Skip to content

[Rule Tuning] PowerShell Rules - Misc Tuning/Severity Bumps #5486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
w0rk3r merged 3 commits into from
Dec 18, 2025
Merged

[Rule Tuning] PowerShell Rules - Misc Tuning/Severity Bumps #5486

w0rk3r merged 3 commits into from
Dec 18, 2025

Conversation

@w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Dec 17, 2025

Issues

Part of BAU maintenance https://github.com/elastic/ia-trade-team/issues/619

Summary

Adjust thresholds to reduce noise, bumps the severity of non-noisy rules.

@w0rk3r w0rk3r self-assigned this Dec 17, 2025
@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint backport: auto labels Dec 17, 2025
@botelastic botelastic bot added the bbr Building Block Rules label Dec 17, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Dec 17, 2025

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 17, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via Invalid Escape Sequences (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via Character Array Reconstruction (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via String Reordering (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via High Numeric Character Proportion (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

Mikaayenson
Mikaayenson reviewed Dec 17, 2025
View reviewed changes
rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml
| where not (
file.directory == "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads" or
file.directory like "C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\DataCollection*"
file.directory like (
Copy link
Contributor

@Mikaayenson Mikaayenson Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀

Copy link
Contributor

@Mikaayenson Mikaayenson Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should double check that this is not minstacked to a specific version (e.g. 9.1.0). It's hard to tell in the docs.

Copy link
Contributor Author

@w0rk3r w0rk3r Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As per the PR tags, it is 8.19 and up: elastic/elasticsearch#129170

Copy link
Contributor Author

@w0rk3r w0rk3r Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

elastic/elasticsearch#129554

Samirbous
Samirbous approved these changes Dec 18, 2025
View reviewed changes
rules/windows/defense_evasion_posh_obfuscation_backtick.toml
user.id
// Filter for scripts that match the pattern at least 10 times
| where Esql.script_block_pattern_count >= 10
Copy link
Contributor

@Samirbous Samirbous Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see many FPs with current count, any reason to bump it up ?

Copy link
Contributor Author

@w0rk3r w0rk3r Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is not noisy, but from what I saw, there was like 1 TP below 20, and 110 FPs

rules/windows/defense_evasion_posh_obfuscation_backtick.toml
_version,
_index,
host.name,
agent.id,
Copy link
Contributor

@Samirbous Samirbous Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see some execution error on some clusters like:

line 25:5: Unknown column [agent.id], did you mean any of [user.id, event.code]? [siem.esqlRule][Potential PowerShell Obfuscation via Invalid Escape Sequences][rule id f7a7edb5-1e5c-40a5-a67d-b1e895dce521][rule uuid 64f17c52-6c6e-479e-ba72-236f3df18f3d][exec id ae4ac43d-0d33-4d1c-9437-62284c3d4fa2][space default]

maybe agent.id is not always defined in Windows integration ?

Copy link
Contributor Author

@w0rk3r w0rk3r Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It should be, anything collected with using Elastic Agent has a agent.id (AFAIK)

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 18, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via Invalid Escape Sequences (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via Character Array Reconstruction (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via String Reordering (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via High Numeric Character Proportion (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link

tradebot-elastic commented Dec 18, 2025 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via Invalid Escape Sequences (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via Character Array Reconstruction (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via String Reordering (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential PowerShell Obfuscation via High Numeric Character Proportion (esql)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@w0rk3r w0rk3r merged commit a9bdfaa into main Dec 18, 2025
14 checks passed
@w0rk3r w0rk3r deleted the rt_0 branch December 18, 2025 11:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@Samirbous Samirbous Samirbous approved these changes

@Aegrah Aegrah Awaiting requested review from Aegrah

@terrancedejesus terrancedejesus Awaiting requested review from terrancedejesus

Assignees

@w0rk3r w0rk3r

Labels

backport: auto bbr Building Block Rules Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@w0rk3r @tradebot-elastic @Mikaayenson @Samirbous