Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution #3545

Merged
merged 10 commits into from
Apr 2, 2024
Merged

[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution #3545

merged 10 commits into from
Apr 2, 2024

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Mar 28, 2024

Issues

Resolves #3518

Summary

Updates the rule with more signers and processes from https://github.com/redcanaryco/surveyor/blob/master/definitions/remote-admin.json and telem.

Also (trying to) contributed back to the reference: redcanaryco/surveyor#160

@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint backport: auto labels Mar 28, 2024
@w0rk3r w0rk3r self-assigned this Mar 28, 2024
terrancedejesus
terrancedejesus approved these changes Mar 28, 2024
View reviewed changes
Copy link
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work 👍🏽
Nothing that I can find to tune FPs out, simply because we are looking for legitimate signed RMM.

@w0rk3r w0rk3r requested a review from Aegrah April 2, 2024 09:35
Aegrah
Aegrah approved these changes Apr 2, 2024
View reviewed changes
Copy link
Contributor

@Aegrah Aegrah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make sure to resolve @Samirbous's comment, prior to merging - but from my point of view LGTM.

Samirbous
Samirbous approved these changes Apr 2, 2024
View reviewed changes
Copy link
Contributor

@Samirbous Samirbous left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we need to compensate with one for sysmon/4688 based on process.name

Samirbous
Samirbous approved these changes Apr 2, 2024
View reviewed changes
Copy link
Contributor

@Samirbous Samirbous left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml Outdated Show resolved Hide resolved
@w0rk3r @Samirbous
Update rules/windows/command_and_control_new_terms_commonly_abused_ra…
8304d5a 
…t_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
Aegrah
Aegrah approved these changes Apr 2, 2024
View reviewed changes
Copy link
Contributor

@Aegrah Aegrah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with narrowing the index patterns, LGTM

@w0rk3r w0rk3r merged commit 4ab7c9b into main Apr 2, 2024
17 checks passed
@w0rk3r w0rk3r deleted the rat_tuning branch April 2, 2024 14:06
protectionsmachine pushed a commit that referenced this pull request Apr 2, 2024
@w0rk3r @github-actions
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Exec…
8079b0f 
…ution (#3545)

* [Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 4ab7c9b)
protectionsmachine pushed a commit that referenced this pull request Apr 2, 2024
@w0rk3r @github-actions
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Exec…
da00084 
…ution (#3545)

* [Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 4ab7c9b)
protectionsmachine pushed a commit that referenced this pull request Apr 2, 2024
@w0rk3r @github-actions
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Exec…
965c28a 
…ution (#3545)

* [Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 4ab7c9b)
protectionsmachine pushed a commit that referenced this pull request Apr 2, 2024
@w0rk3r @github-actions
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Exec…
97080c4 
…ution (#3545)

* [Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 4ab7c9b)
protectionsmachine pushed a commit that referenced this pull request Apr 2, 2024
@w0rk3r @github-actions
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Exec…
91d8547 
…ution (#3545)

* [Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 4ab7c9b)
protectionsmachine pushed a commit that referenced this pull request Apr 2, 2024
@w0rk3r @github-actions
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Exec…
1604f48 
…ution (#3545)

* [Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 4ab7c9b)
protectionsmachine pushed a commit that referenced this pull request Apr 2, 2024
@w0rk3r @github-actions
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Exec…
a3ba0fc 
…ution (#3545)

* [Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 4ab7c9b)
protectionsmachine pushed a commit that referenced this pull request Apr 2, 2024
@w0rk3r @github-actions
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Exec…
eca9b72 
…ution (#3545)

* [Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 4ab7c9b)
protectionsmachine pushed a commit that referenced this pull request Apr 2, 2024
@w0rk3r @github-actions
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Exec…
2e68a11 
…ution (#3545)

* [Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 4ab7c9b)
protectionsmachine pushed a commit that referenced this pull request Apr 2, 2024
@w0rk3r @github-actions
[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Exec…
d1e8748 
…ution (#3545)

* [Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update command_and_control_new_terms_commonly_abused_rat_execution.toml

* Update rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml

Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

---------

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>

(cherry picked from commit 4ab7c9b)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@Samirbous Samirbous Samirbous approved these changes

@Aegrah Aegrah Aegrah approved these changes

@brokensound77 brokensound77 Awaiting requested review from brokensound77

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

Assignees

@w0rk3r w0rk3r

Labels
backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Rule Tuning] First Time Seen Commonly Abused Remote Access Tool Execution
4 participants
@w0rk3r @Samirbous @Aegrah @terrancedejesus