fix(rules): Tune false positives

rules/credential_access_suspicious_access_to_windows_manager_files.yml

@@ -1,6 +1,6 @@
 name: Suspicious access to Windows Credential Manager files
 id: 4ab688f7-94e2-481b-9c7f-c49f3a79a379
-version: 1.0.4
+version: 1.0.5
 description: |
   Identifies suspicious processes trying to acquire credentials from the Windows Credential Manager.
 labels:
@@ -25,7 +25,8 @@ condition: >
             (
               '?:\\Program Files\\*',
               '?:\\Program Files(x86)\\*',
-              '?:\\Windows\\System32\\lsass.exe'
+              '?:\\Windows\\System32\\lsass.exe',
+              '?:\\Windows\\system32\\svchost.exe'
             )
 
 min-engine-version: 3.0.0

rules/credential_access_suspicious_lsass_process_access.yml

@@ -1,6 +1,6 @@
 name: Suspicious LSASS process access
 id: 40e59763-62c6-4ae7-8c8a-5d4167d3b4e9
-version: 1.0.0
+version: 1.0.1
 description: |
   Identifies processes requesting high-privilege access to the
   Local Security Authority Subsystem Service (LSASS) process
@@ -35,12 +35,15 @@ condition: >
               '?:\\Windows\\system32\\MRT.exe',
               '?:\\Windows\\System32\\wininit.exe',
               '?:\\Windows\\System32\\services.exe',
+              '?:\\WINDOWS\\System32\\taskhostw.exe',
               '?:\\Windows\\Sysmon.exe',
               '?:\\Windows\\Sysmon64.exe',
               '?:\\Windows\\System32\\msiexec.exe',
               '?:\\Windows\\system32\\wbem\\wmiprvse.exe',
               '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe'
-            )
+            ) and
+  not (ps.exe imatches '?:\\Windows\\System32\\lsass.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\wininit.exe') and
+  not (thread.callstack.final_user_module.signature.trusted = true and thread.callstack.final_user_module.signature.subject imatches '*Microsoft Corporation*' and thread.callstack.modules not imatches ('*dbgcore.dll', '*comsvcs.dll'))
 
 severity: high
 

rules/credential_access_suspicious_vault_client_dll_load.yml

@@ -1,6 +1,6 @@
 name: Suspicious Vault client DLL load
 id: 64af2e2e-2309-4079-9c0f-985f1dd930f5
-version: 1.0.7
+version: 1.0.8
 description: |
   Identifies loading of the Vault client DLL by an unusual process. Adversaries can abuse the functions provided 
   by the Credential Vault Client Library to enumerate or harvest saved credentials.
@@ -24,34 +24,35 @@ condition: >
   by ps.uuid
     |spawn_process and
      ps.sid not in ('S-1-5-18', 'S-1-5-19', 'S-1-5-20') and ps.exe != '' and
-     not (ps.exe imatches
-                 (
-                   '?:\\Windows\\System32\\MDMAppInstaller.exe',
-                   '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe',
-                   '?:\\Windows\\uus\\*\\WaaSMedicAgent.exe',
-                   '?:\\Windows\\System32\\UCConfigTask.exe',
-                   '?:\\Windows\\System32\\DllHost.exe',
-                   '?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe',
-                   '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe',
-                   '?:\\Program Files\\*.exe',
-                   '?:\\Program Files (x86)\\*.exe',
-                   '?:\\Windows\\winsxs\\*\\TiWorker.exe',
-                   '?:\\Windows\\System32\\RuntimeBroker.exe',
-                   '?:\\WINDOWS\\system32\\UCConfigTask.exe',
-                   '?:\\Program Files\\WindowsApps\\Microsoft.*.exe',
-                   '?:\\Windows\\System32\\SecurityHealth\\*\\SecurityHealthHost.exe',
-                   '?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe',
-                   '?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe',
-                   '?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe',
-                   '?:\\Windows\\System32\\PickerHost.exe',
-                   '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe',
-                   '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\AppActions.exe',
-                   '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe',
-                   '?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe',
-                   '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe',
-                   '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe',
-                   '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe'
-                 )) and
+     ps.exe not imatches
+                (
+                  '?:\\Windows\\System32\\MDMAppInstaller.exe',
+                  '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe',
+                  '?:\\Windows\\uus\\*\\WaaSMedicAgent.exe',
+                  '?:\\Windows\\System32\\UCConfigTask.exe',
+                  '?:\\Windows\\System32\\DllHost.exe',
+                  '?:\\WINDOWS\\explorer.exe',
+                  '?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe',
+                  '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe',
+                  '?:\\Program Files\\*.exe',
+                  '?:\\Program Files (x86)\\*.exe',
+                  '?:\\Windows\\winsxs\\*\\TiWorker.exe',
+                  '?:\\Windows\\System32\\RuntimeBroker.exe',
+                  '?:\\WINDOWS\\system32\\UCConfigTask.exe',
+                  '?:\\Program Files\\WindowsApps\\Microsoft.*.exe',
+                  '?:\\Windows\\System32\\SecurityHealth\\*\\SecurityHealthHost.exe',
+                  '?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe',
+                  '?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe',
+                  '?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe',
+                  '?:\\Windows\\System32\\PickerHost.exe',
+                  '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe',
+                  '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\AppActions.exe',
+                  '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe',
+                  '?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe',
+                  '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe',
+                  '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe',
+                  '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe'
+                ) and
      not (ps.exe imatches '?:\\WINDOWS\\System32\\taskhostw.exe' and ps.parent.args intersects ('-k', 'netsvcs', '-p', '-s', 'Schedule')) and
      not (ps.exe imatches '?:\\WINDOWS\\system32\\BackgroundTaskHost.exe' and ps.args imatches ('-ServerName:*')) and
      not (ps.parent.exe imatches '?:\\Windows\\System32\\services.exe') and

rules/defense_evasion_activation_context_memory_section_hijacking.yml

@@ -1,6 +1,6 @@
 name: Activation Context memory section hijacking
 id: 3d56281e-9608-4a70-b7b7-7651ccd3752b
-version: 1.0.0
+version: 1.0.1
 description: |
   Detects abuses of a legitimate Windows feature present in most processes
   called Activation Contexts with the objective of loading an arbitrary DLL
@@ -26,12 +26,16 @@ condition: >
     |unmap_view_file and
      file.view.type = 'PAGEFILE' and file.view.protection = 'READONLY' and
      (file.view.size = 12288 or (file.view.size = 4096 and
+      not (ps.exe imatches '?:\\Windows\\explorer.exe') and
+      not (ps.parent.exe imatches '?:\\Windows\\System32\\services.exe' and ps.exe imatches '?:\\Windows\\System32\\svchost.exe') and
       not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches '?:\\Windows\\System32\\taskhostw.exe') and
       not (ps.parent.exe imatches '?:\\Windows\\explorer.exe' and ps.exe imatches '?:\\Program Files\\WindowsApps\\*.exe') and
       not (ps.parent.exe imatches '?:\\Windows\\System32\\winlogon.exe' and ps.exe imatches '?:\\Windows\\System32\\dwm.exe') and
       not (ps.parent.exe imatches '?:\\Windows\\System32\\winlogon.exe' and ps.exe imatches '?:\\Windows\\System32\\csrss.exe') and
       not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches '?:\\Program Files\\Microsoft Office\\*\\ActionsServer\\ActionsServer.exe') and
-      not (ps.parent.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.cmdline imatches concat('*-contentproc -parentBuildID* -parentPid ', ps.ppid)))
+      not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches 'C:\\WINDOWS\\SystemApps\\ShellExperienceHost_*\\ShellExperienceHost.exe') and
+      not (ps.parent.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.cmdline imatches concat('*-contentproc -parentBuildID* -parentPid ', ps.ppid))) and
+      not (ps.name iin ('procexp.exe', 'procexp64.exe') and ps.signature.trusted = true and ps.signature.subject imatches '*Microsoft Corporation*')
      )
     |
     |map_view_file and file.view.size = 12288 and file.view.type = 'PAGEFILE' and file.view.protection = 'READWRITE'|

rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml

@@ -1,6 +1,6 @@
 name: BindFlt DLL loaded by an unusual process
 id: fa439e69-2a73-49f9-8385-0e7f801f67db
-version: 1.0.0
+version: 1.0.1
 description: |
   Detects the loading of bindfltapi.dll, bindflt.dll, or bindlink.dll DLL family that
   represents user-mode API surface of the Windows Bind Filter driver (bindflt.sys)
@@ -45,7 +45,8 @@ condition: >
               '?:\\Users\\*\\AppData\\Local\\Docker\\Desktop\\Docker Desktop.exe'
             ) and
   not (ps.sid = 'S-1-5-18' and ps.exe imatches ('?:\\Windows\\System32\\*.exe', '?:\\Windows\\SysWOW64\\*.exe') and
-       ps.signature.subject imatches ('*Microsoft Windows*', '*Microsoft Corporation*') and ps.signature.trusted = true)
+       ps.signature.subject imatches ('*Microsoft Windows*', '*Microsoft Corporation*') and ps.signature.trusted = true) and
+  not (ps.exe imatches '?:\\Windows\\winsxs\\*\\TiWorker.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe')
 action:
   - name: kill
 

rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml

@@ -1,6 +1,6 @@
 name: CldApi DLL loaded by an unusual process
 id: 450aee38-e8cf-47bc-8315-d16b13d740cb
-version: 1.0.0
+version: 1.0.1
 description: |
   Detects the loading of cldapi.dll (Cloud Filter API) by processes other than
   those legitimately associated with Windows Cloud Files infrastructure and OneDrive
@@ -27,13 +27,15 @@ condition: >
               '?:\\Windows\\System32\\SearchProtocolHost.exe',
               '?:\\Windows\\System32\\svchost.exe',
               '?:\\Windows\\System32\\sihost.exe',
-              '?:\\Windows\\System32\\explorer.exe',
+              '?:\\Windows\\explorer.exe',
               '?:\\Windows\\System32\\ShellHost.exe',
               '?:\\Windows\\System32\\FileSyncConfig.exe',
               '?:\\Windows\\System32\\WorkFolders.exe',
               '?:\\Windows\\System32\\OneDriveSetup.exe',
               '?:\\Windows\\SysWOW64\\OneDriveSetup.exe',
               '?:\\Windows\\SystemApps\\Microsoft.Windows.Search_*\\SearchApp.exe',
+              '?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe',
+              '?:\\Program Files\\Microsoft OneDrive\\FileCoAuth.exe',
               '?:\\Program Files\\Microsoft OneDrive\\*\\OneDrive.exe',
               '?:\\Program Files\\Microsoft OneDrive\\*\\FileCoAuth.exe',
               '?:\\Program Files\\Microsoft OneDrive\\*\\OneDriveUpdaterService.exe',
@@ -56,7 +58,10 @@ condition: >
               '?:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe',
               '?:\\Program Files\\Dropbox\\Client\\Dropbox.exe',
               '?:\\Program Files\\Adobe\\Adobe Creative Cloud\\ACC\\Creative Cloud.exe',
-              '?:\\Program Files\\Autodesk\\Desktop App\\AdAppMgrSvc.exe'
+              '?:\\Program Files\\Autodesk\\Desktop App\\AdAppMgrSvc.exe',
+              '?:\\Program Files\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe',
+              '?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe',
+              '?:\\WINDOWS\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_*\\StartMenuExperienceHost.exe'
             )
 action:
   - name: kill

rules/defense_evasion_direct_disk_device_access.yml

@@ -1,6 +1,6 @@
 name: Direct disk device access
 id: b77914b8-9e91-46ab-8f52-342a2848c59e
-version: 1.0.0
+version: 1.0.1
 description: |
   Detects direct access to raw disk devices or volumes by user-mode processes,
   bypassing the Windows filesystem layer. Attackers abuse raw disk handles to
@@ -33,7 +33,9 @@ condition: >
             ) and
   ps.exe not imatches
             (
+              '?:\\Windows\\explorer.exe',
               '?:\\Windows\\System32\\svchost.exe',
+              '?:\\Windows\\System32\\lsass.exe',
               '?:\\Windows\\System32\\services.exe',
               '?:\\Windows\\System32\\defrag.exe',
               '?:\\Windows\\System32\\chkdsk.exe',
@@ -42,6 +44,13 @@ condition: >
               '?:\\Windows\\System32\\dfrg.msc',
               '?:\\Windows\\System32\\wbadmin.exe',
               '?:\\Windows\\System32\\fsutil.exe',
+              '?:\\Windows\\System32\\MRT.exe',
+              '?:\\Windows\\System32\\srtasks.exe',
+              '?:\\Windows\\System32\\taskhostw.exe',
+              '?:\\Windows\\System32\\wbem\\wmiprvse.exe',
+              '?:\\Windows\\System32\\SearchIndexer.exe',
+              '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe',
+              '?:\\Windows\\System32\\SecurityHealthService.exe',
               '?:\\Program Files\\VMware\\VMware Workstation\\vmware.exe',
               '?:\\Program Files (x86)\\VMware\\VMware Workstation\\vmware.exe',
               '?:\\Program Files\\Oracle\\VirtualBox\\VBoxSVC.exe',
@@ -51,9 +60,15 @@ condition: >
               '?:\\Program Files\\Windows Defender\\MsMpEng.exe',
               '?:\\Program Files\\Windows Defender\\NisSrv.exe',
               '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe',
-              '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\NisSrv.exe'
-            )
+              '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\NisSrv.exe',
+              '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe',
+              '?:\\WINDOWS\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_*\\StartMenuExperienceHost.exe'
+            ) and
+  not (ps.exe imatches '?:\\WINDOWS\\system32\\vssvc.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\services.exe') and
+  not (file.path imatches '\\Device\\HarddiskVolume*\\EFI\\OEM\\Boot' and ps.token.integrity_level = 'SYSTEM') and
+  not (thread.callstack.kernel_summary imatches '*|CI.dll|ntoskrnl.exe|clipsp.sys|*' and ps.signature.trusted = true) and
+  not (thread.callstack.symbols imatches ('sechost.dll!TraceSetInformation') and ps.signature.trusted = true and ps.signature.subject imatches '*Microsoft Corporation*')
 
 severity: high
 
-min-engine-version: 3.0.0
+min-engine-version: 3.1.0

rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml

@@ -1,6 +1,6 @@
 name: .NET assembly loaded by unmanaged process
 id: 34be8bd1-1143-4fa8-bed4-ae2566b1394a
-version: 1.2.0
+version: 1.2.1
 description: |
   Identifies the loading of the .NET assembly by an unmanaged process. Adversaries can load the CLR runtime
   inside unmanaged process and execute the assembly via the ICLRRuntimeHost::ExecuteInDefaultAppDomain method.
@@ -35,21 +35,26 @@ condition: >
                   '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe',
                   '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe',
                   '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe',
-                  '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\WinStore.DesktopExtension\\StoreDesktopExtension.exe'
+                  '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\WinStore.DesktopExtension\\StoreDesktopExtension.exe',
+                  '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxRemoteSession.exe',
+                  '?:\\Program Files\\WindowsApps\\Microsoft*\\MicrosoftSecurityApp\\MicrosoftSecurityApp.exe'
                 )
     |
     |(load_unsigned_or_untrusted_module) and
      dll.path not imatches
                 (
                   '?:\\Windows\\System32\\*.dll',
-                  '?:\\Windows\\assembly\\*\\*.ni.dll',
+                  '?:\\Windows\\assembly\\*',
                   '?:\\Program Files\\WindowsPowerShell\\Modules\\*\\*.dll',
                   '?:\\Windows\\Microsoft.NET\\assembly\\*\\*.dll',
                   '?:\\$WinREAgent\\Scratch\\*.dll',
                   '?:\\Windows\\WinSxS\\*.dll',
                   '?:\\Windows\\CbsTemp\\*.dll',
                   '?:\\Windows\\SoftwareDistribution\\*.dll',
-                  '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\*.dll'
+                  '?:\\Windows\\Microsoft.NET\\Framework64\\*\\*.dll',
+                  '?:\\Windows\\Microsoft.NET\\Framework64\\*\\*.dll',
+                  '?:\\Program Files\\WindowsApps\\*',
+                  '?:\\Program Files\\dotnet\\shared\\*\\*.dll'
                 ) and
      ps.exe != '' and ps.pe.is_dotnet = false and
      (dll.pe.is_dotnet or thread.callstack.modules imatches ('*clr.dll'))

rules/defense_evasion_hidden_registry_key_creation.yml

@@ -1,6 +1,6 @@
 name: Hidden registry key creation
 id: 65deda38-9b1d-42a0-9f40-a68903e81b49
-version: 1.1.7
+version: 1.1.8
 description: |
   Identifies the creation of a hidden registry key. Adversaries can utilize the
   native NtSetValueKey API to create a hidden registry key and conceal payloads
@@ -31,13 +31,15 @@ condition: >
               '?:\\Windows\\System32\\svchost.exe',
               '?:\\Windows\\WinSxS\\*\\TiWorker.exe',
               '?:\\Windows\\UUS\\*\\wuaucltcore.exe',
-              '?:\\$WinREAgent\\Scratch\\*\\DismHost.exe'
+              '?:\\$WinREAgent\\Scratch\\*\\DismHost.exe',
+              '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\containerworker.exe'
             ) and
   ps.parent.exe not imatches
             (
               '?:\\WINDOWS\\uus\\*\\wuaucltcore.exe',
               '?:\\WINDOWS\\System32\\svchost.exe'
-            )
+            ) and
+  not (ps.exe imatches '?:\\Windows\\*' and thread.callstack.summary imatches ('ntdll.dll|wcp.dll|CbsCore.dll|turbostsack.dll|*', 'ntdll.dll|drvstore.dll|drupdate.dll|CbsCore.dll|turbostsack.dll|*'))
 
 output: >
   Hidden registry key %registry.path created by process %ps.exe

rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml

@@ -1,6 +1,6 @@
 name: Potential process injection via tainted memory section
 id: 8e4182f3-02e7-4e95-afc3-93d18c9a9c09
-version: 1.0.6
+version: 1.0.8
 description: |
   Identifies potential process injection when the adversary creates and maps a memory
   section with RW protection rights followed by mapping of the same memory section in
@@ -38,7 +38,12 @@ condition: >
                   '?:\\WINDOWS\\System32\\lsass.exe',
                   '?:\\WINDOWS\\System32\\SecurityHealthService.exe',
                   '?:\\WINDOWS\\System32\\services.exe',
-                  '?:\\WINDOWS\\System32\\RuntimeBroker.exe'
+                  '?:\\WINDOWS\\System32\\RuntimeBroker.exe',
+                  '?:\\WINDOWS\\System32\\sihost.exe',
+                  '?:\\WINDOWS\\System32\\smartscreen.exe',
+                  '?:\\WINDOWS\\System32\\taskhostw.exe',
+                  '?:\\WINDOWS\\System32\\wbem\\wmiprvse.exe',
+                  '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe'
                 )
     | as e1
     |map_view_of_section and file.view.protection = 'READONLY|EXECUTE' and file.key = $e1.file.key and evt.pid != $e1.evt.pid|