Skip to content

[Rule Tuning] Windows High-Severity Rules Revamp - Final#6038

Merged
w0rk3r merged 4 commits into
mainfrom
revamp_final
May 12, 2026
Merged

[Rule Tuning] Windows High-Severity Rules Revamp - Final#6038
w0rk3r merged 4 commits into
mainfrom
revamp_final

Conversation

@w0rk3r

@w0rk3r w0rk3r commented May 4, 2026

Copy link
Copy Markdown
Contributor

Issues

Part of https://github.com/elastic/ia-trade-team/issues/619
Part of https://github.com/elastic/ia-trade-team/issues/844
Part of https://github.com/elastic/ia-trade-team/issues/205
Part of https://github.com/elastic/ia-trade-team/issues/636

Summary

This PR fixes/improves our Windows rules by:

  • Improving our investigation guides to be question-driven and actionable, with clear pivots and specific information vs our old checklists
  • Adding Investigate Timeline plugins to help analysts quickly pivot into related alerts, authentication events, file activity, child processes, network activity, directory-service changes, and follow-on Windows Security events
  • Adding setup guides
  • Adding Highlighted fields
  • Fixing/Improving metadata where needed (Description, Mitre tags, references)
  • Improving the order of the fields, so the most relevant information (Name, description, query) are visible without scrolling down too much
  • Tunings where needed (Expand logic, exclude FPs, etc.)

Screenshots / Sample

Highlighted Fields:
image

Investigation Guides: Investigate Plugin

image image

Clicking the investigation plugins launches Timeline with field values populated dynamically from alert fields.

image image

@w0rk3r w0rk3r self-assigned this May 4, 2026
@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint backport: auto labels May 4, 2026
@github-actions

github-actions Bot commented May 4, 2026

Copy link
Copy Markdown
Contributor

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic

tradebot-elastic commented May 4, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ Process Created with an Elevated Token (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Escalation via Vulnerable MSI Repair (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Privileges Elevation via Parent Process PID Spoofing (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ UAC Bypass Attempt via Windows Directory Masquerading (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bypass UAC via Event Viewer (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Privilege Escalation via Named Pipe Impersonation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Windows Service Installed via an Unusual Client (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ UAC Bypass via ICMLuaUtil Elevated COM Interface (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Remote Computer Account DnsHostName Update (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SeIncreaseBasePriorityPrivilege Use (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Privilege Escalation via Rogue Named Pipe Impersonation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface (eql)
  • ❌ Suspicious Print Spooler Point and Print DLL (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Potential Privileged Escalation via SamAccountName Spoofing (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Privilege Escalation via Windir Environment Variable (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic

tradebot-elastic commented May 4, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ Process Created with an Elevated Token (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Escalation via Vulnerable MSI Repair (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Privileges Elevation via Parent Process PID Spoofing (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ UAC Bypass Attempt via Windows Directory Masquerading (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bypass UAC via Event Viewer (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Privilege Escalation via Named Pipe Impersonation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Windows Service Installed via an Unusual Client (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ UAC Bypass via ICMLuaUtil Elevated COM Interface (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Remote Computer Account DnsHostName Update (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SeIncreaseBasePriorityPrivilege Use (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Privilege Escalation via Rogue Named Pipe Impersonation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface (eql)
  • ❌ Suspicious Print Spooler Point and Print DLL (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Potential Privileged Escalation via SamAccountName Spoofing (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Privilege Escalation via Windir Environment Variable (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Aegrah
Aegrah approved these changes May 4, 2026
View reviewed changes
Comment thread rules/windows/privilege_escalation_suspicious_dnshostname_update.toml
[transform]

[[transform.investigate]]
label = "Alerts associated with the modifying user in the surrounding window"

@Aegrah Aegrah May 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No host alert investigation?

@w0rk3r w0rk3r May 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The host information here is (at least most of the time) the DC-one, so it wouldn't be a good pivot I think

@w0rk3r w0rk3r May 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The host information here is (at least most of the time) the DC-one, so it wouldn't be a good pivot I think

@tradebot-elastic

tradebot-elastic commented May 4, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ Process Created with an Elevated Token (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Escalation via Vulnerable MSI Repair (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Privileges Elevation via Parent Process PID Spoofing (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ UAC Bypass Attempt via Windows Directory Masquerading (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bypass UAC via Event Viewer (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Privilege Escalation via Named Pipe Impersonation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Windows Service Installed via an Unusual Client (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ UAC Bypass via ICMLuaUtil Elevated COM Interface (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Remote Computer Account DnsHostName Update (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious SeIncreaseBasePriorityPrivilege Use (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Privilege Escalation via Rogue Named Pipe Impersonation (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ✅ UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface (eql)
  • ❌ Suspicious Print Spooler Point and Print DLL (eql)
    • stack_validation_failed: no_alerts - 0 alerts
  • ❌ Potential Privileged Escalation via SamAccountName Spoofing (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Privilege Escalation via Windir Environment Variable (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic

tradebot-elastic commented May 12, 2026 •
edited
Loading

Copy link
Copy Markdown

⛔️ Test failed

Results
  • ❌ Process Created with an Elevated Token (eql)
    • coverage_issue: no_rta
    • validation_missing: No tests ran
  • ❌ Potential Escalation via Vulnerable MSI Repair (eql)
    • coverage_issue: no_rta
    • validation_missing: No tests ran
  • ❌ Privileges Elevation via Parent Process PID Spoofing (eql)
    • coverage_issue: no_rta
    • validation_missing: No tests ran
  • ❌ UAC Bypass Attempt via Windows Directory Masquerading (eql)
    • coverage_issue: no_rta
    • validation_missing: No tests ran
  • ❌ Bypass UAC via Event Viewer (eql)
    • validation_missing: No tests ran
  • ❌ Privilege Escalation via Named Pipe Impersonation (eql)
    • coverage_issue: no_rta
    • validation_missing: No tests ran
  • ❌ Windows Service Installed via an Unusual Client (eql)
    • coverage_issue: no_rta
    • validation_missing: No tests ran
  • ❌ UAC Bypass via ICMLuaUtil Elevated COM Interface (eql)
    • coverage_issue: no_rta
    • validation_missing: No tests ran
  • ❌ Remote Computer Account DnsHostName Update (eql)
    • coverage_issue: no_rta
    • validation_missing: No tests ran
  • ❌ Suspicious SeIncreaseBasePriorityPrivilege Use (kuery)
    • coverage_issue: no_rta
    • validation_missing: No tests ran
  • ❌ Privilege Escalation via Rogue Named Pipe Impersonation (eql)
    • coverage_issue: no_rta
    • validation_missing: No tests ran
  • ❌ UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface (eql)
    • validation_missing: No tests ran
  • ❌ Suspicious Print Spooler Point and Print DLL (eql)
    • validation_missing: No tests ran
  • ❌ Potential Privileged Escalation via SamAccountName Spoofing (eql)
    • coverage_issue: no_rta
    • validation_missing: No tests ran
  • ❌ Privilege Escalation via Windir Environment Variable (eql)
    • coverage_issue: no_rta
    • validation_missing: No tests ran

@w0rk3r w0rk3r merged commit edd6b77 into main May 12, 2026
13 checks passed
@w0rk3r w0rk3r deleted the revamp_final branch May 12, 2026 19:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Aegrah Aegrah Aegrah approved these changes
@terrancedejesus terrancedejesus terrancedejesus approved these changes
@Mikaayenson Mikaayenson Awaiting requested review from Mikaayenson
@imays11 imays11 Awaiting requested review from imays11
@Samirbous Samirbous Awaiting requested review from Samirbous
@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic
@eric-forte-elastic eric-forte-elastic Awaiting requested review from eric-forte-elastic

Assignees

@w0rk3r w0rk3r

Labels

backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@w0rk3r @tradebot-elastic @Aegrah @terrancedejesus @Mikaayenson