I am attaching a rule below. I need to have an alert when e1 is true or e2 is true but I don't want and alert when we have a combination of e2 and e3 is true. How can i mention then in the rule.
rule RULE_PROD_USER_INFORMATION_REGISTRY_ACCESS {
meta:
author = "abcd"
description = "Detect access to registry keys containing user/system information while suppressing expected Dell activity"
severity = "LOW"
priority = "LOW"
mitre_tactic = "TA0005"
mitre_technique = "T1112"
case_type = "Anomaly detection"
events:
// Original detection event
$e1.principal.hostname = $host
(
$e1.target.registry.registry_key = /Control Panel\\International\\Geo/ or
$e1.principal.process.command_line = /Control Panel\\International\\Geo/ or
$e1.target.registry.registry_key = /SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum/
)
not (
$e1.principal.process.parent_process.file.names = "Dell.TechHub.Diagnostics.SubAgent.exe" nocase or
$e1.principal.process.parent_process.file.names = "Dell.TechHub.Instrumentation.SubAgent.exe" nocase
)
// MDE BIOS registry query
$e2.principal.hostname = $host
$e2.principal.log_type = "MICROSOFT_DEFENDER_FOR_ENDPOINT"
$e2.principal.process.command_line =/HARDWARE\\DESCRIPTION\\System/
// Dell Driver launch
$e3.principal.hostname = $host
$e3.metadata.event_type = "PROCESS_LAUNCH"
$e3.principal.process.command_line = /Dell\\drivers/
match:
$host over 10m
outcome:
$source_ip = array_distinct($e1.principal.ip)
$vendor_name = array_distinct($e1.metadata.vendor_name)
$product_name = array_distinct($e1.metadata.product_name)
$principal_process_command_line =
array_distinct($e1.principal.process.command_line)
condition:
// Fire on original detection
$e1
// Suppress if Dell activity is observed
and not ($e2 and $e3)
}

