[Rules Tuning] Add support for Sysmon ImageLoad Events (#2215)

* [Rules Tuning] Add support for Sysmon ImageLoad Events

added correct event.category and event.action to rules using library events to support sysmon eventid 7.

`event.category == "library"` --> `(event.category == "process" and event.action : "Image loaded*")`

`dll.name` --> `file.name`

* added Suspicious RDP ActiveX Client Loaded

* Delete workspace.xml

(cherry picked from commit 50bb821708)

rules/windows/credential_access_credential_dumping_msbuild.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/03/25"
 maturity = "production"
-updated_date = "2022/07/05"
+updated_date = "2022/08/02"
 
 [rule]
 author = ["Elastic"]
@@ -83,7 +83,8 @@ type = "eql"
 query = '''
 sequence by process.entity_id
  [process where event.type == "start" and (process.name : "MSBuild.exe" or process.pe.original_file_name == "MSBuild.exe")]
- [library where dll.name : ("vaultcli.dll", "SAMLib.DLL")]
+ [any where (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+  (dll.name : ("vaultcli.dll", "SAMLib.DLL") or file.name : ("vaultcli.dll", "SAMLib.DLL"))]
 '''
 
 

rules/windows/defense_evasion_suspicious_wmi_script.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/09/02"
 maturity = "production"
-updated_date = "2021/03/03"
+updated_date = "2022/08/02"
 
 [rule]
 author = ["Elastic"]
@@ -26,7 +26,8 @@ sequence by process.entity_id with maxspan = 2m
    (process.name : "WMIC.exe" or process.pe.original_file_name : "wmic.exe") and
    process.args : ("format*:*", "/format*:*", "*-format*:*") and
    not process.command_line : "* /format:table *"]
-[library where event.type == "start" and dll.name : ("jscript.dll", "vbscript.dll")]
+[any where (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+ (dll.name : ("jscript.dll", "vbscript.dll") or file.name : ("jscript.dll", "vbscript.dll"))]
 '''
 
 

rules/windows/execution_scheduled_task_powershell_source.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/12/15"
 maturity = "production"
-updated_date = "2021/10/17"
+updated_date = "2022/08/02"
 
 [rule]
 author = ["Elastic"]
@@ -26,7 +26,8 @@ type = "eql"
 
 query = '''
 sequence by host.id, process.entity_id with maxspan = 5s
- [library where dll.name : "taskschd.dll" and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe")]
+ [any where (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+  (dll.name : "taskschd.dll" or file.name : "taskschd.dll") and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe")]
  [network where process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and destination.port == 135 and not destination.address in ("127.0.0.1", "::1")]
 '''
 

rules/windows/execution_suspicious_image_load_wmi_ms_office.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/11/17"
 maturity = "production"
-updated_date = "2022/03/31"
+updated_date = "2022/08/02"
 
 [rule]
 author = ["Elastic"]
@@ -30,10 +30,10 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-library where process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and
-  event.action : "load" and
-  event.category : "library" and
-  dll.name : "wmiutils.dll"
+any where
+ (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+  process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and
+  (dll.name : "wmiutils.dll" or file.name : "wmiutils.dll")
 '''
 
 

rules/windows/execution_suspicious_powershell_imgload.toml

@@ -3,7 +3,7 @@ creation_date = "2020/11/17"
 maturity = "production"
 min_stack_comments = "EQL regex syntax introduced in 7.12"
 min_stack_version = "7.12.0"
-updated_date = "2022/05/21"
+updated_date = "2022/08/02"
 
 [rule]
 author = ["Elastic"]
@@ -100,7 +100,10 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-library where dll.name : ("System.Management.Automation.ni.dll", "System.Management.Automation.dll") and
+any where (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+ (dll.name : ("System.Management.Automation.ni.dll", "System.Management.Automation.dll") or
+  file.name : ("System.Management.Automation.ni.dll", "System.Management.Automation.dll")) and
+
 /* add false positives relevant to your environment here */
 not process.executable : ("C:\\Windows\\System32\\RemoteFXvGPUDisablement.exe", "C:\\Windows\\System32\\sdiagnhost.exe") and
 not process.executable regex~ """C:\\Program Files( \(x86\))?\\*\.exe""" and

rules/windows/initial_access_scripts_process_started_via_wmi.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/11/27"
 maturity = "production"
-updated_date = "2021/03/08"
+updated_date = "2022/08/02"
 
 [rule]
 author = ["Elastic"]
@@ -22,7 +22,8 @@ type = "eql"
 
 query = '''
 sequence by host.id with maxspan = 5s
-    [library where dll.name : "wmiutils.dll" and process.name : ("wscript.exe", "cscript.exe")]
+    [any where (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+     (dll.name : "wmiutils.dll" or file.name : "wmiutils.dll") and process.name : ("wscript.exe", "cscript.exe")]
     [process where event.type in ("start", "process_started") and
      process.parent.name : "wmiprvse.exe" and
      user.domain != "NT AUTHORITY" and

rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/11/19"
 maturity = "production"
-updated_date = "2022/03/31"
+updated_date = "2022/08/02"
 
 [rule]
 author = ["Elastic"]
@@ -27,7 +27,8 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-library where dll.name : "mstscax.dll" and
+any where (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+ (dll.name : "mstscax.dll" or file.name : "mstscax.dll") and
    /* depending on noise in your env add here extra paths  */
   process.executable :
     (

rules/windows/persistence_local_scheduled_task_scripting.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/11/29"
 maturity = "production"
-updated_date = "2021/10/17"
+updated_date = "2022/08/02"
 
 [rule]
 author = ["Elastic"]
@@ -26,7 +26,9 @@ type = "eql"
 
 query = '''
 sequence by host.id with maxspan = 30s
-  [library where dll.name : "taskschd.dll" and process.name : ("cscript.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe")]
+  [any where (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+   (dll.name : "taskschd.dll" or file.name : "taskschd.dll") and
+   process.name : ("cscript.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe")]
   [registry where registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\*\\Actions"]
 '''
 

rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/11/17"
 maturity = "production"
-updated_date = "2022/03/31"
+updated_date = "2022/08/02"
 
 [rule]
 author = ["Elastic"]
@@ -32,10 +32,10 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-library where process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and
-  event.action : "load" and
-  event.category : "library" and
-  dll.name : "taskschd.dll"
+any where
+ (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+  process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and
+  (dll.name : "taskschd.dll" or file.name : "taskschd.dll")
 '''