[Tuning] Windows Discovery Rule Tuning for UEBA

[Aegrah]

Summary

This PR will be updated as part of the Windows tuning for UEBA project. Details on the tuning can also be found #3093. This will remain in draft until I am done tuning (makes it easier to create notes).

Reviews

This PR will not get merged until reviewed by @Samirbous @brokensound77 and @w0rk3r, as I do not want to push any rule changes to production that we do not all agree on. I tuned these rules, however ya'll have a better understanding of these rules / Windows detection engineering in general. Any changes not agreed upon, will be reverted.

Windows Account or Group Discovery

Reduces hits from 16340 to 732 last 30 days over 47 unique clusters.

Process Discovery Using Built-in Tools

No additional tuning required, was already well tuned in #3018.

Query Registry using Built-in Tools

Converted this rule to new_terms rule type. Reason being, many FPs, and difficult to tune. Converting this to new_terms using a unique user.name and process.parent.command_line will allow to remove current exclusions (as these will be filtered by statistical anomaly detection) and reduce FPs further.

Discovery of Internet Capabilities via Built-in Tools

Converted to new_terms, will reduce hits back to a minimum and allow it to be a robust DR.

Potential Network Share Discovery

Too noisy, not sure how to fix. Will leave it for now.

PowerShell Script with Discovery Capabilities

Either convert to new_terms on user.name & file.path, or not use it. Will ask Jon what he thinks later.

PowerShell Script with Password Policy Discovery Capabilities

0 hits, we will have to check whether this rule works or not.

Windows System Network Connections Discovery

Converted to new_terms, should minimize noise a lot (given that 90% of the alerts were generated by 3 specific commands by the same user).

Windows System Information Discovery

Converted to new_terms, should reduce hits by 90-95% given that 90%+ of the hits are generated by 1 process.command_line. This is from 1 cluster, however.

AdFind Command Activity

Rule has only TPs. Will not require additional tuning.

Enumeration of Administrator Accounts

Excluded system user, should now be good to include in UEBA pack. 32k alerts back to 403 in the last 30 days.

Account Discovery Command via SYSTEM Account and Whoami Process Activity

These two rules generate a lot of noise. I will create a new new_terms rule for the UEBA pack that checks for unknown user.name.

Enumerating Domain Trusts via DSQUERY.EXE

Only 3 hits last year, only TPs. No change needed.

Enumerating Domain Trusts via NLTEST.EXE

This one needed a bit of tuning. Decreased hits from 604 back to 32 in the last 30 days.

System Information Discovery via Windows Command Shell

Converted to new_terms. 500k hits in last 30 days, not tunable.

Group Policy Discovery via Microsoft GPResult Utility

Good, 200 hits last 30 days, all TPs in 35 unique clusters.

Windows Network Enumeration

Converted to new_terms, didn't see another way of minimizing FPs.

Peripheral Device Discovery

This rule is good, only TPs and limited hits. No tuning needed.

PowerShell Share Enumeration Script

Rule has limited hits. Doesn't need tuning.

PowerShell Suspicious Discovery Related Windows API Functions

Quite a lot of hits, no telemetry available of what commands are actually being ran. Think this one is not useful for UEBA. Will discuss.

External IP Lookup from Non-Browser Process

Perfect candidate for new_terms. Converted it, had a lot of noise.

Enumeration of Privileged Local Groups Membership

Converted to new_terms. Had too many FPs, and was receiving a blacklist longer than 30 lines. New_terms best solution.

Remote System Discovery Commands

Converted to new_terms, a lot of hits. Will be less noisy.

Security Software Discovery using WMIC

Needed some tuning. Removed most FPs, should be good for UEBA now.

System Service Discovery through built-in Windows Utilities

Converted to new_terms, will reduce FPs back to a minimum.

System Time Discovery

Converted to new_terms, will reduce FPs back to a minimum.

[w0rk3r]

Awesome 🧙🏼 work

[brokensound77]

do we think command line will still result in too many results? Alternative options would be parent process or convert this to a BBR

[brokensound77]

or process.executable

[Aegrah]

I think a first good step would be to try it out like this. I am quite sure this should suffice and reduce noise by a lot. Not all of these rules have representative process child or process parent. That's what the signal rule below this one is for.

[brokensound77]

lets put this field alphabetically across all of these rules

[Aegrah]

Never noticed these were alphabetically ordered. That makes sense. Will do!

[brokensound77]

idea:

we may want to consider adding a unit test where, when kibana.alert.rule.rule_id exists as a field in the query, the value rule IDs are verified to exist, to stay synced in cases of deprecations

cc: @terrancedejesus @eric-forte-elastic

[brokensound77]

in a separate PR of course

[brokensound77]

LGTM