Defender XDR to gather additional context on the activity.
- Assess the risk and impact by determining if the system or user account has been involved in previous suspicious activities or if there are any indicators of compromise.
### False positive analysis
@@ -75,7 +75,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Windows Security Event Logs",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
rules/windows/command_and_control_tunnel_yuze.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2026/03/18"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -66,7 +66,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
"Data Source: Elastic Endgame",
"Data Source: Windows Security Event Logs"
rules/windows/command_and_control_velociraptor_shell_execution.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2026/03/18"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -66,7 +66,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
"Data Source: Elastic Endgame",
"Data Source: Windows Security Event Logs"
rules/windows/credential_access_browsers_unusual_parent.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/08/27"
integration = ["windows", "endpoint", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -70,7 +70,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Resources: Investigation Guide",
rules/windows/credential_access_cmdline_dump_tool.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/24"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "system"]
maturity = "production"
updated_date = "2025/09/11"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -75,7 +75,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Sysmon",
]
rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/24"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -125,7 +125,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Sysmon",
"Data Source: Crowdstrike",
rules/windows/credential_access_domain_backup_dpapi_private_keys.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/13"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -43,7 +43,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
]
rules/windows/credential_access_dump_registry_hives.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/23"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -77,7 +77,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Sysmon",
"Data Source: Crowdstrike",
rules/windows/credential_access_generic_localdumps.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2022/08/28"
integration = ["endpoint", "windows", "m365_defender"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -39,7 +39,7 @@ Full user-mode dumps are a diagnostic feature in Windows that captures detailed
- Check for any recent changes to the registry key by examining the modification timestamps and identifying the user or process responsible for the change.
- Investigate the context of the alert by reviewing recent process execution logs to identify any suspicious processes that may have triggered the dump, especially those not matching the legitimate svchost.exe process with user IDs S-1-5-18, S-1-5-19, or S-1-5-20.
- Analyze any generated dump files for sensitive information, such as credentials, and determine if they were accessed or exfiltrated by unauthorized users or processes.
- Correlate the alert with other security events or logs, such as Sysmon or Microsoft Defender for Endpoint, to identify any related suspicious activities or patterns that could indicate a broader attack.
- Correlate the alert with other security events or logs, such as Sysmon or Microsoft Defender XDR, to identify any related suspicious activities or patterns that could indicate a broader attack.
### False positive analysis
@@ -74,7 +74,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Elastic Endgame",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
rules/windows/credential_access_iis_connectionstrings_dumping.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -77,7 +77,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/credential_access_kirbi_file.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/08/23"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -70,7 +70,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Elastic Endgame",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
rules/windows/credential_access_lsass_memdump_file_created.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/24"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -113,7 +113,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
]
timeline_id = "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c"
rules/windows/credential_access_lsass_openprocess_api.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/03/02"
integration = ["endpoint", "m365_defender"]
maturity = "production"
updated_date = "2026/03/02"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -112,7 +112,7 @@ tags = [
"Tactic: Credential Access",
"Tactic: Execution",
"Data Source: Elastic Defend",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Resources: Investigation Guide"
]
timestamp_override = "event.ingested"
rules/windows/credential_access_mimikatz_memssp_default_logs.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/31"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -83,7 +83,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
rules/windows/credential_access_mod_wdigest_security_provider.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/01/19"
integration = ["endpoint", "windows", "m365_defender"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -84,7 +84,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/credential_access_persistence_network_logon_provider_modification.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/03/18"
integration = ["endpoint", "m365_defender", "windows"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -120,7 +120,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
rules/windows/credential_access_rare_webdav_destination.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/04/28"
integration = ["endpoint", "system", "windows", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -46,7 +46,7 @@ tags = [
"Tactic: Credential Access",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
]
rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2022/04/30"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -40,7 +40,7 @@ NTLM, a suite of Microsoft security protocols, is often targeted by adversaries
- Investigate the network connections initiated by the rundll32.exe process to identify any HTTP requests targeting named pipes, such as those containing "/print/pipe/", "/pipe/spoolss", or "/pipe/srvsvc".
- Check the system's event logs for any related authentication attempts or failures around the time of the alert to identify potential NTLM relay activity.
- Analyze the history of the Windows Printer Spooler service on the affected host to determine if it has been recently manipulated or exploited.
- Correlate the alert with other security events or alerts from data sources like Microsoft Defender for Endpoint or Sysmon to identify any related suspicious activities or patterns.
- Correlate the alert with other security events or alerts from data sources like Microsoft Defender XDR or Sysmon to identify any related suspicious activities or patterns.
- Assess the user account associated with the NTLM authentication attempt to determine if it has been compromised or is being used in an unauthorized manner.
### False positive analysis
@@ -77,7 +77,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/credential_access_saved_creds_vaultcmd.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2021/01/19"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "system", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -42,7 +42,7 @@ Windows Credential Manager stores credentials for websites, applications, and ne
- Investigate the parent process of vaultcmd.exe to understand how it was initiated and whether it was triggered by a legitimate application or script.
- Examine recent login activity and network connections from the host to identify any signs of lateral movement or unauthorized access attempts.
- Correlate this event with other security alerts or logs from the same host or user to identify potential patterns of malicious behavior.
- Review endpoint security logs from tools like Microsoft Defender for Endpoint or Crowdstrike for additional context or corroborating evidence of credential access attempts.
- Review endpoint security logs from tools like Microsoft Defender XDR or Crowdstrike for additional context or corroborating evidence of credential access attempts.
### False positive analysis
@@ -76,7 +76,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/12/25"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic", "Austin Songer"]
@@ -102,7 +102,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/credential_access_veeam_commands.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2024/03/14"
integration = ["windows", "endpoint", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -40,7 +40,7 @@ Veeam credentials stored in MSSQL databases are crucial for managing backup oper
- Examine the command line arguments for any references to [VeeamBackup].[dbo].[Credentials] to determine if there was an attempt to access or decrypt Veeam credentials.
- Check the user account associated with the process execution to assess if it is a legitimate user or potentially compromised.
- Investigate the source host for any signs of unauthorized access or suspicious activity, such as unusual login times or failed login attempts.
- Correlate the alert with other security events or logs from data sources like Microsoft Defender for Endpoint or Sysmon to identify any related malicious activities or patterns.
- Correlate the alert with other security events or logs from data sources like Microsoft Defender XDR or Sysmon to identify any related malicious activities or patterns.
- Assess the risk and impact by determining if any Veeam credentials were successfully accessed or exfiltrated, and evaluate the potential for data breaches or ransomware attacks.
### False positive analysis
@@ -73,7 +73,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/credential_access_wbadmin_ntds.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2024/06/05"
integration = ["windows", "endpoint", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -39,7 +39,7 @@ Wbadmin is a Windows utility for backup and recovery, often used by administrato
- Review the process execution details to confirm the presence of wbadmin.exe with the specific arguments related to NTDS.dit, as indicated by the process.command_line field.
- Check the user account associated with the process execution to determine if it belongs to a privileged group such as Backup Operators, which could indicate potential misuse of privileges.
- Investigate the source host identified by host.os.type to determine if it is a domain controller, as this would be a critical factor in assessing the risk of the activity.
- Correlate the event with other security logs or alerts from data sources like Microsoft Defender for Endpoint or Sysmon to identify any related suspicious activities or patterns.
- Correlate the event with other security logs or alerts from data sources like Microsoft Defender XDR or Sysmon to identify any related suspicious activities or patterns.
- Examine recent changes or access attempts to the NTDS.dit file on the domain controller to identify any unauthorized access or modifications.
- Assess the risk score and severity level to prioritize the investigation and determine if immediate response actions are necessary.
@@ -71,7 +71,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/credential_access_wireless_creds_dumping.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2022/11/01"
integration = ["endpoint", "system", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -106,7 +106,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/07/02"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -114,7 +114,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_amsi_bypass_dllhijack.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/01/17"
integration = ["windows", "endpoint", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -111,7 +111,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
rules/windows/defense_evasion_amsienable_key_mod.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/06/01"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -89,7 +89,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
rules/windows/defense_evasion_clearing_windows_console_history.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/11/22"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/02/19"
updated_date = "2026/04/07"
[rule]
author = ["Austin Songer"]
@@ -74,7 +74,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_clearing_windows_event_logs.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -70,7 +70,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_code_signing_policy_modification_builtin_tools.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/01/31"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -104,7 +104,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_code_signing_policy_modification_registry.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/01/31"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -102,7 +102,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
rules/windows/defense_evasion_create_mod_root_certificate.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/02/01"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -85,7 +85,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
]
timestamp_override = "event.ingested"
rules/windows/defense_evasion_defender_disabled_via_registry.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/12/23"
integration = ["endpoint", "windows", "m365_defender"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -71,7 +71,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
]
timestamp_override = "event.ingested"
type = "eql"
rules/windows/defense_evasion_defender_exclusion_via_powershell.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/07/20"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/09/12"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -90,7 +90,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -69,7 +69,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_disable_nla.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2023/08/25"
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -71,7 +71,7 @@ tags = [
"Tactic: Defense Evasion",
"Data Source: Elastic Defend",
"Data Source: Elastic Endgame",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Sysmon",
"Resources: Investigation Guide",
rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2022/01/31"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/02/09"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -112,7 +112,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -67,7 +67,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_disabling_windows_defender_powershell.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/07/07"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/09/12"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -78,7 +78,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_disabling_windows_logs.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/05/06"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/09/12"
updated_date = "2026/04/07"
[rule]
author = ["Elastic", "Ivan Ninichuck", "Austin Songer"]
@@ -72,7 +72,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_dns_over_https_enabled.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/07/22"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2026/04/07"
[rule]
author = ["Austin Songer"]
@@ -72,7 +72,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Resources: Investigation Guide",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_dotnet_compiler_parent_process.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/21"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -72,7 +72,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/10/13"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -73,7 +73,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/07/07"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -69,7 +69,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2021/09/08"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -40,7 +40,7 @@ The Control Panel in Windows is a system utility that allows users to view and a
- Check the parent process of control.exe to determine if it was spawned by a legitimate application or a potentially malicious one.
- Investigate the user account associated with the process to verify if the activity aligns with their typical behavior or if it appears suspicious.
- Examine recent file modifications or creations in directories like \\AppData\\Local\\ or \\Users\\Public\\ to identify any unauthorized or unexpected changes.
- Correlate the event with other security alerts or logs from data sources like Microsoft Defender for Endpoint or Sysmon to gather additional context on the potential threat.
- Correlate the event with other security alerts or logs from data sources like Microsoft Defender XDR or Sysmon to gather additional context on the potential threat.
- Assess the network activity of the host during the time of the alert to identify any unusual outbound connections that may indicate data exfiltration or command and control communication.
### False positive analysis
@@ -73,7 +73,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_execution_lolbas_wuauclt.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/10/13"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -115,7 +115,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/03/25"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -95,7 +95,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2020/03/25"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -41,7 +41,7 @@ The Microsoft Build Engine (MSBuild) is a platform for building applications, ty
- Check the command line arguments used to start MSBuild.exe for any suspicious or unusual parameters that could indicate malicious activity.
- Investigate the user account associated with the process to determine if it aligns with expected behavior or if it might be compromised.
- Examine recent file modifications or creations in directories commonly used by MSBuild to identify any unauthorized or unexpected files.
- Correlate the event with other security alerts or logs from data sources like Microsoft Defender for Endpoint or Sysmon to gather additional context on the activity.
- Correlate the event with other security alerts or logs from data sources like Microsoft Defender XDR or Sysmon to gather additional context on the activity.
- Assess the network activity of the host during the time of the alert to identify any potential data exfiltration or communication with known malicious IP addresses.
### False positive analysis
@@ -73,7 +73,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_execution_msbuild_started_renamed.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/03/25"
integration = ["endpoint", "windows", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -112,7 +112,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2020/09/03"
integration = ["endpoint", "windows", "m365_defender", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/09/11"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -39,7 +39,7 @@ DLL side-loading exploits the DLL search order to load malicious code into trust
- Investigate the process execution path to determine if it deviates from the standard paths listed in the query, such as "?:\\Windows\\explorer.exe" or "?:\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE".
- Examine the process creation history and parent process to identify any unusual or suspicious parent-child relationships that might indicate malicious activity.
- Check for any recent file modifications or creations in the directory from which the process was executed, which could suggest the presence of a malicious DLL.
- Correlate the event with other security logs or alerts from data sources like Elastic Endgame, Elastic Defend, Sysmon, or Microsoft Defender for Endpoint to gather additional context and identify potential patterns of malicious behavior.
- Correlate the event with other security logs or alerts from data sources like Elastic Endgame, Elastic Defend, Sysmon, or Microsoft Defender XDR to gather additional context and identify potential patterns of malicious behavior.
- Assess the risk and impact of the event by considering the risk score and severity level provided, and determine if immediate containment or further investigation is necessary.
### False positive analysis
@@ -71,7 +71,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Resources: Investigation Guide",
"Data Source: Crowdstrike",
"Data Source: SentinelOne",
rules/windows/defense_evasion_execution_windefend_unusual_path.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/07/07"
integration = ["endpoint", "windows", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic", "Dennis Perto"]
@@ -72,7 +72,7 @@ tags = [
"Tactic: Execution",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
]
rules/windows/defense_evasion_file_creation_mult_extension.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/01/19"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -69,7 +69,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Resources: Investigation Guide",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_from_unusual_directory.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/10/30"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/05/05"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -120,7 +120,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Resources: Investigation Guide",
rules/windows/defense_evasion_hide_encoded_executable_registry.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/25"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -38,7 +38,7 @@ Windows Registry is a hierarchical database storing low-level settings for the O
- Analyze the encoded data string "TVqQAAMAAAAEAAAA*" to determine if it corresponds to a known malicious executable or pattern.
- Check the modification timestamp to correlate with any other suspicious activities or events on the system around the same time.
- Investigate the process or user account responsible for the registry modification to assess if it is associated with legitimate activity or known threats.
- Cross-reference the alert with other data sources such as Sysmon, Microsoft Defender for Endpoint, or SentinelOne for additional context or corroborating evidence of malicious behavior.
- Cross-reference the alert with other data sources such as Sysmon, Microsoft Defender XDR, or SentinelOne for additional context or corroborating evidence of malicious behavior.
- Evaluate the system's network activity and connections during the time of the registry modification to identify any potential command and control communications or data exfiltration attempts.
### False positive analysis
@@ -69,7 +69,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
]
rules/windows/defense_evasion_iis_httplogging_disabled.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/04/14"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -71,7 +71,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_indirect_exec_conhost.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/08/21"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -62,7 +62,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_indirect_exec_forfiles.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/02/03"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/12/11"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -62,7 +62,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_indirect_exec_openssh.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/08/21"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/30"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -62,7 +62,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_lolbas_win_cdb_utility.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2024/07/24"
integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -70,7 +70,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
"Data Source: Windows Security Event Logs",
"Resources: Investigation Guide",
rules/windows/defense_evasion_lsass_ppl_disabled_registry.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/05/27"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -73,7 +73,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/24"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -39,7 +39,7 @@ Endpoint security solutions, like Elastic and Microsoft Defender, monitor and pr
- Examine the parent process executable path and name to determine if it is a known legitimate process or potentially malicious. Pay special attention to paths not listed in the known benign paths, such as those outside "?:\\Program Files\\Elastic\\*" or "?:\\Windows\\System32\\*".
- Investigate the command-line arguments used by the parent process to identify any unusual or suspicious patterns that could indicate malicious activity, especially if they do not match the benign arguments like "test", "version", or "status".
- Check the historical activity of the parent process to see if it has been involved in other suspicious activities or if it has a history of spawning security-related processes.
- Correlate the alert with other security events or logs from data sources like Elastic Endgame, Microsoft Defender for Endpoint, or Sysmon to gather additional context and identify any related suspicious activities.
- Correlate the alert with other security events or logs from data sources like Elastic Endgame, Microsoft Defender XDR, or Sysmon to gather additional context and identify any related suspicious activities.
- Assess the risk and impact of the alert by considering the environment, the criticality of the affected systems, and any potential data exposure or operational disruption.
### False positive analysis
@@ -70,7 +70,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Resources: Investigation Guide",
rules/windows/defense_evasion_masquerading_renamed_autoit.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2020/09/01"
integration = ["endpoint", "windows", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[transform]
[[transform.osquery]]
@@ -110,7 +110,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike"
]
timestamp_override = "event.ingested"
rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2020/08/24"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -39,7 +39,7 @@ WerFault.exe is a Windows error reporting tool that handles application crashes.
- Investigate the network connections established by the suspicious process to identify any unusual or unauthorized external communications.
- Analyze file writes and modifications made by the process to detect any unauthorized changes or potential indicators of compromise.
- Check the parent process tree to understand the context of how WerFault.exe was invoked and identify any preceding suspicious activities or processes.
- Correlate the event with other security alerts or logs from data sources like Elastic Endgame, Elastic Defend, Microsoft Defender for Endpoint, Sysmon, or SentinelOne to gather additional context and assess the scope of the potential threat.
- Correlate the event with other security alerts or logs from data sources like Elastic Endgame, Elastic Defend, Microsoft Defender XDR, Sysmon, or SentinelOne to gather additional context and assess the scope of the potential threat.
### False positive analysis
@@ -75,7 +75,7 @@ tags = [
"Tactic: Privilege Escalation",
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Resources: Investigation Guide",
rules/windows/defense_evasion_masquerading_trusted_directory.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2020/11/18"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/02/19"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -40,7 +40,7 @@ The Program Files directories in Windows are trusted locations for legitimate so
- Review the process executable path to confirm if it matches any known masquerading patterns, such as unexpected directories containing "Program Files" in their path.
- Check the parent process of the suspicious executable to determine how it was launched and assess if the parent process is legitimate or potentially malicious.
- Investigate the user account associated with the process execution to determine if it has low privileges and if the activity aligns with typical user behavior.
- Correlate the event with other security logs or alerts from data sources like Microsoft Defender for Endpoint or Sysmon to identify any related suspicious activities or patterns.
- Correlate the event with other security logs or alerts from data sources like Microsoft Defender XDR or Sysmon to identify any related suspicious activities or patterns.
- Examine the file hash of the executable to see if it matches known malware signatures or if it has been flagged in threat intelligence databases.
- Assess the network activity associated with the process to identify any unusual outbound connections that could indicate data exfiltration or command-and-control communication.
@@ -72,7 +72,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_microsoft_defender_tampering.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/10/18"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Austin Songer"]
@@ -83,7 +83,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Elastic Endgame",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_modify_ownership_os_files.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/09/01"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/09/02"
updated_date = "2026/04/07"
[rule]
@@ -68,7 +68,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_ms_office_suspicious_regmod.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2022/01/12"
integration = ["windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -81,7 +81,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Endgame",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
]
rules/windows/defense_evasion_mshta_susp_child.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/08/19"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -72,7 +72,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_msiexec_remote_payload.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/08/19"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -70,7 +70,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_ntlm_downgrade.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/04/14"
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows", "crowdstrike"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -63,7 +63,7 @@ tags = [
"Tactic: Defense Evasion",
"Data Source: Elastic Defend",
"Data Source: Elastic Endgame",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Sysmon",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_obf_args_unicode_modified_letters.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/11/13"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/11/13"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -70,7 +70,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2022/11/01"
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -39,7 +39,7 @@ The LocalAccountTokenFilterPolicy is a Windows registry setting that, when enabl
- Identify the user account and process responsible for the registry modification by examining the associated event logs for user and process information.
- Check for any recent remote connections to the affected system, focusing on connections initiated by local administrator accounts, to determine if the change was exploited for lateral movement.
- Investigate any other recent registry changes on the host to identify potential patterns of unauthorized modifications that could indicate broader malicious activity.
- Correlate the event with other security alerts or logs from data sources like Elastic Endgame, Elastic Defend, Sysmon, SentinelOne, or Microsoft Defender for Endpoint to gather additional context and assess the scope of the potential threat.
- Correlate the event with other security alerts or logs from data sources like Elastic Endgame, Elastic Defend, Sysmon, SentinelOne, or Microsoft Defender XDR to gather additional context and assess the scope of the potential threat.
- Assess the system for signs of compromise or malicious activity, such as unusual processes, network connections, or file modifications, that may have occurred around the time of the registry change.
### False positive analysis
@@ -76,7 +76,7 @@ tags = [
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
]
rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2021/10/15"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/09/12"
updated_date = "2026/04/07"
[rule]
author = ["Austin Songer"]
@@ -84,7 +84,7 @@ tags = [
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Windows Security Event Logs",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_proxy_execution_via_msdt.toml
+3 -3
View File
@@ -2,7 +2,7 @@
creation_date = "2022/05/31"
integration = ["endpoint", "windows", "m365_defender", "crowdstrike", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -38,7 +38,7 @@ The Microsoft Diagnostics Troubleshooting Wizard (MSDT) is a legitimate tool use
- Examine the parent process of msdt.exe to determine if it was launched by an unexpected or potentially malicious process like cmd.exe, powershell.exe, or mshta.exe.
- Check the file path of the msdt.exe executable to ensure it matches the standard locations (?:\\Windows\\system32\\msdt.exe or ?:\\Windows\\SysWOW64\\msdt.exe) and investigate any deviations.
- Investigate the user account associated with the process execution to determine if the activity aligns with their typical behavior or if it appears suspicious.
- Correlate the event with other security alerts or logs from data sources like Microsoft Defender for Endpoint or Sysmon to identify any related malicious activities or patterns.
- Correlate the event with other security alerts or logs from data sources like Microsoft Defender XDR or Sysmon to identify any related malicious activities or patterns.
- Assess the risk score and severity of the alert to prioritize the investigation and determine if immediate action is required to mitigate potential threats.
### False positive analysis
@@ -72,7 +72,7 @@ tags = [
"Tactic: Defense Evasion",
"Data Source: Elastic Endgame",
"Data Source: Elastic Defend",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: Sysmon",
"Data Source: Crowdstrike",
"Data Source: SentinelOne",
rules/windows/defense_evasion_reg_disable_enableglobalqueryblocklist.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2024/05/31"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -74,7 +74,7 @@ tags = [
"Tactic: Defense Evasion",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Elastic Endgame",
"Data Source: Crowdstrike",
rules/windows/defense_evasion_regmod_remotemonologue.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/04/14"
integration = ["endpoint", "m365_defender", "sentinel_one_cloud_funnel", "windows"]
maturity = "production"
updated_date = "2026/03/24"
updated_date = "2026/04/07"
[rule]
author = ["Elastic"]
@@ -61,7 +61,7 @@ tags = [
"Tactic: Defense Evasion",
"Data Source: Elastic Defend",
"Data Source: Elastic Endgame",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: Microsoft Defender XDR",
"Data Source: SentinelOne",
"Data Source: Sysmon",
"Resources: Investigation Guide",

Some files were not shown because too many files have changed in this diff Show More