Skip to content

[Tuning] Diverse Rules Tuning #5482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Samirbous wants to merge 11 commits into
base: main
Choose a base branch
from
Open

[Tuning] Diverse Rules Tuning #5482

Samirbous wants to merge 11 commits into from
+66 −40

Conversation

@Samirbous
Copy link
Contributor

@Samirbous Samirbous commented Dec 17, 2025

  • Bash Shell Profile Modification - remove rename from event.action and uses file.name for better matches).
  • Web Shell Detection: Script Process Child of Common Web Processes - extra tuning to reduce FPs

@Samirbous Samirbous self-assigned this Dec 17, 2025
@Samirbous Samirbous added the Rule: Tuning tweaking or tuning an existing rule label Dec 17, 2025
@botelastic botelastic bot added Domain: Endpoint OS: Windows windows related rules labels Dec 17, 2025
@Samirbous Samirbous requested a review from w0rk3r December 17, 2025 10:40
@github-actions
Copy link
Contributor

github-actions bot commented Dec 17, 2025

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Web Shell Detection: Script Process Child of Common Web Processes (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bash Shell Profile Modification (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Web Shell Detection: Script Process Child of Common Web Processes (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bash Shell Profile Modification (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Web Shell Detection: Script Process Child of Common Web Processes (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bash Shell Profile Modification (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Web Shell Detection: Script Process Child of Common Web Processes (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bash Shell Profile Modification (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Web Shell Detection: Script Process Child of Common Web Processes (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bash Shell Profile Modification (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@botelastic botelastic bot added the OS: Linux label Dec 17, 2025
@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Uncommon Destination Port Connection by Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Web Shell Detection: Script Process Child of Common Web Processes (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bash Shell Profile Modification (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Mikaayenson
Mikaayenson reviewed Dec 17, 2025
View reviewed changes
.../integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml
severity = "high"
tags = [
"OS: Windows",
"Data Source: Elastic Endgame",
Copy link
Contributor

@Mikaayenson Mikaayenson Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

...s/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_low_probability.toml
severity = "low"
tags = [
"OS: Windows",
"Data Source: Elastic Endgame",
Copy link
Contributor

@Mikaayenson Mikaayenson Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

...s/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_low_probability.toml
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2023/10/16"
integration = ["problemchild", "endpoint"]
Copy link
Contributor

@Mikaayenson Mikaayenson Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this include windows?

Copy link
Contributor Author

@Samirbous Samirbous Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it will just add unnecessary noise, the rule require fixes at the ML level, this tuning purpose is to reduce the flooding.

rules/linux/persistence_web_server_sus_destination_port.toml
/*
This rule does not exclude local IP ranges by default. To exclude these, use the following exclusion statement:
cidrmatch(destination.ip, "10.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
not cidrmatch(destination.ip, "127.0.0.0/8", "::1","FE80::/10", "FF00::/8", "10.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
Copy link
Contributor

@Mikaayenson Mikaayenson Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No longer detecting internal c2 right?

Copy link
Contributor Author

@Samirbous Samirbous Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

99% of the noise is from internal apps, difficult to spot internal C2 in all the noise using this logic.

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Uncommon Destination Port Connection by Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Web Shell Detection: Script Process Child of Common Web Processes (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution via XZBackdoor (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bash Shell Profile Modification (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Uncommon Destination Port Connection by Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Web Shell Detection: Script Process Child of Common Web Processes (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution via XZBackdoor (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bash Shell Profile Modification (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Uncommon Destination Port Connection by Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Internal Linux SSH Brute Force Detected (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Web Shell Detection: Script Process Child of Common Web Processes (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution via XZBackdoor (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bash Shell Profile Modification (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Uncommon Destination Port Connection by Web Server (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Internal Linux SSH Brute Force Detected (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Web Shell Detection: Script Process Child of Common Web Processes (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential Execution via XZBackdoor (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (eql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Bash Shell Profile Modification (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mikaayenson Mikaayenson Mikaayenson left review comments

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@Aegrah Aegrah Awaiting requested review from Aegrah

@terrancedejesus terrancedejesus Awaiting requested review from terrancedejesus

@imays11 imays11 Awaiting requested review from imays11

At least 2 approving reviews are required to merge this pull request.

Assignees

@Samirbous Samirbous

Labels

backport: auto Domain: Endpoint OS: Linux OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Samirbous @tradebot-elastic @Mikaayenson