Skip to content

[Rule Tuning] PowerShell Rules - Misc Tuning/Severity Bumps #5486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
w0rk3r merged 3 commits into from
Dec 18, 2025
Merged

[Rule Tuning] PowerShell Rules - Misc Tuning/Severity Bumps #5486

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6bf9e19
[Rule Tuning] PowerShell Misc Tuning/Severity Bump
w0rk3r Dec 17, 2025
4d0a81a
bump sev
w0rk3r Dec 18, 2025
e5f3ff5
Merge branch 'main' into rt_0
w0rk3r Dec 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions rules/windows/defense_evasion_posh_obfuscation_backtick.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/04/15"
integration = ["windows"]
maturity = "production"
updated_date = "2025/12/09"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -117,8 +117,8 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
agent.id,
Copy link
Contributor

@Samirbous Samirbous Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see some execution error on some clusters like:

line 25:5: Unknown column [agent.id], did you mean any of [user.id, event.code]? [siem.esqlRule][Potential PowerShell Obfuscation via Invalid Escape Sequences][rule id f7a7edb5-1e5c-40a5-a67d-b1e895dce521][rule uuid 64f17c52-6c6e-479e-ba72-236f3df18f3d][exec id ae4ac43d-0d33-4d1c-9437-62284c3d4fa2][space default]

maybe agent.id is not always defined in Windows integration ?

Copy link
Contributor Author

@w0rk3r w0rk3r Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It should be, anything collected with using Elastic Agent has a agent.id (AFAIK)

user.id

// Filter for scripts that match the pattern at least 10 times
| where Esql.script_block_pattern_count >= 10
Copy link
Contributor

@Samirbous Samirbous Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see many FPs with current count, any reason to bump it up ?

Copy link
Contributor Author

@w0rk3r w0rk3r Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is not noisy, but from what I saw, there was like 1 TP below 20, and 110 FPs

// Filter for scripts that match the pattern at least 20 times
| where Esql.script_block_pattern_count >= 20

| where file.name not like "TSS_*.psm1"
// ESQL requires this condition, otherwise it only returns matches where file.name exists.
Expand Down
6 changes: 3 additions & 3 deletions rules/windows/defense_evasion_posh_obfuscation_backtick_var.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/04/16"
integration = ["windows"]
maturity = "production"
updated_date = "2025/12/09"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -51,7 +51,7 @@ PowerShell, a powerful scripting language in Windows environments, can be exploi
- Implement enhanced monitoring on the affected host and similar systems to detect any recurrence of obfuscation techniques or related suspicious activities.
- Update endpoint protection and intrusion detection systems with indicators of compromise (IOCs) derived from the analysis to improve detection capabilities for similar threats in the future.
"""
risk_score = 21
risk_score = 73
rule_id = "d43f2b43-02a1-4219-8ce9-10929a32a618"
setup = """## Setup

Expand All @@ -71,7 +71,7 @@ Steps to implement the logging policy via registry:
reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
```
"""
severity = "low"
severity = "high"
tags = [
"Domain: Endpoint",
"OS: Windows",
Expand Down
6 changes: 3 additions & 3 deletions rules/windows/defense_evasion_posh_obfuscation_char_arrays.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/04/14"
integration = ["windows"]
maturity = "production"
updated_date = "2025/12/09"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -51,7 +51,7 @@ PowerShell, a powerful scripting language, is often targeted by adversaries for
- Update endpoint protection and ensure that AMSI and other security features are fully enabled and configured to detect similar threats.
- Escalate the incident to the security operations center (SOC) for further analysis and to determine if additional systems are affected.
"""
risk_score = 21
risk_score = 73
rule_id = "85e2d45e-a3df-4acf-83d3-21805f564ff4"
setup = """## Setup

Expand All @@ -71,7 +71,7 @@ Steps to implement the logging policy via registry:
reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
```
"""
severity = "low"
severity = "high"
tags = [
"Domain: Endpoint",
"OS: Windows",
Expand Down
6 changes: 3 additions & 3 deletions rules/windows/defense_evasion_posh_obfuscation_concat_dynamic.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/04/15"
integration = ["windows"]
maturity = "production"
updated_date = "2025/12/09"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -50,7 +50,7 @@ PowerShell is a powerful scripting language used for task automation and configu
- Escalate the incident to the security operations team for further analysis and to determine if additional systems have been compromised.
- Update endpoint protection and monitoring tools to enhance detection capabilities for similar obfuscation techniques, leveraging insights from the MITRE ATT&CK framework.
"""
risk_score = 21
risk_score = 73
rule_id = "083383af-b9a4-42b7-a463-29c40efe7797"
setup = """## Setup

Expand All @@ -70,7 +70,7 @@ Steps to implement the logging policy via registry:
reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
```
"""
severity = "low"
severity = "high"
tags = [
"Domain: Endpoint",
"OS: Windows",
Expand Down
9 changes: 6 additions & 3 deletions rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/04/16"
integration = ["windows"]
maturity = "production"
updated_date = "2025/12/09"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -119,12 +119,15 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
user.id

// Filter for scripts with high numeric character ratio
| where Esql.script_block_ratio > 0.30
| where Esql.script_block_ratio > 0.35

// Exclude Windows Defender Noisy Patterns
| where not (
file.directory == "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads" or
file.directory like "C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\DataCollection*"
file.directory like (
Copy link
Contributor

@Mikaayenson Mikaayenson Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀

Copy link
Contributor

@Mikaayenson Mikaayenson Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should double check that this is not minstacked to a specific version (e.g. 9.1.0). It's hard to tell in the docs.

Copy link
Contributor Author

@w0rk3r w0rk3r Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As per the PR tags, it is 8.19 and up: elastic/elasticsearch#129170

Copy link
Contributor Author

@w0rk3r w0rk3r Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

elastic/elasticsearch#129554

"C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\DataCollection*",
"C:\\\\Program Files\\\\SentinelOne\\\\Sentinel Agent*"
)
)
// ESQL requires this condition, otherwise it only returns matches where file.directory exists.
or file.directory is null
Expand Down
6 changes: 3 additions & 3 deletions rules/windows/defense_evasion_posh_obfuscation_string_format.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
creation_date = "2025/04/03"
integration = ["windows"]
maturity = "production"
updated_date = "2025/12/09"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -117,8 +117,8 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
agent.id,
user.id

// Filter for scripts that match the pattern at least four times
| where Esql.script_block_pattern_count >= 4
// Filter for scripts that match the pattern at least five times
| where Esql.script_block_pattern_count >= 5

// Exclude Noisy Patterns

Expand Down
4 changes: 2 additions & 2 deletions rules_building_block/defense_evasion_posh_obfuscation_proportion_special_chars.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ bypass_bbr_timing = true
creation_date = "2025/04/16"
integration = ["windows"]
maturity = "production"
updated_date = "2025/12/09"
updated_date = "2025/12/17"

[rule]
author = ["Elastic"]
Expand Down Expand Up @@ -86,7 +86,7 @@ from logs-windows.powershell_operational* metadata _id, _version, _index
user.id

// Filter for scripts with high special character ratio
| where Esql.script_block_ratio > 0.30
| where Esql.script_block_ratio > 0.35

// Exclude Noisy Patterns
| where not file.directory like "C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\DataCollection\\\\*"
Expand Down
Loading