[Rule Tuning] Windows Misc Tunings (#6379)

* [Rule Tuning] Windows Misc Tunings

* Update privilege_escalation_unusual_parentchild_relationship.toml

* Update privilege_escalation_via_ppid_spoofing.toml

* Update privilege_escalation_via_ppid_spoofing.toml

* Update privilege_escalation_unusual_parentchild_relationship.toml

Author: w0rk3r

rules/windows/command_and_control_screenconnect_childproc.toml

@@ -2,7 +2,7 @@
 creation_date = "2024/03/27"
 integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "system", "crowdstrike"]
 maturity = "production"
-updated_date = "2026/05/04"
+updated_date = "2026/07/02"
 
 [rule]
 author = ["Elastic"]
@@ -99,7 +99,7 @@ process where host.os.type == "windows" and event.type == "start" and
    (process.name : "rundll32.exe" and not process.args : "url.dll,FileProtocolHandler") or
    (process.name : "msiexec.exe" and process.args : ("/i", "-i") and
     process.args : ("/q", "/quiet", "/qn", "-q", "-quiet", "-qn", "-Q+")) or
-   process.name : ("mshta.exe", "certutil.exe", "bistadmin.exe", "certreq.exe", "wscript.exe", "cscript.exe", "curl.exe",
+   process.name : ("mshta.exe", "certutil.exe", "bitsadmin.exe", "certreq.exe", "wscript.exe", "cscript.exe", "curl.exe",
                    "ssh.exe", "scp.exe", "wevtutil.exe", "wget.exe", "wmic.exe")
    )
 '''

rules/windows/defense_evasion_untrusted_driver_loaded.toml

@@ -2,7 +2,7 @@
 creation_date = "2023/01/27"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2026/05/01"
+updated_date = "2026/07/02"
 
 [rule]
 author = ["Elastic"]
@@ -39,12 +39,14 @@ driver where host.os.type == "windows" and process.pid == 4 and
   /* errorExpired and errorRevoked are handled by d12bac54-ab2a-4159-933f-d7bcefa7b61d */
   not dll.code_signature.status : ("errorExpired", "errorRevoked", "errorCode_endpoint:*") and
   
-  /* HP DOT4 printer driver family FPs (Dot4.sys, Dot4Prt.sys, Dot4usb.sys, Dot4Scan.sys) */
   not dll.hash.sha256 : (
+        /* HP DOT4 printer driver family FPs (Dot4.sys, Dot4Prt.sys, Dot4usb.sys, Dot4Scan.sys) */
         "f21c1d478180bc5e932bb2c2e4618e3ed463ca87acedeb139682d218435f82f1",
         "7e2f2a139e897eae56038b920bda9381094bc0ae9e626f6634e6b444b8b0c91f",
         "12ffdf5f48a79b1b4adbb88ba2cb6c59dd6719554e8ea6beefe99b3e3c66f1ac",
-        "dbc6afaf80141e2480e19878f581edfe9c2b018da2ec527c4025ff04d5587afd"
+        "dbc6afaf80141e2480e19878f581edfe9c2b018da2ec527c4025ff04d5587afd",
+        /* (dc3d.sys, test-signed) */
+        "ca8f9564733ded4c3895cf7150bb254995d66889e6be08d6654e4f897e4ff7a4"
   )
 '''
 

rules/windows/lateral_movement_credential_access_kerberos_correlation.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/10/28"
 integration = ["endpoint", "windows", "system"]
 maturity = "production"
-updated_date = "2026/05/03"
+updated_date = "2026/07/02"
 
 [rule]
 author = ["Elastic"]
@@ -59,10 +59,12 @@ sequence by source.port, source.ip with maxspan=3s
       "C:\\Windows\\System32\\svchost.exe",
       "C:\\Program Files\\VMware\\VMware View\\Server\\bin\\ws_TomcatService.exe",
       "C:\\Program Files\\Omnissa\\Horizon\\Server\\bin\\ws_TomcatService.exe",
+      "C:\\Program Files\\SysAidServer\\root\\WEB-INF\\domains\\NetworkDiscovery.exe",
+      "C:\\Program Files (x86)\\IGEL\\RemoteManager\\*\\bin\\tomcat10.exe",
       "F:\\IGEL\\RemoteManager\\*\\bin\\tomcat10.exe"
     ) and
     user.id in ("S-1-5-20", "S-1-5-18")
-  ) and   
+  ) and
   source.ip != "127.0.0.1" and destination.ip != "::1" and destination.ip != "127.0.0.1"]
  [authentication where host.os.type == "windows" and event.code in ("4768", "4769")]
 '''

rules/windows/privilege_escalation_unusual_parentchild_relationship.toml

@@ -2,7 +2,7 @@
 creation_date = "2020/02/18"
 integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
 maturity = "production"
-updated_date = "2026/05/04"
+updated_date = "2026/07/06"
 
 [transform]
 [[transform.osquery]]
@@ -146,7 +146,7 @@ type = "eql"
 
 query = '''
 process where host.os.type == "windows" and event.type == "start" and
-process.parent.name != null and
+process.parent.name != null and process.parent.executable like ("?:\\*", "\\Device\\*") and
  (
    /* suspicious parent processes */
    (process.name:"autochk.exe" and not process.parent.name:"smss.exe") or
@@ -169,11 +169,12 @@ process.parent.name != null and
    (process.name:"userinit.exe" and not process.parent.name:("dwm.exe", "winlogon.exe", "KUsrInit.exe")) or
    (process.name:("wmiprvse.exe", "wsmprovhost.exe", "winrshost.exe") and not process.parent.name:"svchost.exe") or
    /* suspicious child processes */
-   (process.parent.name:("SearchProtocolHost.exe", "taskhost.exe", "csrss.exe") and not process.name:("werfault.exe", "wermgr.exe", "WerFaultSecure.exe", "conhost.exe", "ngentask.exe")) or
+   (process.parent.name:("SearchProtocolHost.exe", "taskhost.exe", "csrss.exe") and not process.name:("werfault.exe", "wermgr.exe", "WerFaultSecure.exe", "conhost.exe", "ngentask.exe", "SearchProtocolHost.exe")) or
    (process.parent.name:"autochk.exe" and not process.name:("chkdsk.exe", "doskey.exe", "WerFault.exe")) or
    (process.parent.name:"smss.exe" and not process.name:("autochk.exe", "smss.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "setupcl.exe", "WerFault.exe", "wpbbin.exe", "PvsVmBoot.exe", "SophosNA.exe", "omnissa-ic-nga.exe", "icarus_rvrt.exe", "poqexec.exe")) or
-   (process.parent.name:"wermgr.exe" and not process.name:("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe")) or
-   (process.parent.name:"conhost.exe" and not process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe", "WerFaultSecure.exe"))
+   (process.parent.name:"wermgr.exe" and not process.name:("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe") and
+     not (process.name:"rundll32.exe" and process.command_line : "*WerConCpl.dll*LaunchErcApp*")) or
+   (process.parent.name:"conhost.exe" and not process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe", "WerFaultSecure.exe", "conhost.exe"))
   )
 '''
 

rules/windows/privilege_escalation_via_ppid_spoofing.toml

@@ -2,7 +2,7 @@
 creation_date = "2022/10/20"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2026/05/03"
+updated_date = "2026/07/03"
 
 [rule]
 author = ["Elastic"]
@@ -41,7 +41,7 @@ query = '''
 process where host.os.type == "windows" and event.action == "start" and
 
  /* process creation via seclogon */
- process.parent.Ext.real.pid > 0 and
+ process.parent.Ext.real.pid > 0 and process.parent.executable != null and
 
  /* PrivEsc to SYSTEM */
  user.id : "S-1-5-18"  and
@@ -75,7 +75,6 @@ process where host.os.type == "windows" and event.action == "start" and
                                    "?:\\Windows\\UUS\\amd64\\wuauclt.exe",
                                    "?:\\Windows\\UUS\\amd64\\wuaucltcore.exe",
                                    "?:\\ProgramData\\Microsoft\\Windows\\UUS\\*\\wuaucltcore.exe")) and
- not (process.executable : ("?:\\Windows\\System32\\MpSigStub.exe", "?:\\Windows\\SysWOW64\\MpSigStub.exe") and process.parent.executable == null) and
 
  /* Other third party SW */
  not process.parent.executable :
@@ -90,7 +89,7 @@ process where host.os.type == "windows" and event.action == "start" and
                     "?:\\Program Files (x86)\\GoToAssist Remote Support Customer\\*\\g2ax_comm_customer.exe") and
  not (
     process.code_signature.trusted == true and process.code_signature.subject_name == "Netwrix Corporation" and
-    process.name : "adcrcpy.exe" and process.parent.name : (
+    process.name : ("adcrcpy.exe", "addumpcaller.exe") and process.parent.name : (
       "Netwrix.ADA.EventCollector.exe",
       "Netwrix.ADA.Analyzer.exe"
     )