From 019615b7954c4f52cca7de14590e1c20add43b1b Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 27 Jul 2026 19:01:23 +0200 Subject: [PATCH 01/22] fix(rules): Reduce Suspicious access to Windows Credential Manager files FPs --- ...ial_access_suspicious_access_to_windows_manager_files.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/credential_access_suspicious_access_to_windows_manager_files.yml b/rules/credential_access_suspicious_access_to_windows_manager_files.yml index e3b98ca87..f423c4f20 100644 --- a/rules/credential_access_suspicious_access_to_windows_manager_files.yml +++ b/rules/credential_access_suspicious_access_to_windows_manager_files.yml @@ -1,6 +1,6 @@ name: Suspicious access to Windows Credential Manager files id: 4ab688f7-94e2-481b-9c7f-c49f3a79a379 -version: 1.0.4 +version: 1.0.5 description: | Identifies suspicious processes trying to acquire credentials from the Windows Credential Manager. labels: @@ -25,7 +25,8 @@ condition: > ( '?:\\Program Files\\*', '?:\\Program Files(x86)\\*', - '?:\\Windows\\System32\\lsass.exe' + '?:\\Windows\\System32\\lsass.exe', + '?:\\Windows\\system32\\svchost.exe' ) min-engine-version: 3.0.0 From 75b27d16cf546f86908d4609d7c3e106f8669121 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 27 Jul 2026 21:26:18 +0200 Subject: [PATCH 02/22] fix(rules): Reduce Suspicious access to the hosts file FPs --- ..._evasion_suspicious_access_to_the_hosts_file.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml b/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml index cf7d6ac9e..a6fcd047a 100644 --- a/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml +++ b/rules/defense_evasion_suspicious_access_to_the_hosts_file.yml @@ -1,6 +1,6 @@ name: Suspicious access to the hosts file id: f7b2c9d3-99e7-41d5-bb4a-6ea1a5f7f9e2 -version: 1.1.0 +version: 1.1.1 description: > Identifies suspicious process accessing the Windows hosts file for potential tampering. Adversaries can hijack the hosts files to block traffic to download/update servers or redirect the @@ -51,7 +51,8 @@ condition: > '?:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection\\*\\Smc.exe', '?:\\Program Files (x86)\\Trend Micro\\*\\TMBMSRV.exe', '?:\\Program Files\\ESET\\ESET Security\\ekrn.exe', - '?:\\Program Files\\Sophos\\Sophos Anti-Virus\\SavService.exe' + '?:\\Program Files\\Sophos\\Sophos Anti-Virus\\SavService.exe', + '?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF\\AcroCEF.exe' ) | |open_file and @@ -61,12 +62,16 @@ condition: > '?:\\Program Files\\*\\libcef.dll!GetHandleVerifier', '?:\\Program Files (x86)\\*\\libcef.dll!GetHandleVerifier', '?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe!GetHandleVerifier', + '?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe!uv_tcp_init', + '?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe!?Create@CppHeap@v8@*', '?:\\Users\\*\\AppData\\Roaming\\Spotify\\libcef.dll!GetHandleVerifier', '?:\\Program Files\\Microsoft VS Code\\Code.exe!GetHandleVerifier', '?:\\Program Files (x86)\\Microsoft VS Code\\Code.exe!GetHandleVerifier', '?:\\Program Files\\Google\\Chrome\\*\\chrome.dll!*', - '?:\\Program Files (x86)\\Google\\Chrome\\*\\chrome.dll!*' - )) + '?:\\Program Files (x86)\\Google\\Chrome\\*\\chrome.dll!*', + '?:\\Program Files\\Microsoft\\*\\msedge.dll!*', + '?:\\Program Files (x86)\\Microsoft\\*\\msedge.dll!*' + ) and ps.signature.trusted = true, ps.signature.trusted) | action: - name: kill From eaebedc4bd94e825ce6e779af2f0f60a857ca052 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 27 Jul 2026 21:32:36 +0200 Subject: [PATCH 03/22] fix(rules): Reduce Suspicious protected process execution FPs --- ...evasion_suspicious_protected_process_execution.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/rules/defense_evasion_suspicious_protected_process_execution.yml b/rules/defense_evasion_suspicious_protected_process_execution.yml index a360e5952..21e3a7644 100644 --- a/rules/defense_evasion_suspicious_protected_process_execution.yml +++ b/rules/defense_evasion_suspicious_protected_process_execution.yml @@ -1,6 +1,6 @@ name: Suspicious protected process execution id: a778295a-02f1-42d9-9c20-78346a7bc2c6 -version: 1.0.0 +version: 1.1.0 description: | Identifies unprivileged process spawning a child with protected integrity level. This indicates an unusual behavior that is often associated with attempts to tamper with or @@ -22,12 +22,15 @@ condition: > sequence maxspan 1m30s |spawn_process and - ps.token.integrity_level != 'SYSTEM' and + ps.is_protected = false and + (ps.sid != 'S-1-5-18' or ps.token.integrity_level != 'SYSTEM') and ps.exe not imatches ( '?:\\Program Files\\*', - '?:\\Program Files(x86)\\*' - ) + '?:\\Program Files(x86)\\*', + '?:\\WINDOWS\\System32\\csrss.exe' + ) and + ps.parent.exe not imatches '?:\\WINDOWS\\System32\\smss.exe' | by ps.uuid |spawn_process and ps.is_protected| by ps.parent.uuid action: From 4b73c440cbc1c14ce0bba85dffa436face7ad9bc Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 27 Jul 2026 21:40:43 +0200 Subject: [PATCH 04/22] fix(rules): Reduce Suspicious child process integrity level FPs --- ...e_escalation_suspicious_child_process_integrity_level.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/privilege_escalation_suspicious_child_process_integrity_level.yml b/rules/privilege_escalation_suspicious_child_process_integrity_level.yml index 90ebae1b7..782e2ab50 100644 --- a/rules/privilege_escalation_suspicious_child_process_integrity_level.yml +++ b/rules/privilege_escalation_suspicious_child_process_integrity_level.yml @@ -1,6 +1,6 @@ name: Suspicious child process integrity level id: b958e949-a16a-4d66-b008-15f4e8382a6e -version: 1.0.1 +version: 1.0.2 description: | Identifies the execution of the parent process running with low/medium integrity level that spawns a child process with the system integrity level. Because normal @@ -41,7 +41,8 @@ condition: > '?:\\Windows\\System32\\WerFaultSecure.exe', '?:\\Program Files\\Google\\GoogleUpdater\\*\\updater.exe', '?:\\Program Files (x86)\\Google\\GoogleUpdater\\*\\updater.exe' - ) + ) and + not (ps.exe imatches '?:\\WINDOWS\\system32\\conhost.exe' and ps.parent.exe imatches '?:\\WINDOWS\\system32\\Clipup.exe') | by ps.parent.uuid action: - name: kill From 931edca383b8c9bd166f7e1fec68ba7986185d93 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 27 Jul 2026 21:57:36 +0200 Subject: [PATCH 05/22] fix(rules): Reduce Suspicious Vault client DLL load FPs --- ...ccess_suspicious_vault_client_dll_load.yml | 59 ++++++++++--------- 1 file changed, 30 insertions(+), 29 deletions(-) diff --git a/rules/credential_access_suspicious_vault_client_dll_load.yml b/rules/credential_access_suspicious_vault_client_dll_load.yml index 8adc79043..919715a88 100644 --- a/rules/credential_access_suspicious_vault_client_dll_load.yml +++ b/rules/credential_access_suspicious_vault_client_dll_load.yml @@ -1,6 +1,6 @@ name: Suspicious Vault client DLL load id: 64af2e2e-2309-4079-9c0f-985f1dd930f5 -version: 1.0.7 +version: 1.0.8 description: | Identifies loading of the Vault client DLL by an unusual process. Adversaries can abuse the functions provided by the Credential Vault Client Library to enumerate or harvest saved credentials. @@ -24,34 +24,35 @@ condition: > by ps.uuid |spawn_process and ps.sid not in ('S-1-5-18', 'S-1-5-19', 'S-1-5-20') and ps.exe != '' and - not (ps.exe imatches - ( - '?:\\Windows\\System32\\MDMAppInstaller.exe', - '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe', - '?:\\Windows\\uus\\*\\WaaSMedicAgent.exe', - '?:\\Windows\\System32\\UCConfigTask.exe', - '?:\\Windows\\System32\\DllHost.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe', - '?:\\Program Files\\*.exe', - '?:\\Program Files (x86)\\*.exe', - '?:\\Windows\\winsxs\\*\\TiWorker.exe', - '?:\\Windows\\System32\\RuntimeBroker.exe', - '?:\\WINDOWS\\system32\\UCConfigTask.exe', - '?:\\Program Files\\WindowsApps\\Microsoft.*.exe', - '?:\\Windows\\System32\\SecurityHealth\\*\\SecurityHealthHost.exe', - '?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe', - '?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe', - '?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe', - '?:\\Windows\\System32\\PickerHost.exe', - '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe', - '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\AppActions.exe', - '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe', - '?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe', - '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe', - '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe' - )) and + ps.exe not imatches + ( + '?:\\Windows\\System32\\MDMAppInstaller.exe', + '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe', + '?:\\Windows\\uus\\*\\WaaSMedicAgent.exe', + '?:\\Windows\\System32\\UCConfigTask.exe', + '?:\\Windows\\System32\\DllHost.exe', + '?:\\WINDOWS\\explorer.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe', + '?:\\Program Files\\*.exe', + '?:\\Program Files (x86)\\*.exe', + '?:\\Windows\\winsxs\\*\\TiWorker.exe', + '?:\\Windows\\System32\\RuntimeBroker.exe', + '?:\\WINDOWS\\system32\\UCConfigTask.exe', + '?:\\Program Files\\WindowsApps\\Microsoft.*.exe', + '?:\\Windows\\System32\\SecurityHealth\\*\\SecurityHealthHost.exe', + '?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe', + '?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe', + '?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe', + '?:\\Windows\\System32\\PickerHost.exe', + '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe', + '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\AppActions.exe', + '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe', + '?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe', + '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe' + ) and not (ps.exe imatches '?:\\WINDOWS\\System32\\taskhostw.exe' and ps.parent.args intersects ('-k', 'netsvcs', '-p', '-s', 'Schedule')) and not (ps.exe imatches '?:\\WINDOWS\\system32\\BackgroundTaskHost.exe' and ps.args imatches ('-ServerName:*')) and not (ps.parent.exe imatches '?:\\Windows\\System32\\services.exe') and From 84e9cdb592d216924380ddde86704347f1e9b1f8 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Wed, 29 Jul 2026 22:12:13 +0200 Subject: [PATCH 06/22] fix(rules): Reduce Potential process injection via tainted memory section FPs --- ...process_injection_via_tainted_memory_section.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml b/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml index 0e61f6819..89d877e76 100644 --- a/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml +++ b/rules/defense_evasion_potential_process_injection_via_tainted_memory_section.yml @@ -1,6 +1,6 @@ name: Potential process injection via tainted memory section id: 8e4182f3-02e7-4e95-afc3-93d18c9a9c09 -version: 1.0.6 +version: 1.0.8 description: | Identifies potential process injection when the adversary creates and maps a memory section with RW protection rights followed by mapping of the same memory section in @@ -38,8 +38,15 @@ condition: > '?:\\WINDOWS\\System32\\lsass.exe', '?:\\WINDOWS\\System32\\SecurityHealthService.exe', '?:\\WINDOWS\\System32\\services.exe', - '?:\\WINDOWS\\System32\\RuntimeBroker.exe' - ) + '?:\\WINDOWS\\System32\\RuntimeBroker.exe', + '?:\\WINDOWS\\System32\\sihost.exe', + '?:\\WINDOWS\\System32\\smartscreen.exe', + '?:\\WINDOWS\\System32\\taskhostw.exe', + '?:\\WINDOWS\\System32\\wbem\\wmiprvse.exe', + '?:\\WINDOWS\\System32\\backgroundTaskHost.exe', + '?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe' + ) and + not (ps.parent.exe imatches '?:\\WINDOWS\\Explorer.exe' and ps.signature.exists = true and ps.signature.trusted = true) | as e1 |map_view_of_section and file.view.protection = 'READONLY|EXECUTE' and file.key = $e1.file.key and evt.pid != $e1.evt.pid| action: From 959eb13c5b5a2d624e9a56f4ab9edfa1ec565a34 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 1 Aug 2026 21:52:07 +0200 Subject: [PATCH 07/22] fix(rules): Reduce CldApi DLL loaded by an unusual process FPs --- ...vasion_cldapi_dll_loaded_by_an_unusual_process.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml b/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml index 17dca5561..34da3031a 100644 --- a/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml +++ b/rules/defense_evasion_cldapi_dll_loaded_by_an_unusual_process.yml @@ -1,6 +1,6 @@ name: CldApi DLL loaded by an unusual process id: 450aee38-e8cf-47bc-8315-d16b13d740cb -version: 1.0.0 +version: 1.0.1 description: | Detects the loading of cldapi.dll (Cloud Filter API) by processes other than those legitimately associated with Windows Cloud Files infrastructure and OneDrive @@ -27,13 +27,15 @@ condition: > '?:\\Windows\\System32\\SearchProtocolHost.exe', '?:\\Windows\\System32\\svchost.exe', '?:\\Windows\\System32\\sihost.exe', - '?:\\Windows\\System32\\explorer.exe', + '?:\\Windows\\explorer.exe', '?:\\Windows\\System32\\ShellHost.exe', '?:\\Windows\\System32\\FileSyncConfig.exe', '?:\\Windows\\System32\\WorkFolders.exe', '?:\\Windows\\System32\\OneDriveSetup.exe', '?:\\Windows\\SysWOW64\\OneDriveSetup.exe', '?:\\Windows\\SystemApps\\Microsoft.Windows.Search_*\\SearchApp.exe', + '?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe', + '?:\\Program Files\\Microsoft OneDrive\\FileCoAuth.exe', '?:\\Program Files\\Microsoft OneDrive\\*\\OneDrive.exe', '?:\\Program Files\\Microsoft OneDrive\\*\\FileCoAuth.exe', '?:\\Program Files\\Microsoft OneDrive\\*\\OneDriveUpdaterService.exe', @@ -56,7 +58,10 @@ condition: > '?:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe', '?:\\Program Files\\Dropbox\\Client\\Dropbox.exe', '?:\\Program Files\\Adobe\\Adobe Creative Cloud\\ACC\\Creative Cloud.exe', - '?:\\Program Files\\Autodesk\\Desktop App\\AdAppMgrSvc.exe' + '?:\\Program Files\\Autodesk\\Desktop App\\AdAppMgrSvc.exe', + '?:\\Program Files\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe', + '?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe', + '?:\\WINDOWS\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_*\\StartMenuExperienceHost.exe' ) action: - name: kill From 8343d1b7066c46a467c008b25a66c63776d494bf Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 1 Aug 2026 23:15:07 +0200 Subject: [PATCH 08/22] fix(rules): Reduce Direct disk device access FPs --- ...ense_evasion_direct_disk_device_access.yml | 25 ++++++++++++++++--- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/rules/defense_evasion_direct_disk_device_access.yml b/rules/defense_evasion_direct_disk_device_access.yml index d6f6b233f..4595ab948 100644 --- a/rules/defense_evasion_direct_disk_device_access.yml +++ b/rules/defense_evasion_direct_disk_device_access.yml @@ -1,6 +1,6 @@ name: Direct disk device access id: b77914b8-9e91-46ab-8f52-342a2848c59e -version: 1.0.0 +version: 1.0.1 description: | Detects direct access to raw disk devices or volumes by user-mode processes, bypassing the Windows filesystem layer. Attackers abuse raw disk handles to @@ -33,7 +33,10 @@ condition: > ) and ps.exe not imatches ( + '?:\\Windows\\explorer.exe', '?:\\Windows\\System32\\svchost.exe', + '?:\\Windows\\System32\\lsass.exe', + '?:\\Windows\\System32\\devicesensus.exe', '?:\\Windows\\System32\\services.exe', '?:\\Windows\\System32\\defrag.exe', '?:\\Windows\\System32\\chkdsk.exe', @@ -42,6 +45,14 @@ condition: > '?:\\Windows\\System32\\dfrg.msc', '?:\\Windows\\System32\\wbadmin.exe', '?:\\Windows\\System32\\fsutil.exe', + '?:\\Windows\\System32\\MRT.exe', + '?:\\Windows\\System32\\srtasks.exe', + '?:\\Windows\\System32\\taskhostw.exe', + '?:\\Windows\\System32\\wbem\\wmiprvse.exe', + '?:\\Windows\\System32\\SearchIndexer.exe', + '?:\\Windows\\uus\\*\\MoUsoCoreWorker.exe', + '?:\\Windows\\winsxs\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe', + '?:\\Windows\\System32\\SecurityHealthService.exe', '?:\\Program Files\\VMware\\VMware Workstation\\vmware.exe', '?:\\Program Files (x86)\\VMware\\VMware Workstation\\vmware.exe', '?:\\Program Files\\Oracle\\VirtualBox\\VBoxSVC.exe', @@ -51,9 +62,15 @@ condition: > '?:\\Program Files\\Windows Defender\\MsMpEng.exe', '?:\\Program Files\\Windows Defender\\NisSrv.exe', '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe', - '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\NisSrv.exe' - ) + '?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\NisSrv.exe', + '?:\\WINDOWS\\SystemApps\\MicrosoftWindows.Client.CBS_*\\SearchHost.exe', + '?:\\WINDOWS\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_*\\StartMenuExperienceHost.exe' + ) and + not (ps.exe imatches '?:\\WINDOWS\\system32\\vssvc.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\services.exe') and + not (file.path imatches '\\Device\\HarddiskVolume*\\EFI\\OEM\\Boot' and ps.token.integrity_level = 'SYSTEM') and + not (thread.callstack.kernel_summary imatches '*|CI.dll|ntoskrnl.exe|clipsp.sys|*' and ps.signature.trusted = true) and + not (thread.callstack.symbols imatches ('sechost.dll!TraceSetInformation') and ps.signature.trusted = true and ps.signature.subject imatches '*Microsoft Corporation*') severity: high -min-engine-version: 3.0.0 +min-engine-version: 3.1.0 From 7ca8be07f0f2dfeb866849f7261d08a7b643bd1f Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 1 Aug 2026 23:18:42 +0200 Subject: [PATCH 09/22] fix(rules): Reduce BindFlt DLL loaded by an unusual process FPs --- ...ense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml b/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml index a2f450c53..f4df9f4bc 100644 --- a/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml +++ b/rules/defense_evasion_bindflt_dll_loaded_by_an_unusual_process.yml @@ -1,6 +1,6 @@ name: BindFlt DLL loaded by an unusual process id: fa439e69-2a73-49f9-8385-0e7f801f67db -version: 1.0.0 +version: 1.0.1 description: | Detects the loading of bindfltapi.dll, bindflt.dll, or bindlink.dll DLL family that represents user-mode API surface of the Windows Bind Filter driver (bindflt.sys) @@ -45,7 +45,8 @@ condition: > '?:\\Users\\*\\AppData\\Local\\Docker\\Desktop\\Docker Desktop.exe' ) and not (ps.sid = 'S-1-5-18' and ps.exe imatches ('?:\\Windows\\System32\\*.exe', '?:\\Windows\\SysWOW64\\*.exe') and - ps.signature.subject imatches ('*Microsoft Windows*', '*Microsoft Corporation*') and ps.signature.trusted = true) + ps.signature.subject imatches ('*Microsoft Windows*', '*Microsoft Corporation*') and ps.signature.trusted = true) and + not (ps.exe imatches '?:\\Windows\\winsxs\\*\\TiWorker.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe') action: - name: kill From fb0165d271c18e0c382549d164028a7404807059 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 1 Aug 2026 23:40:26 +0200 Subject: [PATCH 10/22] fix(rules): Reduce NET assembly loaded by unmanaged process FPs --- ..._dotnet_assembly_loaded_by_unmanaged_process.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml b/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml index fa14f3d7e..321dca76b 100644 --- a/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml +++ b/rules/defense_evasion_dotnet_assembly_loaded_by_unmanaged_process.yml @@ -1,6 +1,6 @@ name: .NET assembly loaded by unmanaged process id: 34be8bd1-1143-4fa8-bed4-ae2566b1394a -version: 1.2.0 +version: 1.2.1 description: | Identifies the loading of the .NET assembly by an unmanaged process. Adversaries can load the CLR runtime inside unmanaged process and execute the assembly via the ICLRRuntimeHost::ExecuteInDefaultAppDomain method. @@ -35,21 +35,26 @@ condition: > '?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe', '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe', '?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe', - '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\WinStore.DesktopExtension\\StoreDesktopExtension.exe' + '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\WinStore.DesktopExtension\\StoreDesktopExtension.exe', + '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxRemoteSession.exe', + '?:\\Program Files\\WindowsApps\\Microsoft*\\MicrosoftSecurityApp\\MicrosoftSecurityApp.exe' ) | |(load_unsigned_or_untrusted_module) and dll.path not imatches ( '?:\\Windows\\System32\\*.dll', - '?:\\Windows\\assembly\\*\\*.ni.dll', + '?:\\Windows\\assembly\\*', '?:\\Program Files\\WindowsPowerShell\\Modules\\*\\*.dll', '?:\\Windows\\Microsoft.NET\\assembly\\*\\*.dll', '?:\\$WinREAgent\\Scratch\\*.dll', '?:\\Windows\\WinSxS\\*.dll', '?:\\Windows\\CbsTemp\\*.dll', '?:\\Windows\\SoftwareDistribution\\*.dll', - '?:\\Program Files\\WindowsApps\\Microsoft.WindowsStore_*\\*.dll' + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\*.dll', + '?:\\Windows\\Microsoft.NET\\Framework64\\*\\*.dll', + '?:\\Program Files\\WindowsApps\\*', + '?:\\Program Files\\dotnet\\shared\\*\\*.dll' ) and ps.exe != '' and ps.pe.is_dotnet = false and (dll.pe.is_dotnet or thread.callstack.modules imatches ('*clr.dll')) From c64051b2a53250958f6df2abb1c13482c5ccde0d Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 3 Aug 2026 10:59:44 +0200 Subject: [PATCH 11/22] fix(rules): Reduce Activation Context memory section hijacking FPs --- ...vasion_activation_context_memory_section_hijacking.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/rules/defense_evasion_activation_context_memory_section_hijacking.yml b/rules/defense_evasion_activation_context_memory_section_hijacking.yml index 33738daf4..a7f9a1ae1 100644 --- a/rules/defense_evasion_activation_context_memory_section_hijacking.yml +++ b/rules/defense_evasion_activation_context_memory_section_hijacking.yml @@ -1,6 +1,6 @@ name: Activation Context memory section hijacking id: 3d56281e-9608-4a70-b7b7-7651ccd3752b -version: 1.0.0 +version: 1.0.1 description: | Detects abuses of a legitimate Windows feature present in most processes called Activation Contexts with the objective of loading an arbitrary DLL @@ -26,12 +26,16 @@ condition: > |unmap_view_file and file.view.type = 'PAGEFILE' and file.view.protection = 'READONLY' and (file.view.size = 12288 or (file.view.size = 4096 and + not (ps.exe imatches '?:\\Windows\\explorer.exe') and + not (ps.parent.exe imatches '?:\\Windows\\System32\\services.exe' and ps.exe imatches '?:\\Windows\\System32\\svchost.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches '?:\\Windows\\System32\\taskhostw.exe') and not (ps.parent.exe imatches '?:\\Windows\\explorer.exe' and ps.exe imatches '?:\\Program Files\\WindowsApps\\*.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\winlogon.exe' and ps.exe imatches '?:\\Windows\\System32\\dwm.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\winlogon.exe' and ps.exe imatches '?:\\Windows\\System32\\csrss.exe') and not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches '?:\\Program Files\\Microsoft Office\\*\\ActionsServer\\ActionsServer.exe') and - not (ps.parent.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.cmdline imatches concat('*-contentproc -parentBuildID* -parentPid ', ps.ppid))) + not (ps.parent.exe imatches '?:\\Windows\\System32\\svchost.exe' and ps.exe imatches 'C:\\WINDOWS\\SystemApps\\ShellExperienceHost_*\\ShellExperienceHost.exe') and + not (ps.parent.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.exe imatches '?:\\Program Files\\Mozilla Firefox\\firefox.exe' and ps.cmdline imatches concat('*-contentproc -parentBuildID* -parentPid ', ps.ppid))) and + not (ps.name iin ('procexp.exe', 'procexp64.exe') and ps.signature.trusted = true and ps.signature.subject imatches '*Microsoft Corporation*') ) | |map_view_file and file.view.size = 12288 and file.view.type = 'PAGEFILE' and file.view.protection = 'READWRITE'| From a84941fb4be7862b510624e1fbd1f5fb83e004ec Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 3 Aug 2026 21:56:21 +0200 Subject: [PATCH 12/22] fix(rules): Reduce Process execution from hollowed memory section FPs --- ...asion_process_execution_from_hollowed_memory_section.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml b/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml index f3fa84996..b9e3f2374 100644 --- a/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml +++ b/rules/defense_evasion_process_execution_from_hollowed_memory_section.yml @@ -1,6 +1,6 @@ name: Process execution from hollowed memory section id: 2a3fbae8-5e8c-4b71-b9da-56c3958c0d53 -version: 2.1.3 +version: 2.1.4 description: | Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code @@ -32,7 +32,9 @@ condition: > '?:\\Windows\\System32\\services.exe', '?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe', '?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe' - ) + ) and + not (ps.exe imatches '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxServer.exe' and ps.parent.exe imatches '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxRemoteSession.exe') and + not (ps.exe imatches '?:\\Program Files\\WindowsApps\\MicrosoftWindows.WindowsSandbox_*\\WindowsSandboxRemoteSession.exe' and ps.parent.exe imatches '?:\\Windows\\explorer.exe') | by ps.uuid, file.view.base |load_executable and module.path not imatches '?:\\Windows\\SoftwareDistribution\\Download\\*\\Package_for_RollupFix*\\*.exe' and From 96dd14c8dc0f21db22bae7c98023fc82a12507cb Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 3 Aug 2026 22:05:15 +0200 Subject: [PATCH 13/22] fix(rules): Check process parent args in Clickfix phishing via browser dialog box --- ...initial_access_clickfix_phishing_via_browser_dialog_box.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml b/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml index b672f791d..4a7c015dd 100644 --- a/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml +++ b/rules/initial_access_clickfix_phishing_via_browser_dialog_box.yml @@ -1,6 +1,6 @@ name: Clickfix phishing via browser dialog box id: 5fc4bf43-fbb6-4a78-a2cc-1fe9138bd3c2 -version: 1.0.0 +version: 1.0.1 description: | Identifies a ClickFix-style social-engineering phishing attempt and its FileFix evolution where a web page coerces a user into interacting with a trusted File Explorer address bar so @@ -23,6 +23,7 @@ references: condition: > spawn_process and ps.parent.name iin web_browser_binaries and + (ps.parent.args iintersects ('--service-sandbox-type=none', '--message-loop-type-ui') or ps.parent.args iintersects ('-contentproc', 'utility')) and (ps.name iin script_interpreters or ps.name iin ('msiexec.exe', 'rundll32.exe', 'curl.exe', 'wget.exe', 'certutil.exe', 'certreq.exe', 'msbuild.exe') or ps.exe imatches '?:\\Users\\*\\Downloads\\*') and thread.callstack.summary imatches 'ntdll.dll|*|windows.storage.dll|shell32.dll|windows.storage.dll|SHCore.dll|*' From ae827bd026b4e151c58b5d229aa1f3d380b7ac1b Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 3 Aug 2026 22:24:47 +0200 Subject: [PATCH 14/22] fix(rules): Reduce Hidden registry key creation FPs --- rules/defense_evasion_hidden_registry_key_creation.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/rules/defense_evasion_hidden_registry_key_creation.yml b/rules/defense_evasion_hidden_registry_key_creation.yml index ebc48939d..cac9528f6 100644 --- a/rules/defense_evasion_hidden_registry_key_creation.yml +++ b/rules/defense_evasion_hidden_registry_key_creation.yml @@ -1,6 +1,6 @@ name: Hidden registry key creation id: 65deda38-9b1d-42a0-9f40-a68903e81b49 -version: 1.1.7 +version: 1.1.8 description: | Identifies the creation of a hidden registry key. Adversaries can utilize the native NtSetValueKey API to create a hidden registry key and conceal payloads @@ -31,13 +31,15 @@ condition: > '?:\\Windows\\System32\\svchost.exe', '?:\\Windows\\WinSxS\\*\\TiWorker.exe', '?:\\Windows\\UUS\\*\\wuaucltcore.exe', - '?:\\$WinREAgent\\Scratch\\*\\DismHost.exe' + '?:\\$WinREAgent\\Scratch\\*\\DismHost.exe', + '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\containerworker.exe' ) and ps.parent.exe not imatches ( '?:\\WINDOWS\\uus\\*\\wuaucltcore.exe', '?:\\WINDOWS\\System32\\svchost.exe' - ) + ) and + not (ps.exe imatches '?:\\Windows\\*' and thread.callstack.summary imatches ('ntdll.dll|wcp.dll|CbsCore.dll|turbostsack.dll|*', 'ntdll.dll|drvstore.dll|drupdate.dll|CbsCore.dll|turbostsack.dll|*')) output: > Hidden registry key %registry.path created by process %ps.exe From ab4fecffb0112a2eb4f0a5b16ce5a1f1bd2af519 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Mon, 3 Aug 2026 22:29:02 +0200 Subject: [PATCH 15/22] fix(rules): Reduce Process execution from a self-deleting binary FPs --- ...evasion_process_execution_from_self_deleting_binary.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/rules/defense_evasion_process_execution_from_self_deleting_binary.yml b/rules/defense_evasion_process_execution_from_self_deleting_binary.yml index c82042e2f..cc5ac8c62 100644 --- a/rules/defense_evasion_process_execution_from_self_deleting_binary.yml +++ b/rules/defense_evasion_process_execution_from_self_deleting_binary.yml @@ -1,6 +1,6 @@ name: Process execution from a self-deleting binary id: 0f0da517-b22c-4d14-9adc-36baeb621cf7 -version: 1.0.6 +version: 1.0.7 description: | Identifies the execution of the process from a self-deleting binary. The attackers can abuse undocumented API functions to create a process from a file-backed section. The file @@ -19,7 +19,7 @@ references: condition: > sequence - maxspan 1m + maxspan 1m |delete_file and file.info.is_disposition_delete_file and ps.exe not imatches @@ -29,7 +29,8 @@ condition: > '?:\\WINDOWS\\uus\\packages\\preview\\*\\MoUsoCoreWorker.exe', '?:\\WINDOWS\\System32\\svchost.exe', '?:\\WINDOWS\\winsxs\\*\\TiWorker.exe', - '?:\\Windows\\UUS\\*\\wuaucltcore.exe' + '?:\\Windows\\UUS\\*\\wuaucltcore.exe', + '?:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\containerworker.exe' ) and ps.parent.exe not imatches '?:\\WINDOWS\\uus\\*\\wuaucltcore.exe' and file.path not imatches From a3ead80cf7f19228955cae0bcda4a0bd0da31b54 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Wed, 5 Aug 2026 01:17:14 +0200 Subject: [PATCH 16/22] fix(rules): Reduce Suspicious LSASS process access FPs --- .../credential_access_suspicious_lsass_process_access.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/rules/credential_access_suspicious_lsass_process_access.yml b/rules/credential_access_suspicious_lsass_process_access.yml index a99f4903b..9030e92d5 100644 --- a/rules/credential_access_suspicious_lsass_process_access.yml +++ b/rules/credential_access_suspicious_lsass_process_access.yml @@ -1,6 +1,6 @@ name: Suspicious LSASS process access id: 40e59763-62c6-4ae7-8c8a-5d4167d3b4e9 -version: 1.0.0 +version: 1.0.1 description: | Identifies processes requesting high-privilege access to the Local Security Authority Subsystem Service (LSASS) process @@ -35,12 +35,15 @@ condition: > '?:\\Windows\\system32\\MRT.exe', '?:\\Windows\\System32\\wininit.exe', '?:\\Windows\\System32\\services.exe', + '?:\\WINDOWS\\System32\\taskhostw.exe', '?:\\Windows\\Sysmon.exe', '?:\\Windows\\Sysmon64.exe', '?:\\Windows\\System32\\msiexec.exe', '?:\\Windows\\system32\\wbem\\wmiprvse.exe', '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe' - ) + ) and + not (ps.exe imatches '?:\\Windows\\System32\\lsass.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\wininit.exe') and + not (thread.callstack.final_user_module.signature.trusted = true and thread.callstack.final_user_module.signature.subject imatches '*Microsoft Corporation*' and thread.callstack.modules not imatches ('*dbgcore.dll', '*comsvcs.dll')) severity: high From 8ef8bceaf8daa80bdb5ff11c7516fa3cde74ebf4 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Wed, 5 Aug 2026 18:30:13 +0200 Subject: [PATCH 17/22] fix(rules): Reduce Embedded script execution via shortcut file FPs --- ...execution_embedded_script_execution_via_shortcut_file.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/execution_embedded_script_execution_via_shortcut_file.yml b/rules/execution_embedded_script_execution_via_shortcut_file.yml index df041e05b..e91d6b6d5 100644 --- a/rules/execution_embedded_script_execution_via_shortcut_file.yml +++ b/rules/execution_embedded_script_execution_via_shortcut_file.yml @@ -1,6 +1,6 @@ name: Embedded script execution via shortcut file id: 2d94a68b-03fe-4ece-9a99-f4de8ff7261d -version: 1.0.1 +version: 1.0.2 description: | Detects execution of embedded scripts delivered via Windows shortcut (.lnk) files. Adversaries can exploit the attack chain where a shortcut file is accessed by a @@ -26,7 +26,8 @@ condition: > by ps.sessionid |open_file and ps.name iin ('cmd.exe', 'findstr.exe', 'find.exe', 'powershell.exe', 'pwsh.exe') and - file.path imatches '?:\\*.lnk' + file.path imatches '?:\\*.lnk' and + file.path not imatches '?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Powershell\\Windows PowerShell.lnk' | |create_file and ps.name iin ('cmd.exe', 'powershell.exe', 'pwsh.exe') and From ac2a615ab0c8c4bb9a66eb33a08a887c4e94219a Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Wed, 5 Aug 2026 18:42:47 +0200 Subject: [PATCH 18/22] fix(rules): Reduce Registry access to SAM database FPs --- rules/credential_access_registry_access_to_sam_database.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/credential_access_registry_access_to_sam_database.yml b/rules/credential_access_registry_access_to_sam_database.yml index e080ee2f9..74f4d3bbf 100644 --- a/rules/credential_access_registry_access_to_sam_database.yml +++ b/rules/credential_access_registry_access_to_sam_database.yml @@ -1,6 +1,6 @@ name: Registry access to SAM database id: 2f326557-0291-4eb1-a87a-7a17b7d941cb -version: 2.0.3 +version: 2.0.4 description: Identifies access to the Security Account Manager registry hives. labels: @@ -35,6 +35,7 @@ condition: > registry.path not imatches ( 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users', + 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\*\\InprocServer32', 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names', 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names\\WDAGUtilityAccount\\ChannelReferences', 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account', From 6386b72419b449bd832d016e653e19e72873fadd Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Wed, 5 Aug 2026 18:53:06 +0200 Subject: [PATCH 19/22] fix(rules): Reduce File access to SAM database FPs --- rules/credentail_access_file_access_to_sam_database.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/credentail_access_file_access_to_sam_database.yml b/rules/credentail_access_file_access_to_sam_database.yml index 7e290d6fe..3cdafb811 100644 --- a/rules/credentail_access_file_access_to_sam_database.yml +++ b/rules/credentail_access_file_access_to_sam_database.yml @@ -1,6 +1,6 @@ name: File access to SAM database id: e3dace20-4962-4381-884e-40dcdde66626 -version: 1.0.7 +version: 1.0.8 description: | Identifies access to the Security Account Manager on-disk database. labels: @@ -33,7 +33,8 @@ condition: > '?:\\Windows\\System32\\vmwp.exe', '?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe', '?:\\Windows\\System32\\wuauclt.exe', - '?:\\Windows\\System32\\MRT.exe' + '?:\\Windows\\System32\\MRT.exe', + '?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe' ) min-engine-version: 3.0.0 From 30a54b8f074fd60ace69afb138551aac1bb11e80 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 8 Aug 2026 16:23:46 +0200 Subject: [PATCH 20/22] fix(rules): Reduce Potential privilege elevation via arbitrary section creation FPs --- ...privilege_elevation_via_arbitrary_section_creation.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/rules/privilege_escalation_potential_privilege_elevation_via_arbitrary_section_creation.yml b/rules/privilege_escalation_potential_privilege_elevation_via_arbitrary_section_creation.yml index 18c05e6cd..520f7473e 100644 --- a/rules/privilege_escalation_potential_privilege_elevation_via_arbitrary_section_creation.yml +++ b/rules/privilege_escalation_potential_privilege_elevation_via_arbitrary_section_creation.yml @@ -1,6 +1,6 @@ name: Potential privilege elevation via arbitrary section creation id: a232b3e4-17ac-4b0c-bcd3-43816b92d15d -version: 1.0.0 +version: 1.0.1 description: | Identifies potential privilege escalation attempts where a non-SYSTEM process creates symbolic links targeting object manager namespaces specific to memory section objects @@ -30,7 +30,9 @@ condition: > '\\KnownDlls\\*', '\\KnownDlls32\\*', '\\Device\\*' - ) + ) and + not (evt.arg[target] imatches '\\Device\\lwm\\NetworkInterface\\*') and + not (thread.callstack.kernel_summary imatches '*|ndis.sys|*|vmswitch.sys|vmsproxy.sys|*') | |spawn_process and ps.token.integrity_level = 'SYSTEM' and @@ -43,4 +45,4 @@ condition: > severity: high -min-engine-version: 3.0.0 +min-engine-version: 3.1.0 From 556b7f6344295eb1fac0ba3ef6469313c0ea1c75 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 8 Aug 2026 16:29:35 +0200 Subject: [PATCH 21/22] fix(rules): Fix smss.exe typo in callstack summary --- ...evasion_potential_operation_evasion_via_direct_syscall.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/defense_evasion_potential_operation_evasion_via_direct_syscall.yml b/rules/defense_evasion_potential_operation_evasion_via_direct_syscall.yml index aa1910519..e784e00ec 100644 --- a/rules/defense_evasion_potential_operation_evasion_via_direct_syscall.yml +++ b/rules/defense_evasion_potential_operation_evasion_via_direct_syscall.yml @@ -1,6 +1,6 @@ name: Potential operation evasion via direct syscall id: 4d91ae23-ba4f-44a1-9952-a7e634d39ceb -version: 1.0.0 +version: 1.0.1 description: | Identifies processes invoking system operations via direct syscalls. Adversaries and offensive tooling use this technique to evade user-mode @@ -31,7 +31,7 @@ condition: > evt.pid != 4 and ps.name != '' and thread.callstack.summary istartswith ps.name ) ) and - not ((ps.exe imatches '?:\\Windows\\System32\\smss.exe' or ps.parent.exe imatches '?:\\Windows\\System32\\smss.exe') and thread.callstack.summary imatches 'ntdll.dll|smsss.exe|*') and + not ((ps.exe imatches '?:\\Windows\\System32\\smss.exe' or ps.parent.exe imatches '?:\\Windows\\System32\\smss.exe') and thread.callstack.summary imatches 'ntdll.dll|smss.exe|*') and not (ps.exe imatches '?:\\Windows\\System32\\WerFault.exe' and thread.callstack.summary imatches 'ntdll.dll|kernelbase.dll|faultrep.dll|wersvc.dll|ntdll.dll|kernel32.dll|ntdll.dll') and not (ps.exe imatches '?:\\Windows\\System32\\WUDFCompanionHost.exe' and ps.parent.exe imatches '?:\\Windows\\System32\\services.exe') and not (spawn_process and ps.exe imatches '?:\\Windows\\System32\\WUDFCompanionHost.exe' and thread.callstack.summary imatches 'ntdll.dll|vmwp.exe|ntdll.dll*') and From 9d546505d7319c5e8ba653e950f7cabf9b725f90 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Sat, 8 Aug 2026 17:11:17 +0200 Subject: [PATCH 22/22] fix(rules): Remove open_file event predicate --- ...ege_escalation_exploitation_via_common_log_file_system.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/privilege_escalation_exploitation_via_common_log_file_system.yml b/rules/privilege_escalation_exploitation_via_common_log_file_system.yml index e8a9639ed..60affe8a9 100644 --- a/rules/privilege_escalation_exploitation_via_common_log_file_system.yml +++ b/rules/privilege_escalation_exploitation_via_common_log_file_system.yml @@ -1,6 +1,6 @@ name: Exploitation via Common Log File System id: 74624a2e-1ca6-4214-9065-9f96d60e9cc6 -version: 1.0.0 +version: 1.0.1 description: | Identifies potential Common Log File System (CLFS) exploitation for privilege escalation by non-SYSTEM processes invoking CLFS log file @@ -20,7 +20,7 @@ references: condition: > sequence maxspan 1m30s - |((open_file) or (create_file)) and + |create_file and ps.sid != 'S-1-5-18' and thread.callstack.symbols imatches ('clfsw32.dll!CreateLogFile*', 'clfsw32.dll!AddLogContainerSet*') | by ps.uuid