From 019615b7954c4f52cca7de14590e1c20add43b1b Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 27 Jul 2026 19:01:23 +0200 Subject: [PATCH 01/19] fix(rules): Reduce Suspicious access to Windows Credential Manager files FPs --- ...ial_access_suspicious_access_to_windows_manager_files.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/credential_access_suspicious_access_to_windows_manager_files.yml b/rules/credential_access_suspicious_access_to_windows_manager_files.yml index e3b98ca87..f423c4f20 100644 --- a/rules/credential_access_suspicious_access_to_windows_manager_files.yml +++ b/rules/credential_access_suspicious_access_to_windows_manager_files.yml @@ -1,6 +1,6 @@ name: Suspicious access to Windows Credential Manager files id: 4ab688f7-94e2-481b-9c7f-c49f3a79a379 -version: 1.0.4 +version: 1.0.5 description: | Identifies suspicious processes trying to acquire credentials from the Windows Credential Manager. labels: @@ -25,7 +25,8 @@ condition: > ( '?:\\Program Files\\*', '?:\\Program Files(x86)\\*', - '?:\\Windows\\System32\\lsass.exe' + '?:\\Windows\\System32\\lsass.exe', + '?:\\Windows\\system32\\svchost.exe' ) min-engine-version: 3.0.0 From 9397b10790416fbf9ebd3a22b70935c28a701165 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 27 Jul 2026 21:26:18 +0200 Subject: [PATCH 02/19] fix(rules): Reduce Suspicious access to the hosts file FPs --- ...nse_evasion_suspicious_access_to_the_hosts_file.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml b/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml index cf7d6ac9e..d00fc142d 100644 --- a/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml +++ b/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml @@ -1,6 +1,6 @@ name: Suspicious access to the hosts file id: f7b2c9d3-99e7-41d5-bb4a-6ea1a5f7f9e2 -version: 1.1.0 +version: 1.1.1 description: > Identifies suspicious process accessing the Windows hosts file for potential tampering. Adversaries can hijack the hosts files to block traffic to download/update servers or redirect the @@ -51,7 +51,8 @@ condition: > '?:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\*\\Smc.exe', '?:\\Program Files (x86)\\Trend Micro\\*\\TMBMSRV.exe', '?:\\Program Files\\ESET\\ESET Security\\ekrn.exe', - '?:\\Program Files\\Sophos\\Sophos Anti-Virus\\SavService.exe' + '?:\\Program Files\\Sophos\\Sophos Anti-Virus\\SavService.exe', + '?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF\\AcroCEF.exe' ) | |open_file and @@ -61,11 +62,14 @@ condition: > '?:\\Program Files\\*\\libcef.dll!GetHandleVerifier', '?:\\Program Files (x86)\\*\\libcef.dll!GetHandleVerifier', '?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe!GetHandleVerifier', + '?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe!uv_tcp_init', '?:\\Users\\*\\AppData\\Roaming\\Spotify\\libcef.dll!GetHandleVerifier', '?:\\Program Files\\Microsoft VS Code\\Code.exe!GetHandleVerifier', '?:\\Program Files (x86)\\Microsoft VS Code\\Code.exe!GetHandleVerifier', '?:\\Program Files\\Google\\Chrome\\*\\chrome.dll!*', - '?:\\Program Files (x86)\\Google\\Chrome\\*\\chrome.dll!*' + '?:\\Program Files (x86)\\Google\\Chrome\\*\\chrome.dll!*', + '?:\\Program Files\\Microsoft\\*\\msedge.dll!*', + '?:\\Program Files (x86)\\Microsoft\\*\\msedge.dll!*' )) | action: From 4a92dce67fc93d51f3632bc42acd5cc8062351f9 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 27 Jul 2026 21:32:36 +0200 Subject: [PATCH 03/19] fix(rules): Reduce Suspicious protected process execution FPs --- ...evasion_suspicious_protected_process_execution.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/rules/defense_evasion_suspicious_protected_process_execution.yml b/rules/defense_evasion_suspicious_protected_process_execution.yml index a360e5952..21e3a7644 100644 --- a/rules/defense_evasion_suspicious_protected_process_execution.yml +++ b/rules/defense_evasion_suspicious_protected_process_execution.yml @@ -1,6 +1,6 @@ name: Suspicious protected process execution id: a778295a-02f1-42d9-9c20-78346a7bc2c6 -version: 1.0.0 +version: 1.1.0 description: | Identifies unprivileged process spawning a child with protected integrity level. This indicates an unusual behavior that is often associated with attempts to tamper with or @@ -22,12 +22,15 @@ condition: > sequence maxspan 1m30s |spawn_process and - ps.token.integrity_level != 'SYSTEM' and + ps.is_protected = false and + (ps.sid != 'S-1-5-18' or ps.token.integrity_level != 'SYSTEM') and ps.exe not imatches ( '?:\\Program Files\\*', - '?:\\Program Files(x86)\\*' - ) + '?:\\Program Files(x86)\\*', + '?:\\WINDOWS\\System32\\csrss.exe' + ) and + ps.parent.exe not imatches '?:\\WINDOWS\\System32\\smss.exe' | by ps.uuid |spawn_process and ps.is_protected| by ps.parent.uuid action: From 44d06f6e287ca9024729a79163fffd1499323d6d Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 27 Jul 2026 21:40:43 +0200 Subject: [PATCH 04/19] fix(rules): Reduce Suspicious child process integrity level FPs --- ...e_escalation_suspicious_child_process_integrity_level.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/privilege_escalation_suspicious_child_process_integrity_level.yml b/rules/privilege_escalation_suspicious_child_process_integrity_level.yml index 90ebae1b7..782e2ab50 100644 --- a/rules/privilege_escalation_suspicious_child_process_integrity_level.yml +++ b/rules/privilege_escalation_suspicious_child_process_integrity_level.yml @@ -1,6 +1,6 @@ name: Suspicious child process integrity level id: b958e949-a16a-4d66-b008-15f4e8382a6e -version: 1.0.1 +version: 1.0.2 description: | Identifies the execution of the parent process running with low/medium integrity level that spawns a child process with the system integrity level. Because normal @@ -41,7 +41,8 @@ condition: > '?:\\Windows\\System32\\WerFaultSecure.exe', '?:\\Program Files\\Google\\GoogleUpdater\\*\\updater.exe', '?:\\Program Files (x86)\\Google\\GoogleUpdater\\*\\updater.exe' - ) + ) and + not (ps.exe imatches '?:\\WINDOWS\\system32\\conhost.exe' and ps.parent.exe imatches '?:\\WINDOWS\\system32\\Clipup.exe') | by ps.parent.uuid action: - name: kill From ba3a67d50a60edd8cc3d73f4550bdf5384ad92a5 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 27 Jul 2026 21:57:36 +0200 Subject: [PATCH 05/19] fix(rules): Reduce Suspicious Vault client DLL load FPs --- ...ccess_suspicious_vault_client_dll_load.yml | 59 ++++++++++--------- 1 file changed, 30 insertions(+), 29 deletions(-) diff --git a/rules/credential_access_suspicious_vault_client_dll_load.yml b/rules/credential_access_suspicious_vault_client_dll_load.yml index 8adc79043..919715a88 100644 --- a/rules/credential_access_suspicious_vault_client_dll_load.yml +++ b/rules/credential_access_suspicious_vault_client_dll_load.yml @@ -1,6 +1,6 @@ name: Suspicious Vault client DLL load id: 64af2e2e-2309-4079-9c0f-985f1dd930f5 -version: 1.0.7 +version: 1.0.8 description: | Identifies loading of the Vault client DLL by an unusual process. Adversaries can abuse the functions provided by the Credential Vault Client Library to enumerate or harvest saved credentials. @@ -24,34 +24,35 @@ condition: > by ps.uuid |spawn_process and ps.sid not in ('S-1-5-18', 'S-1-5-19', 'S-1-5-20') and ps.exe != '' and - not (ps.exe imatches - ( - '?:\\Windows\\System32\\MDMAppInstaller.exe', - '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe', - '?:\\Windows\\uus\\*\\WaaSMedicAgent.exe', - '?:\\Windows\\System32\\UCConfigTask.exe', - '?:\\Windows\\System32\\DllHost.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe', - '?:\\Program Files\\*.exe', - '?:\\Program Files (x86)\\*.exe', - '?:\\Windows\\winsxs\\*\\TiWorker.exe', - '?:\\Windows\\System32\\RuntimeBroker.exe', - '?:\\WINDOWS\\system32\\UCConfigTask.exe', - '?:\\Program Files\\WindowsApps\\Microsoft.*.exe', - '?:\\Windows\\System32\\SecurityHealth\\*\\SecurityHealthHost.exe', - '?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe', - '?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe', - '?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe', - '?:\\Windows\\System32\\PickerHost.exe', - '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe', - '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\AppActions.exe', - '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe', - '?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe', - '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe' - )) and + ps.exe not imatches + ( + '?:\\Windows\\System32\\MDMAppInstaller.exe', + '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe', + '?:\\Windows\\uus\\*\\WaaSMedicAgent.exe', + '?:\\Windows\\System32\\UCConfigTask.exe', + '?:\\Windows\\System32\\DllHost.exe', + '?:\\WINDOWS\\explorer.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe', + '?:\\Program Files\\*.exe', + '?:\\Program Files (x86)\\*.exe', + '?:\\Windows\\winsxs\\*\\TiWorker.exe', + '?:\\Windows\\System32\\RuntimeBroker.exe', + '?:\\WINDOWS\\system32\\UCConfigTask.exe', + '?:\\Program Files\\WindowsApps\\Microsoft.*.exe', + '?:\\Windows\\System32\\SecurityHealth\\*\\SecurityHealthHost.exe', + '?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe', + '?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe', + '?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe', + '?:\\Windows\\System32\\PickerHost.exe', + '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe', + '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\AppActions.exe', + '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe', + '?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe', + '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe' + ) and not (ps.exe imatches '?:\\WINDOWS\\System32\\taskhostw.exe' and ps.parent.args intersects ('-k', 'netsvcs', '-p', '-s', 'Schedule')) and not (ps.exe imatches '?:\\WINDOWS\\system32\\BackgroundTaskHost.exe' and ps.args imatches ('-ServerName:*')) and not (ps.parent.exe imatches '?:\\Windows\\System32\\services.exe') and From 2c27183e9abfbd563593c5d25a6b2facbd5b39c4 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Wed, 29 Jul 2026 22:12:13 +0200 Subject: [PATCH 06/19] fix(rules): Reduce Potential process injection via tainted memory section FPs --- ..._process_injection_via_tainted_memory_section.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml b/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml index 0e61f6819..188abdbcb 100644 --- a/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml +++ b/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml @@ -1,6 +1,6 @@ name: Potential process injection via tainted memory section id: 8e4182f3-02e7-4e95-afc3-93d18c9a9c09 -version: 1.0.6 +version: 1.0.8 description: | Identifies potential process injection when the adversary creates and maps a memory section with RW protection rights followed by mapping of the same memory section in @@ -38,8 +38,14 @@ condition: > '?:\\WINDOWS\\System32\\lsass.exe', '?:\\WINDOWS\\System32\\SecurityHealthService.exe', '?:\\WINDOWS\\System32\\services.exe', - '?:\\WINDOWS\\System32\\RuntimeBroker.exe' - ) + '?:\\WINDOWS\\System32\\RuntimeBroker.exe', + '?:\\WINDOWS\\System32\\sihost.exe', + '?:\\WINDOWS\\System32\\smartscreen.exe', + '?:\\WINDOWS\\System32\\taskhostw.exe', + '?:\\WINDOWS\\System32\\wbem\\wmiprvse.exe', + '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe' + ) and + not (ps.parent.exe imatches '?:\\WINDOWS\\Explorer.exe' and ps.signature.exists = true and ps.signature.trusted = true) | as e1 |map_view_of_section and file.view.protection = 'READONLY|EXECUTE' and file.key = $e1.file.key and evt.pid != $e1.evt.pid| action: From 37b1c719f5620ffa3dccb921a0144433cc09ebcb Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 1 Aug 2026 21:52:07 +0200 Subject: [PATCH 07/19] fix(rules): Reduce CldApi DLL loaded by an unusual process FPs --- ...vasion_cldapi_dll_loaded_by_an_unusual_process.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml b/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml index 17dca5561..34da3031a 100644 --- a/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml +++ b/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml @@ -1,6 +1,6 @@ name: CldApi DLL loaded by an unusual process id: 450aee38-e8cf-47bc-8315-d16b13d740cb -version: 1.0.0 +version: 1.0.1 description: | Detects the loading of cldapi.dll (Cloud Filter API) by processes other than those legitimately associated with Windows Cloud Files infrastructure and OneDrive @@ -27,13 +27,15 @@ condition: > '?:\\Windows\\System32\\SearchProtocolHost.exe', '?:\\Windows\\System32\\svchost.exe', '?:\\Windows\\System32\\sihost.exe', - '?:\\Windows\\System32\\explorer.exe', + '?:\\Windows\\explorer.exe', '?:\\Windows\\System32\\ShellHost.exe', '?:\\Windows\\System32\\FileSyncConfig.exe', '?:\\Windows\\System32\\WorkFolders.exe', '?:\\Windows\\System32\\OneDriveSetup.exe', '?:\\Windows\\SysWOW64\\OneDriveSetup.exe', '?:\\Windows\\SystemApps\\Microsoft.Windows.Search_*\\SearchApp.exe', + '?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe', + '?:\\Program Files\\Microsoft OneDrive\\FileCoAuth.exe', '?:\\Program Files\\Microsoft OneDrive\\*\\OneDrive.exe', '?:\\Program Files\\Microsoft OneDrive\\*\\FileCoAuth.exe', '?:\\Program Files\\Microsoft OneDrive\\*\\OneDriveUpdaterService.exe', @@ -56,7 +58,10 @@ condition: > '?:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe', '?:\\Program Files\\Dropbox\\Client\\Dropbox.exe', '?:\\Program Files\\Adobe\\Adobe Creative Cloud\\ACC\\Creative Cloud.exe', - '?:\\Program Files\\Autodesk\\Desktop App\\AdAppMgrSvc.exe' + '?:\\Program Files\\Autodesk\\Desktop App\\AdAppMgrSvc.exe', + '?:\\Program Files\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe', + '?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe', + '?:\\WINDOWS\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_*\\StartMenuExperienceHost.exe' ) action: - name: kill From f0aa37f262cec303edaf933761e51c237933f92c Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 1 Aug 2026 23:15:07 +0200 Subject: [PATCH 08/19] fix(rules): Reduce Direct disk device access FPs --- ...ense_evasion_direct_disk_device_access.yml | 23 +++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/rules/defense_evasion_direct_disk_device_access.yml b/rules/defense_evasion_direct_disk_device_access.yml index d6f6b233f..446583d15 100644 --- a/rules/defense_evasion_direct_disk_device_access.yml +++ b/rules/defense_evasion_direct_disk_device_access.yml @@ -1,6 +1,6 @@ name: Direct disk device access id: b77914b8-9e91-46ab-8f52-342a2848c59e -version: 1.0.0 +version: 1.0.1 description: | Detects direct access to raw disk devices or volumes by user-mode processes, bypassing the Windows filesystem layer. Attackers abuse raw disk handles to @@ -33,7 +33,9 @@ condition: > ) and ps.exe not imatches ( + '?:\\Windows\\explorer.exe', '?:\\Windows\\System32\\svchost.exe', + '?:\\Windows\\System32\\lsass.exe', '?:\\Windows\\System32\\services.exe', '?:\\Windows\\System32\\defrag.exe', '?:\\Windows\\System32\\chkdsk.exe', @@ -42,6 +44,13 @@ condition: > '?:\\Windows\\System32\\dfrg.msc', '?:\\Windows\\System32\\wbadmin.exe', '?:\\Windows\\System32\\fsutil.exe', + '?:\\Windows\\System32\\MRT.exe', + '?:\\Windows\\System32\\srtasks.exe', + '?:\\Windows\\System32\\taskhostw.exe', + '?:\\Windows\\System32\\wbem\\wmiprvse.exe', + '?:\\Windows\\System32\\SearchIndexer.exe', + '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe', + '?:\\Windows\\System32\\SecurityHealthService.exe', '?:\\Program Files\\VMware\\VMware Workstation\\vmware.exe', '?:\\Program Files (x86)\\VMware\\VMware Workstation\\vmware.exe', '?:\\Program Files\\Oracle\\VirtualBox\\VBoxSVC.exe', @@ -51,9 +60,15 @@ condition: > '?:\\Program Files\\Windows Defender\\MsMpEng.exe', '?:\\Program Files\\Windows Defender\\NisSrv.exe', '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe', - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\NisSrv.exe' - ) + '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\NisSrv.exe', + '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe', + '?:\\WINDOWS\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_*\\StartMenuExperienceHost.exe' + ) and + not (ps.exe imatches '?:\\WINDOWS\\system32\\vssvc.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\services.exe') and + not (file.path imatches '\\Device\\HarddiskVolume*\\EFI\\OEM\\Boot' and ps.token.integrity_level = 'SYSTEM') and + not (thread.callstack.kernel_summary imatches '*|CI.dll|ntoskrnl.exe|clipsp.sys|*' and ps.signature.trusted = true) and + not (thread.callstack.symbols imatches ('sechost.dll!TraceSetInformation') and ps.signature.trusted = true and ps.signature.subject imatches '*Microsoft Corporation*') severity: high -min-engine-version: 3.0.0 +min-engine-version: 3.1.0 From 1a75be860bb32c8fbcb13b560c940fc5dbd04fe3 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 1 Aug 2026 23:18:42 +0200 Subject: [PATCH 09/19] fix(rules): Reduce BindFlt DLL loaded by an unusual process FPs --- ...ense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml b/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml index a2f450c53..f4df9f4bc 100644 --- a/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml +++ b/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml @@ -1,6 +1,6 @@ name: BindFlt DLL loaded by an unusual process id: fa439e69-2a73-49f9-8385-0e7f801f67db -version: 1.0.0 +version: 1.0.1 description: | Detects the loading of bindfltapi.dll, bindflt.dll, or bindlink.dll DLL family that represents user-mode API surface of the Windows Bind Filter driver (bindflt.sys) @@ -45,7 +45,8 @@ condition: > '?:\\Users\\*\\AppData\\Local\\Docker\\Desktop\\Docker Desktop.exe' ) and not (ps.sid = 'S-1-5-18' and ps.exe imatches ('?:\\Windows\\System32\\*.exe', '?:\\Windows\\SysWOW64\\*.exe') and - ps.signature.subject imatches ('*Microsoft Windows*', '*Microsoft Corporation*') and ps.signature.trusted = true) + ps.signature.subject imatches ('*Microsoft Windows*', '*Microsoft Corporation*') and ps.signature.trusted = true) and + not (ps.exe imatches '?:\\Windows\\winsxs\\*\\TiWorker.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe') action: - name: kill From 620b126060fa9bb7040ce7b02f633e7934e4281a Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 1 Aug 2026 23:40:26 +0200 Subject: [PATCH 10/19] fix(rules): Reduce NET assembly loaded by unmanaged process FPs --- ..._dotnet_assembly_loaded_by_unmanaged_process.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml b/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml index fa14f3d7e..321dca76b 100644 --- a/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml +++ b/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml @@ -1,6 +1,6 @@ name: .NET assembly loaded by unmanaged process id: 34be8bd1-1143-4fa8-bed4-ae2566b1394a -version: 1.2.0 +version: 1.2.1 description: | Identifies the loading of the .NET assembly by an unmanaged process. Adversaries can load the CLR runtime inside unmanaged process and execute the assembly via the ICLRRuntimeHost::ExecuteInDefaultAppDomain method. @@ -35,21 +35,26 @@ condition: > '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe', '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe', '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe', - '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\WinStore.DesktopExtension\\StoreDesktopExtension.exe' + '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\WinStore.DesktopExtension\\StoreDesktopExtension.exe', + '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxRemoteSession.exe', + '?:\\Program Files\\WindowsApps\\Microsoft*\\MicrosoftSecurityApp\\MicrosoftSecurityApp.exe' ) | |(load_unsigned_or_untrusted_module) and dll.path not imatches ( '?:\\Windows\\System32\\*.dll', - '?:\\Windows\\assembly\\*\\*.ni.dll', + '?:\\Windows\\assembly\\*', '?:\\Program Files\\WindowsPowerShell\\Modules\\*\\*.dll', '?:\\Windows\\Microsoft.NET\\assembly\\*\\*.dll', '?:\\$WinREAgent\\Scratch\\*.dll', '?:\\Windows\\WinSxS\\*.dll', '?:\\Windows\\CbsTemp\\*.dll', '?:\\Windows\\SoftwareDistribution\\*.dll', - '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\*.dll' + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\*.dll', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\*.dll', + '?:\\Program Files\\WindowsApps\\*', + '?:\\Program Files\\dotnet\\shared\\*\\*.dll' ) and ps.exe != '' and ps.pe.is_dotnet = false and (dll.pe.is_dotnet or thread.callstack.modules imatches ('*clr.dll')) From 988af879ef5019d07711bd0353413f070333cf5b Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 3 Aug 2026 10:59:44 +0200 Subject: [PATCH 11/19] fix(rules): Reduce Activation Context memory section hijacking FPs --- ...vasion_activation_context_memory_section_hijacking.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/rules/defense_evasion_activation_context_memory_section_hijacking.yml b/rules/defense_evasion_activation_context_memory_section_hijacking.yml index 33738daf4..a7f9a1ae1 100644 --- a/rules/defense_evasion_activation_context_memory_section_hijacking.yml +++ b/rules/defense_evasion_activation_context_memory_section_hijacking.yml @@ -1,6 +1,6 @@ name: Activation Context memory section hijacking id: 3d56281e-9608-4a70-b7b7-7651ccd3752b -version: 1.0.0 +version: 1.0.1 description: | Detects abuses of a legitimate Windows feature present in most processes called Activation Contexts with the objective of loading an arbitrary DLL @@ -26,12 +26,16 @@ condition: > |unmap_view_file and file.view.type = 'PAGEFILE' and file.view.protection = 'READONLY' and (file.view.size = 12288 or (file.view.size = 4096 and + not (ps.exe imatches '?:\\Windows\\explorer.exe') and + not (ps.parent.exe imatches '?:\\Windows\\System32\\services.exe' and ps.exe imatches '?:\\Windows\\System32\\svchost.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches '?:\\Windows\\System32\\taskhostw.exe') and not (ps.parent.exe imatches '?:\\Windows\\explorer.exe' and ps.exe imatches '?:\\Program Files\\WindowsApps\\*.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\winlogon.exe' and ps.exe imatches '?:\\Windows\\System32\\dwm.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\winlogon.exe' and ps.exe imatches '?:\\Windows\\System32\\csrss.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches '?:\\Program Files\\Microsoft Office\\*\\ActionsServer\\ActionsServer.exe') and - not (ps.parent.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.cmdline imatches concat('*-contentproc -parentBuildID* -parentPid ', ps.ppid))) + not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches 'C:\\WINDOWS\\SystemApps\\ShellExperienceHost_*\\ShellExperienceHost.exe') and + not (ps.parent.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.cmdline imatches concat('*-contentproc -parentBuildID* -parentPid ', ps.ppid))) and + not (ps.name iin ('procexp.exe', 'procexp64.exe') and ps.signature.trusted = true and ps.signature.subject imatches '*Microsoft Corporation*') ) | |map_view_file and file.view.size = 12288 and file.view.type = 'PAGEFILE' and file.view.protection = 'READWRITE'| From 388460ce00712f142b506d5410500f87e1ae218e Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 3 Aug 2026 21:56:21 +0200 Subject: [PATCH 12/19] fix(rules): Reduce Process execution from hollowed memory section FPs --- ...asion_process_execution_from_hollowed_memory_section.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml b/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml index f3fa84996..b9e3f2374 100644 --- a/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml +++ b/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml @@ -1,6 +1,6 @@ name: Process execution from hollowed memory section id: 2a3fbae8-5e8c-4b71-b9da-56c3958c0d53 -version: 2.1.3 +version: 2.1.4 description: | Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code @@ -32,7 +32,9 @@ condition: > '?:\\Windows\\System32\\services.exe', '?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe', '?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe' - ) + ) and + not (ps.exe imatches '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxServer.exe' and ps.parent.exe imatches '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxRemoteSession.exe') and + not (ps.exe imatches '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxRemoteSession.exe' and ps.parent.exe imatches '?:\\Windows\\explorer.exe') | by ps.uuid, file.view.base |load_executable and module.path not imatches '?:\\Windows\\SoftwareDistribution\\Download\\*\\Package_for_RollupFix*\\*.exe' and From 8324850e91b1745972dfa00784d6d7761911133b Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 3 Aug 2026 22:05:15 +0200 Subject: [PATCH 13/19] fix(rules): Check process parent args in Clickfix phishing via browser dialog box --- ...initial_access_clickfix_phishing_via_browser_dialog_box.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml b/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml index b672f791d..4a7c015dd 100644 --- a/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml +++ b/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml @@ -1,6 +1,6 @@ name: Clickfix phishing via browser dialog box id: 5fc4bf43-fbb6-4a78-a2cc-1fe9138bd3c2 -version: 1.0.0 +version: 1.0.1 description: | Identifies a ClickFix-style social-engineering phishing attempt and its FileFix evolution where a web page coerces a user into interacting with a trusted File Explorer address bar so @@ -23,6 +23,7 @@ references: condition: > spawn_process and ps.parent.name iin web_browser_binaries and + (ps.parent.args iintersects ('--service-sandbox-type=none', '--message-loop-type-ui') or ps.parent.args iintersects ('-contentproc', 'utility')) and (ps.name iin script_interpreters or ps.name iin ('msiexec.exe', 'rundll32.exe', 'curl.exe', 'wget.exe', 'certutil.exe', 'certreq.exe', 'msbuild.exe') or ps.exe imatches '?:\\Users\\*\\Downloads\\*') and thread.callstack.summary imatches 'ntdll.dll|*|windows.storage.dll|shell32.dll|windows.storage.dll|SHCore.dll|*' From e10658948c75353229311f8279c4f816eee47981 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 3 Aug 2026 22:24:47 +0200 Subject: [PATCH 14/19] fix(rules): Reduce Hidden registry key creation FPs --- rules/defense_evasion_hidden_registry_key_creation.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/rules/defense_evasion_hidden_registry_key_creation.yml b/rules/defense_evasion_hidden_registry_key_creation.yml index ebc48939d..cac9528f6 100644 --- a/rules/defense_evasion_hidden_registry_key_creation.yml +++ b/rules/defense_evasion_hidden_registry_key_creation.yml @@ -1,6 +1,6 @@ name: Hidden registry key creation id: 65deda38-9b1d-42a0-9f40-a68903e81b49 -version: 1.1.7 +version: 1.1.8 description: | Identifies the creation of a hidden registry key. Adversaries can utilize the native NtSetValueKey API to create a hidden registry key and conceal payloads @@ -31,13 +31,15 @@ condition: > '?:\\Windows\\System32\\svchost.exe', '?:\\Windows\\WinSxS\\*\\TiWorker.exe', '?:\\Windows\\UUS\\*\\wuaucltcore.exe', - '?:\\$WinREAgent\\Scratch\\*\\DismHost.exe' + '?:\\$WinREAgent\\Scratch\\*\\DismHost.exe', + '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\containerworker.exe' ) and ps.parent.exe not imatches ( '?:\\WINDOWS\\uus\\*\\wuaucltcore.exe', '?:\\WINDOWS\\System32\\svchost.exe' - ) + ) and + not (ps.exe imatches '?:\\Windows\\*' and thread.callstack.summary imatches ('ntdll.dll|wcp.dll|CbsCore.dll|turbostsack.dll|*', 'ntdll.dll|drvstore.dll|drupdate.dll|CbsCore.dll|turbostsack.dll|*')) output: > Hidden registry key %registry.path created by process %ps.exe From 8774cea3d259712a00ddc27c2dfaeef9874f9ad9 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 3 Aug 2026 22:29:02 +0200 Subject: [PATCH 15/19] fix(rules): Reduce Process execution from a self-deleting binary FPs --- ...evasion_process_execution_from_self_deleting_binary.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/rules/defense_evasion_process_execution_from_self_deleting_binary.yml b/rules/defense_evasion_process_execution_from_self_deleting_binary.yml index c82042e2f..cc5ac8c62 100644 --- a/rules/defense_evasion_process_execution_from_self_deleting_binary.yml +++ b/rules/defense_evasion_process_execution_from_self_deleting_binary.yml @@ -1,6 +1,6 @@ name: Process execution from a self-deleting binary id: 0f0da517-b22c-4d14-9adc-36baeb621cf7 -version: 1.0.6 +version: 1.0.7 description: | Identifies the execution of the process from a self-deleting binary. The attackers can abuse undocumented API functions to create a process from a file-backed section. The file @@ -19,7 +19,7 @@ references: condition: > sequence - maxspan 1m + maxspan 1m |delete_file and file.info.is_disposition_delete_file and ps.exe not imatches @@ -29,7 +29,8 @@ condition: > '?:\\WINDOWS\\uus\\packages\\preview\\*\\MoUsoCoreWorker.exe', '?:\\WINDOWS\\System32\\svchost.exe', '?:\\WINDOWS\\winsxs\\*\\TiWorker.exe', - '?:\\Windows\\UUS\\*\\wuaucltcore.exe' + '?:\\Windows\\UUS\\*\\wuaucltcore.exe', + '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\containerworker.exe' ) and ps.parent.exe not imatches '?:\\WINDOWS\\uus\\*\\wuaucltcore.exe' and file.path not imatches From 5dd6c535ec283d8463de08752321a0da9b485739 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Wed, 5 Aug 2026 01:17:14 +0200 Subject: [PATCH 16/19] fix(rules): Reduce Suspicious LSASS process access FPs --- .../credential_access_suspicious_lsass_process_access.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/rules/credential_access_suspicious_lsass_process_access.yml b/rules/credential_access_suspicious_lsass_process_access.yml index a99f4903b..9030e92d5 100644 --- a/rules/credential_access_suspicious_lsass_process_access.yml +++ b/rules/credential_access_suspicious_lsass_process_access.yml @@ -1,6 +1,6 @@ name: Suspicious LSASS process access id: 40e59763-62c6-4ae7-8c8a-5d4167d3b4e9 -version: 1.0.0 +version: 1.0.1 description: | Identifies processes requesting high-privilege access to the Local Security Authority Subsystem Service (LSASS) process @@ -35,12 +35,15 @@ condition: > '?:\\Windows\\system32\\MRT.exe', '?:\\Windows\\System32\\wininit.exe', '?:\\Windows\\System32\\services.exe', + '?:\\WINDOWS\\System32\\taskhostw.exe', '?:\\Windows\\Sysmon.exe', '?:\\Windows\\Sysmon64.exe', '?:\\Windows\\System32\\msiexec.exe', '?:\\Windows\\system32\\wbem\\wmiprvse.exe', '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe' - ) + ) and + not (ps.exe imatches '?:\\Windows\\System32\\lsass.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\wininit.exe') and + not (thread.callstack.final_user_module.signature.trusted = true and thread.callstack.final_user_module.signature.subject imatches '*Microsoft Corporation*' and thread.callstack.modules not imatches ('*dbgcore.dll', '*comsvcs.dll')) severity: high From 99316ab95df1b9d9a67856a239850ba9815fd213 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Wed, 5 Aug 2026 18:30:13 +0200 Subject: [PATCH 17/19] fix(rules): Reduce Embedded script execution via shortcut file FPs --- ...execution_embedded_script_execution_via_shortcut_file.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/execution_embedded_script_execution_via_shortcut_file.yml b/rules/execution_embedded_script_execution_via_shortcut_file.yml index df041e05b..e91d6b6d5 100644 --- a/rules/execution_embedded_script_execution_via_shortcut_file.yml +++ b/rules/execution_embedded_script_execution_via_shortcut_file.yml @@ -1,6 +1,6 @@ name: Embedded script execution via shortcut file id: 2d94a68b-03fe-4ece-9a99-f4de8ff7261d -version: 1.0.1 +version: 1.0.2 description: | Detects execution of embedded scripts delivered via Windows shortcut (.lnk) files. Adversaries can exploit the attack chain where a shortcut file is accessed by a @@ -26,7 +26,8 @@ condition: > by ps.sessionid |open_file and ps.name iin ('cmd.exe', 'findstr.exe', 'find.exe', 'powershell.exe', 'pwsh.exe') and - file.path imatches '?:\\*.lnk' + file.path imatches '?:\\*.lnk' and + file.path not imatches '?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Powershell\\Windows PowerShell.lnk' | |create_file and ps.name iin ('cmd.exe', 'powershell.exe', 'pwsh.exe') and From 9da5af15f08678a88baf86bb811f6119585ad555 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Wed, 5 Aug 2026 18:42:47 +0200 Subject: [PATCH 18/19] fix(rules): Reduce Registry access to SAM database FPs --- rules/credential_access_registry_access_to_sam_database.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/credential_access_registry_access_to_sam_database.yml b/rules/credential_access_registry_access_to_sam_database.yml index e080ee2f9..74f4d3bbf 100644 --- a/rules/credential_access_registry_access_to_sam_database.yml +++ b/rules/credential_access_registry_access_to_sam_database.yml @@ -1,6 +1,6 @@ name: Registry access to SAM database id: 2f326557-0291-4eb1-a87a-7a17b7d941cb -version: 2.0.3 +version: 2.0.4 description: Identifies access to the Security Account Manager registry hives. labels: @@ -35,6 +35,7 @@ condition: > registry.path not imatches ( 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users', + 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\*\\InprocServer32', 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names', 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names\\WDAGUtilityAccount\\ChannelReferences', 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account', From 6fffd751e9f7a1449dd6a48a2d1bb7819b9b1ccc Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Wed, 5 Aug 2026 18:53:06 +0200 Subject: [PATCH 19/19] fix(rules): Reduce File access to SAM database FPs --- rules/credentail_access_file_access_to_sam_database.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/credentail_access_file_access_to_sam_database.yml b/rules/credentail_access_file_access_to_sam_database.yml index 7e290d6fe..3cdafb811 100644 --- a/rules/credentail_access_file_access_to_sam_database.yml +++ b/rules/credentail_access_file_access_to_sam_database.yml @@ -1,6 +1,6 @@ name: File access to SAM database id: e3dace20-4962-4381-884e-40dcdde66626 -version: 1.0.7 +version: 1.0.8 description: | Identifies access to the Security Account Manager on-disk database. labels: @@ -33,7 +33,8 @@ condition: > '?:\\Windows\\System32\\vmwp.exe', '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe', '?:\\Windows\\System32\\wuauclt.exe', - '?:\\Windows\\System32\\MRT.exe' + '?:\\Windows\\System32\\MRT.exe', + '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe' ) min-engine-version: 3.0.0