Skip to content

[Rule Tuning] Communication App Rules #5487

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
w0rk3r merged 6 commits into from
Dec 18, 2025
Merged

[Rule Tuning] Communication App Rules #5487

w0rk3r merged 6 commits into from
Dec 18, 2025
+54 −45

Conversation

@w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Dec 17, 2025 •
edited by Samirbous
Loading

Issues

BAU maintenance https://github.com/elastic/ia-trade-team/issues/619

Summary

Excludes FP patterns, add new Zoom-related code signature, adjusts Suspicious Communication App Child Process for better performance.

Related community slack msg https://elasticstack.slack.com/archives/C016E72DWDS/p1765964054051179

@w0rk3r w0rk3r self-assigned this Dec 17, 2025
@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint backport: auto labels Dec 17, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Dec 17, 2025

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Connection to Commonly Abused Web Services (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Communication App Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Communication Apps (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Business App Installer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Mikaayenson
Mikaayenson approved these changes Dec 17, 2025
View reviewed changes
rules/windows/defense_evasion_communication_apps_suspicious_child_process.toml
not process.executable :
("?:\\Program Files\\*.exe",
process where host.os.type == "windows" and event.type == "start" and
process.parent.name : (
Copy link
Contributor

@Mikaayenson Mikaayenson Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. Is there chances where we have one of these comm apps as a grandparent?

e.g. comm app --> 
            <some updater intermediate> --> 
                                    powershell.exe?

Copy link
Contributor Author

@w0rk3r w0rk3r Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't have the descendant of feature in SIEM EQL, so that is a blind spot for this one

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 18, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Connection to Commonly Abused Web Services (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Communication App Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Communication Apps (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Business App Installer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 18, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Connection to Commonly Abused Web Services (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Communication App Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Communication Apps (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Business App Installer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 18, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Connection to Commonly Abused Web Services (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Communication App Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Communication Apps (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Business App Installer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 18, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Connection to Commonly Abused Web Services (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Communication App Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Communication Apps (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Business App Installer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Samirbous
Samirbous approved these changes Dec 18, 2025
View reviewed changes
Copy link
Contributor

@Samirbous Samirbous left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good number of FPs are for missing process hash (due to errors to parse the file), excluded by adding process.hash.sha256 != null, otherwise LGTM

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 18, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Connection to Commonly Abused Web Services (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Suspicious Communication App Child Process (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Communication Apps (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Masquerading as Business App Installer (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@w0rk3r w0rk3r merged commit 5ec8e3e into main Dec 18, 2025
14 checks passed
@w0rk3r w0rk3r deleted the rt_1 branch December 18, 2025 10:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@Samirbous Samirbous Samirbous approved these changes

@Aegrah Aegrah Awaiting requested review from Aegrah

@terrancedejesus terrancedejesus Awaiting requested review from terrancedejesus

Assignees

@w0rk3r w0rk3r

Labels

backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@w0rk3r @tradebot-elastic @Mikaayenson @Samirbous