[Rule Tuning] Adapt Rules to work with Sysmon

rules/windows/command_and_control_tool_transfer_via_curl.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/02/03"
 integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
 maturity = "production"
-updated_date = "2025/02/21"
+updated_date = "2025/02/22"
 min_stack_version = "8.14.0"
 min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 
@@ -75,19 +75,35 @@ tags = [
  "Data Source: Elastic Defend",
  "Data Source: Windows Security Event Logs",
  "Data Source: Microsoft Defender for Endpoint",
- "Data Source: Sysmon",
  "Data Source: SentinelOne",
  "Data Source: Crowdstrike",
+ "Data Source: Sysmon",
  "Resources: Investigation Guide",
 ]
 timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-process where host.os.type == "windows" and event.type == "start" and user.id != "S-1-5-18" and
- process.executable : ("?:\\Windows\\System32\\curl.exe", "?:\\Windows\\SysWOW64\\curl.exe") and
- process.command_line : "*http*" and
- process.parent.name : ("cmd.exe", "powershell.exe", "rundll32.exe", "explorer.exe", "conhost.exe", "forfiles.exe", "wscript.exe", "cscript.exe", "mshta.exe", "hh.exe", "mmc.exe")
+process where host.os.type == "windows" and event.type == "start" and
+ process.executable : (
+ "?:\\Windows\\System32\\curl.exe",
+ "?:\\Windows\\SysWOW64\\curl.exe"
+ ) and
+ process.command_line : "*http*" and
+ process.parent.name : (
+ "cmd.exe", "powershell.exe",
+ "rundll32.exe", "explorer.exe",
+ "conhost.exe", "forfiles.exe",
+ "wscript.exe", "cscript.exe",
+ "mshta.exe", "hh.exe", "mmc.exe"
+ ) and 
+ not (
+ user.id == "S-1-5-18" and
+ /* Don't apply the user.id exclusion to Sysmon for compatibility */
+ not event.dataset : ("windows.sysmon_operational", "windows.sysmon")
+ ) and
+ /* Exclude System Integrity Processes for Sysmon */
+ not ?winlog.event_data.IntegrityLevel == "System"
 '''
 
 

rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml

@@ -2,7 +2,7 @@
 creation_date = "2022/05/31"
 integration = ["endpoint", "windows", "system", "m365_defender", "crowdstrike"]
 maturity = "production"
-updated_date = "2025/02/21"
+updated_date = "2025/02/22"
 min_stack_version = "8.14.0"
 min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 
@@ -81,8 +81,8 @@ tags = [
  "Data Source: Elastic Defend",
  "Data Source: Windows Security Event Logs",
  "Data Source: Microsoft Defender for Endpoint",
- "Data Source: Sysmon",
  "Data Source: Crowdstrike",
+ "Data Source: Sysmon",
 ]
 timestamp_override = "event.ingested"
 type = "eql"
@@ -94,8 +94,12 @@ process where host.os.type == "windows" and event.type == "start" and
  "/LSAQUERYFTI:*", "/PARENTDOMAIN",
  "/DOMAIN_TRUSTS", "/BDC_QUERY:*"
  ) and 
-not process.parent.name : "PDQInventoryScanner.exe" and 
-not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
+not process.parent.name : "PDQInventoryScanner.exe" and
+not (
+ user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+ /* Don't apply the user.id exclusion to Sysmon for compatibility */
+ not event.dataset : ("windows.sysmon_operational", "windows.sysmon")
+)
 '''
 
 

rules/windows/discovery_whoami_command_activity.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 integration = ["endpoint", "system", "windows", "m365_defender"]
 maturity = "production"
-updated_date = "2025/02/21"
+updated_date = "2025/02/22"
 min_stack_version = "8.14.0"
 min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 
@@ -75,8 +75,8 @@ tags = [
  "Data Source: Elastic Endgame",
  "Data Source: Elastic Defend",
  "Data Source: Microsoft Defender for Endpoint",
- "Data Source: Windows Security Event Logs",
  "Data Source: Sysmon",
+ "Data Source: Windows Security Event Logs"
 ]
 timestamp_override = "event.ingested"
 type = "eql"
@@ -87,9 +87,15 @@ process where host.os.type == "windows" and event.type == "start" and process.na
  (
  /* scoped for whoami execution under system privileges */
  (
- user.domain : ("NT *", "* NT", "IIS APPPOOL") and
- user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20", "S-1-5-82-*") and
- not ?winlog.event_data.SubjectUserName : "*$"
+ (
+ user.domain : ("NT *", "* NT", "IIS APPPOOL") and
+ user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20", "S-1-5-82-*") and
+ not ?winlog.event_data.SubjectUserName : "*$" and
+
+ /* Sysmon will always populate user.id as S-1-5-18, leading to FPs */
+ not event.dataset : ("windows.sysmon_operational", "windows.sysmon")
+ ) or
+ (?process.Ext.token.integrity_level_name : "System" or ?winlog.event_data.IntegrityLevel : "System")
  ) and
  not (
  process.parent.name : "cmd.exe" and

rules/windows/lateral_movement_incoming_wmi.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/11/15"
 integration = ["endpoint", "windows"]
 maturity = "production"
-updated_date = "2025/01/15"
+updated_date = "2025/02/22"
 min_stack_version = "8.14.0"
 min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 
@@ -13,12 +13,7 @@ Identifies processes executed via Windows Management Instrumentation (WMI) on a
 adversary lateral movement, but could be noisy if administrators use WMI to remotely manage hosts.
 """
 from = "now-9m"
-index = [
- "logs-endpoint.events.process-*",
- "logs-endpoint.events.network-*",
- "winlogbeat-*",
- "logs-windows.sysmon_operational-*",
-]
+index = ["logs-endpoint.events.process-*", "logs-endpoint.events.network-*", "logs-windows.sysmon_operational-*"]
 language = "eql"
 license = "Elastic License v2"
 name = "WMI Incoming Lateral Movement"
@@ -49,7 +44,11 @@ sequence by host.id with maxspan = 2s
 
  [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "WmiPrvSE.exe" and
  not (?process.Ext.token.integrity_level_name : "System" or ?winlog.event_data.IntegrityLevel : "System") and
- not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+ not (
+ user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+ /* Don't apply the user.id exclusion to Sysmon for compatibility */
+ not event.dataset : ("windows.sysmon_operational", "windows.sysmon")
+ ) and
  not process.executable :
  ("?:\\Program Files\\HPWBEM\\Tools\\hpsum_swdiscovery.exe",
  "?:\\Windows\\CCM\\Ccm32BitLauncher.exe",