security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] Windows 3rd Party EDR Compatibility - Part 9 (#5024)

Browse Source
This commit is contained in:
Jonhnathan
2025-08-28 12:15:25 -07:00
committed by GitHub
parent be18b4db16
commit 9c08869575
5 changed files with 26 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/defense_evasion_wsl_registry_modification.toml
+4 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2023/01/12"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/26"
[rule]
author = ["Elastic"]
@@ -18,6 +18,7 @@ index = [
"endgame-*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -73,6 +74,7 @@ tags = [
"Data Source: Sysmon",
"Data Source: Microsoft Defender for Endpoint",
"Data Source: SentinelOne",
"Data Source: Crowdstrike",
"Resources: Investigation Guide",
]
timeline_id = "3e47ef71-ebfc-4520-975c-cb27fc090799"
rules/windows/execution_command_prompt_connecting_to_the_internet.toml
+4 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/26"
[transform]
[[transform.osquery]]
@@ -48,6 +48,7 @@ index = [
"logs-endpoint.events.process-*",
"logs-endpoint.events.network-*",
"logs-windows.sysmon_operational-*",
"logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
@@ -118,6 +119,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
]
type = "eql"
rules/windows/execution_html_help_executable_program_connecting_to_the_internet.toml
+4 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/26"
[transform]
[[transform.osquery]]
@@ -43,6 +43,7 @@ index = [
"logs-endpoint.events.process-*",
"logs-endpoint.events.network-*",
"logs-windows.sysmon_operational-*",
"logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
@@ -120,6 +121,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
]
type = "eql"
rules/windows/execution_powershell_susp_args_via_winscript.toml
+10 -6
View File
@@ -1,12 +1,12 @@
[metadata]
creation_date = "2024/09/09"
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender"]
integration = ["windows", "system", "sentinel_one_cloud_funnel", "m365_defender", "crowdstrike"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/26"
[rule]
author = ["Elastic"]
description = "Identifies PowerShell.exe or Cmd.exe execution spawning from Windows Script Host processes Wscript.exe.\n"
description = "Identifies PowerShell.exe or Cmd.exe execution spawning from Windows Script Host processes Wscript.exe."
from = "now-9m"
index = [
"logs-m365_defender.event-*",
@@ -15,6 +15,8 @@ index = [
"logs-windows.forwarded*",
"logs-windows.sysmon_operational-*",
"winlogbeat-*",
"endgame-*",
"logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
@@ -61,19 +63,21 @@ tags = [
"OS: Windows",
"Use Case: Threat Detection",
"Tactic: Execution",
"Resources: Investigation Guide",
"Data Source: Windows Security Event Logs",
"Data Source: Sysmon",
"Data Source: SentinelOne",
"Data Source: Microsoft Defender for Endpoint",
"Resources: Investigation Guide",
"Data Source: Elastic Endgame",
"Data Source: Crowdstrike",
]
timestamp_override = "event.ingested"
type = "eql"
query = '''
process where host.os.type == "windows" and event.action == "start" and
process where host.os.type == "windows" and event.type == "start" and
process.name : ("powershell.exe", "pwsh.exe", "cmd.exe") and
process.parent.name : ("wscript.exe", "mshta.exe") and ?process.parent.args : "?:\\Users\\*"
process.parent.name : ("wscript.exe", "mshta.exe")
'''
rules/windows/execution_psexec_lateral_movement_command.toml
+4 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2020/02/18"
integration = ["endpoint", "windows"]
integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/03/20"
updated_date = "2025/08/26"
[rule]
author = ["Elastic"]
@@ -22,6 +22,7 @@ index = [
"logs-endpoint.events.process-*",
"logs-endpoint.events.network-*",
"logs-windows.sysmon_operational-*",
"logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
@@ -70,6 +71,7 @@ tags = [
"Resources: Investigation Guide",
"Data Source: Elastic Defend",
"Data Source: Sysmon",
"Data Source: SentinelOne",
]
type = "eql"