Skip to content

[Rule Tuning] Communication App Rules #5487

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
w0rk3r merged 6 commits into from
Dec 18, 2025
Merged

[Rule Tuning] Communication App Rules #5487

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
53d2e9b
[Rule Tuning] Communication App Rules
w0rk3r Dec 17, 2025
c14f818
Update defense_evasion_masquerading_business_apps_installer.toml
Samirbous Dec 18, 2025
372c6e7
Update defense_evasion_masquerading_business_apps_installer.toml
Samirbous Dec 18, 2025
15ea1ca
Update defense_evasion_masquerading_communication_apps.toml
Samirbous Dec 18, 2025
7b0c024
Update defense_evasion_masquerading_business_apps_installer.toml
Samirbous Dec 18, 2025
4134a5f
Merge branch 'main' into rt_1
w0rk3r Dec 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions rules/windows/command_and_control_common_webservices.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2020/11/04"
integration = ["endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/12/01"
updated_date = "2025/12/17"

[transform]
[[transform.investigate]]
Expand Down Expand Up @@ -296,7 +296,8 @@ network where host.os.type == "windows" and
) or

/* Zoom */
(process.name : "Zoom.exe" and (process.code_signature.subject_name : "Zoom Video Communications, Inc." and
(process.name : "Zoom.exe" and (
process.code_signature.subject_name : ("Zoom Video Communications, Inc.", "Zoom Communications, Inc.") and
process.code_signature.trusted == true) and dns.question.name : ("www.googleapis.com", "graph.microsoft.com")
) or

Expand Down
60 changes: 29 additions & 31 deletions rules/windows/defense_evasion_communication_apps_suspicious_child_process.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2023/08/04"
integration = ["endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -33,25 +33,36 @@ timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
not process.executable :
("?:\\Program Files\\*.exe",
process where host.os.type == "windows" and event.type == "start" and
process.parent.name : (
Copy link
Contributor

@Mikaayenson Mikaayenson Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. Is there chances where we have one of these comm apps as a grandparent?

e.g. comm app --> 
            <some updater intermediate> --> 
                                    powershell.exe?

Copy link
Contributor Author

@w0rk3r w0rk3r Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't have the descendant of feature in SIEM EQL, so that is a blind spot for this one

"slack.exe", "CiscoCollabHost.exe", "WebexHost.exe", "Teams.exe",
"Discord.exe", "Whatsapp.exe", "Zoom.exe", "thunderbird.exe"
) and
not process.executable : (
"?:\\Program Files\\*.exe",
"?:\\Program Files (x86)\\*.exe",
"?:\\Windows\\System32\\WerFault.exe",
"?:\\Windows\\SysWOW64\\WerFault.exe") and
"?:\\Windows\\SysWOW64\\WerFault.exe"
) and

/* Common Signed Browser Processes */
not (
process.executable : (
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
"?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\opera.exe"
) and process.code_signature.trusted == true
) and
(
/* Slack */
(process.parent.name : "slack.exe" and not
(
(
process.executable : (
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
"?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
"?:\\Users\\*\\AppData\\Roaming\\Zoom\\bin*\\Zoom.exe",
"?:\\Windows\\System32\\rundll32.exe",
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
"?:\\Windows\\System32\\notepad.exe",
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\opera.exe"
"?:\\Windows\\System32\\notepad.exe"
) and process.code_signature.trusted == true
) or
(
Expand All @@ -70,20 +81,11 @@ process where host.os.type == "windows" and event.type == "start" and
/* WebEx */
(process.parent.name : ("CiscoCollabHost.exe", "WebexHost.exe") and not
(
(
process.executable : (
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
"?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\opera.exe"
) and process.code_signature.trusted == true
) or
(
process.code_signature.subject_name : (
"Cisco Systems, Inc.",
"Cisco WebEx LLC",
"Cisco Systems Inc."
) and process.code_signature.trusted == true
)
process.code_signature.subject_name : (
"Cisco Systems, Inc.",
"Cisco WebEx LLC",
"Cisco Systems Inc."
) and process.code_signature.trusted == true
)
) or

Expand All @@ -93,8 +95,6 @@ process where host.os.type == "windows" and event.type == "start" and
(
process.executable : (
"?:\\Windows\\BrowserCore\\BrowserCore.exe",
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe"
) and process.code_signature.trusted == true
) or
Expand All @@ -115,7 +115,6 @@ process where host.os.type == "windows" and event.type == "start" and
(
(
process.executable : (
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
"?:\\Windows\\System32\\reg.exe",
"?:\\Windows\\SysWOW64\\reg.exe"
) and process.code_signature.trusted == true
Expand Down Expand Up @@ -169,14 +168,13 @@ process where host.os.type == "windows" and event.type == "start" and
(
(
process.executable : (
"?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
"?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
"?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe"
"?:\\Users\\*\\AppData\\Local\\BraveSoftware\\Brave-Browser\\Application\\brave.exe"
) and process.code_signature.trusted == true
) or
(
process.code_signature.subject_name : (
"Zoom Video Communications, Inc."
"Zoom Video Communications, Inc.",
"Zoom Communications, Inc."
) and process.code_signature.trusted == true
)
)
Expand Down
18 changes: 11 additions & 7 deletions rules/windows/defense_evasion_masquerading_business_apps_installer.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2023/09/01"
integration = ["endpoint"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
Expand All @@ -25,21 +25,21 @@ severity = "low"
tags = [
"Domain: Endpoint",
"Data Source: Elastic Defend",
"Data Source: Elastic Endgame",
"OS: Windows",
"Use Case: Threat Detection",
"Tactic: Defense Evasion",
"Tactic: Initial Access",
"Tactic: Execution",
"Resources: Investigation Guide",
"Data Source: Elastic Endgame",
"Resources: Investigation Guide"
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and
process where host.os.type == "windows" and
event.type == "start" and process.executable : "?:\\Users\\*\\Downloads\\*" and
not process.code_signature.status : ("errorCode_endpoint*", "errorUntrustedRoot", "errorChaining") and
not process.code_signature.status like ("errorCode_endpoint*", "errorUntrustedRoot", "errorChaining") and process.hash.sha256 != null and
(
/* Slack */
(process.name : "*slack*.exe" and not
Expand Down Expand Up @@ -69,13 +69,17 @@ process where host.os.type == "windows" and
(process.code_signature.subject_name in (
"WhatsApp LLC",
"WhatsApp, Inc",
"24803D75-212C-471A-BC57-9EF86AB91435"
"24803D75-212C-471A-BC57-9EF86AB91435",
/* WhatsApp Installer - MS Store */
"Microsoft Corporation"
) and process.code_signature.trusted == true)
) or

/* Zoom */
(process.name : ("*zoom*installer*.exe", "*zoom*setup*.exe", "zoom.exe") and not
(process.code_signature.subject_name == "Zoom Video Communications, Inc." and process.code_signature.trusted == true)
(process.code_signature.subject_name in (
"Zoom Video Communications, Inc.", "Zoom Communications, Inc."
) and process.code_signature.trusted == true)
) or

/* Outlook */
Expand Down
16 changes: 11 additions & 5 deletions rules/windows/defense_evasion_masquerading_communication_apps.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2023/05/05"
integration = ["endpoint", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2025/08/26"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -33,7 +33,8 @@ type = "eql"

query = '''
process where host.os.type == "windows" and
event.type == "start" and
event.type == "start" and
not process.code_signature.status like "errorCode_endpoint*" and process.hash.sha256 != null and
(
/* Slack */
(process.name : "slack.exe" and not
Expand All @@ -50,7 +51,8 @@ process where host.os.type == "windows" and

/* Teams */
(process.name : "Teams.exe" and not
(process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
(process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true) and
process.executable != "C:\\Program Files (x86)\\Teams Installer\\Teams.exe"
) or

/* Discord */
Expand All @@ -60,7 +62,8 @@ process where host.os.type == "windows" and

/* RocketChat */
(process.name : "Rocket.Chat.exe" and not
(process.code_signature.subject_name : "Rocket.Chat Technologies Corp." and process.code_signature.trusted == true)
(process.code_signature.subject_name : "Rocket.Chat Technologies Corp." and process.code_signature.trusted == true) and
process.executable != "C:\\Program Files\\rocketchat\\Rocket.Chat.exe"
) or

/* Mattermost */
Expand All @@ -79,7 +82,10 @@ process where host.os.type == "windows" and

/* Zoom */
(process.name : "Zoom.exe" and not
(process.code_signature.subject_name : "Zoom Video Communications, Inc." and process.code_signature.trusted == true)
(process.code_signature.subject_name : (
"Zoom Video Communications, Inc.",
"Zoom Communications, Inc."
) and process.code_signature.trusted == true)
) or

/* Outlook */
Expand Down
Loading