To Modify/Tune Curated Detection Rule Logic

You have a couple of options here.

1. You can copy the rule from Content Hub and custimize the logic. If you navigate to Content Hub the logic of the rule you’re referring to can be found, but there’s a small caveat, you would need to copy and paste it into a custom rule and you would need to comment out some of the outcome variables, they have some clever calculation of risk based on factors but in custom rules we are limited to 20 outcome variables (seems that curated detections doesn’t have that limitation. 
2. In this case there may be a clever way to do an exclusion for the rule if your log source supports it (e.x if you want to limit based on just metadata.log_type = WINEVTLOG or for EDR log types the .platform filed may be present)
3. What you are mentioning too may be a legitimate bug with this curated detection, so that can be something reported to support, as you mentioned the rule is experiencing false positives. I would file a support ticket and provide some sample logs of the false positives, as this may help the team tune the rule globally, but that isn’t something customers can easily do as currently there is no construct of a per-customer curated detection, you can just copy and tweak them or do exclusions. We will also follow up in our own support channels on this. 

Below is an example of a rule that will save that’s obviously not perfect but you can tweak. I added a winevtlog limiter since your post doesn’t clarify which EDR we’re testing against and unfortunately had to comment out a bunch of very nice outcome variables but the limitation for 20 is there. 

I really hope this helps!

rule ttp_windows_rubeus_indicators {

meta:

rule_name = "Rubeus Indicators"

description = "This signature detects the Rubeus Utility being executed on a host. Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project."

severity = "High"

tactic = "TA0006"

technique = "T1558"

reference = "https://github.com/GhostPack/Rubeus?tab=readme-ov-file#rubeus"

events:

$e.metadata.event_type = "PROCESS_LAUNCH"

$e.metadata.log_type = "WINEVTLOG" // add your own filtering

(

re.regex($e.target.process.file.full_path, `\\Rubeus([0-9]{1,2})?\.exe$`) nocase or

re.regex($e.principal.process.file.full_path, `\\Rubeus([0-9]{1,2})?\.exe$`) nocase or

(

re.regex($e.target.process.command_line, `\s(asktgt|asktgs|tgssub|createnetonly|preauthscan|s4u|golden|silver|diamond|tgtdeleg|dump)\s`) nocase and

re.regex($e.target.process.command_line, `\s\/(user[\s:]|enctype|rc4|aes128|aes256|domain|dc|outfile|ptt|luid|certificate|nowrap|getcredentials|servicekey|service|ticket)`) nocase

) or

(

re.regex($e.target.process.command_line, `\s(kerberoast|asreproast)\s`) nocase and

re.regex($e.target.process.command_line, `\/(spns?|user|domain|dc|ou|ldaps|creduser|rc4opsec|ldapfilter|nowrap|outfile)`) nocase

)

)

outcome:

$risk_score = 85

$vendor_name = $e.metadata.vendor_name

$product_name = $e.metadata.product_name

$victim_uid = $e.principal.asset.asset_id

$victim_name = $e.principal.asset.hostname

$victim_netid = array($e.principal.ip)

$adversary_uid = $e.principal.user.userid

$adversary_name = $e.principal.user.user_display_name

$adversary_netid = $e.principal.user.windows_sid

$tmp1 = max(

if($e.security_result.action != "BLOCK" and $e.security_result.action != "UNKNOWN_ACTION", 2)

)

$tmp2 = max(

if($e.security_result.action = "BLOCK", 1)

)

$result = arrays.index_to_str(

strings.split("attempted,failed,succeeded,succeeded"), $tmp1 + $tmp2

)

$result_time = $e.metadata.event_timestamp.seconds

$event_count = 1

$hostname = $e.principal.hostname

$rule_category = "methodology"

$principal_process_command_line = $e.principal.process.command_line

$principal_process_file_full_path = $e.principal.process.file.full_path

$target_process_command_line = $e.target.process.command_line

$target_process_file_full_path = $e.target.process.file.full_path

// $threat_verdict_malicious = if($e.target.file.security_result.threat_verdict = "MALICIOUS", 1, 0)

// $threat_verdict_suspicious = if($e.target.file.security_result.threat_verdict = "SUSPICIOUS", 1, 0)

// $sus_vt_tags = max(if(re.regex(strings.coalesce($e.target.file.tags, "None"), /(cve-|executes-dropped-file|zero-filled|spreader|self-delete|registry|base64-string|exploit|upx|checks-hostname|write-file|contains-embedded-js|sets-process-name|embedded-ole|persistence|revoked-cert|via-tor)/), 1, 0))

// $recent_compile_time = if($e.target.file.pe_file.compilation_time.seconds >= $e.metadata.event_timestamp.seconds - (60 * 60 * 48), 1, 0)

// $invalid_cert = if(any $e.target.file.signature_info.sigcheck.signers.status = /(revoked|untrusted|distrusted|nottrusted)/ nocase, 1, 0)

// $system_user_file_write = if($e.principal.user.userid = "system", 1, 0)

// $sus_file_name_architecture = if(re.regex($e.target.file.full_path, /^.*\[^\/]+(32|64).[^\/.]+$/), 1, 0)

// $single_double_char_filename = if(re.regex($e.target.file.full_path, /^.*([^\/]{1,2}.[^\/.]+)$/), 1, 0)

// $double_extensions = if(re.regex($e.target.file.full_path, /^(?:.*[\/])?([^.\/\]+.[a-zA-Z]{3}.[a-zA-Z]{3})$/), 1, 0)

// $all_numbers_file_name = if(re.regex($e.target.file.full_path, /\d+.[a-zA-Z]{3}$/), 1, 0)

// $common_malicious_file_names = if(re.regex($e.target.file.full_path, /(setup\.exe|update\.js|lsass\.dmp|1\.txt|ntds\.dit|logs\.dat|sqlite3\.dll|pass_1234|system\.dll|readme|mimi)/) nocase, 1, 0)

// $is_archive_file = if(re.regex($e.target.file.full_path, /.(zip|rar|7z|tar|gz|bz2|cab|iso)$/), 1, 0)

// $is_executable_file = if(re.regex($e.target.file.full_path, /.(exe|dll|scr|pif|com|cpl|bat|cmd|vbs|js|jse|wsf|wsh|ps1|psm1|msh|msh1|msh2|scf|lnk|inf|reg|hta|gadget)$/), 1, 0)

// $asset_is_server = if($e.principal.asset.type = "SERVER", 1, 0)

// $producer_risk_score = $threat_verdict_malicious + $threat_verdict_suspicious + $recent_compile_time + $system_user_file_write + $sus_file_name_architecture + $common_malicious_file_names + $asset_is_server + $single_double_char_filename + $double_extensions + $sus_vt_tags + $all_numbers_file_name + $is_executable_file + $is_archive_file + $invalid_cert

// $likely_security_testing = if(re.regex($e.principal.process.file.full_path, /(verodin_backend.exe|safebreach|\sb_|attackiq)/) nocase, 1, 0) + if(re.regex($e.principal.process.parent_process.file.full_path, /(verodin_backend.exe|safebreach|\sb_|attackiq)/) nocase, 1, 0) + if(re.regex($e.principal.process.command_line, /(verodin_backend.exe|safebreach|\sb_|attackiq)/) nocase, 1, 0)

condition:

$e

}