[Rule Tuning] Suspicious Windows Powershell Arguments - #6707
Closed
Mikaayenson wants to merge 2 commits into
Closed
Mikaayenson wants to merge 2 commits into
Mikaayenson wants to merge 2 commits into
Conversation
…2ce-d140-4118-8192-af4d13715234)
…783-e1bc-4a40-8200-26e02c0abd39)
Mikaayenson
added
Rule: Tuning
Contributor
There was a problem hiding this comment.
Pull request overview
This PR tunes the existing Windows EQL rule “Suspicious Windows Powershell Arguments” to reduce false positives by adding/expanding targeted allowlists and refining matching logic around known-benign PowerShell patterns.
Changes:
- Updates rule metadata
updated_dateto reflect the tuning date. - Adds parent-process exclusions for Windows Compatibility Telemetry and Defender IR tooling.
- Refactors the
.Replacematching into a dedicated clause with targeted exclusions, and expands the existing Start-AsJob-related allowlist along with a WebClient.OpenRead()allowlist entry.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "?:\\Program Files (x86)\\*.exe" | ||
| ) and | ||
|
|
||
| not process.parent.name : ("CompatTelRunner.exe", "SenseIR.exe") and |
Comment on lines
192
to
196
| "*Use-Icinga -Minimal*", | ||
| "*& {$j = sajb {Add-Type -AssemblyName*" | ||
| "*& {$j = sajb {Add-Type -AssemblyName*", | ||
| "*$j = sajb {*wjb $j*rcjb $j*", | ||
| "*WebClient*).OpenRead(*" | ||
| ) |
Contributor
|
Some global exceptions are too broad, other uses parent.name instead of path.. Will keep track of this one and push a tuning for the next release |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves elastic/ia-trade-team#1087
Reduces noise from WebClient-based internet connectivity checks, compliance scanning tools using Start-AsJob patterns, Windows Compatibility Telemetry, Microsoft Defender IR, and benign file-renaming Replace calls. Adds a targeted command_line exclusion for WebClient OpenRead connectivity probes and broadens the existing sajb compliance-scanning exclusion to cover all Start-AsJob/Wait-Job/Remove-Job idioms. Also adds CompatTelRunner.exe and SenseIR.exe to the parent process allowlist and expands the .Replace exclusion to cover file-rename patterns.
Full telemetry triage, analytics links, and KQL verification: see linked ia-trade-team issue.