To Modify/Tune Curated Detection Rule Logic

Hi,

You’re understanding it correctly.I have been over the Google docs, to see if I could find something, but Curated rules are Google-managed, so the underlying logic cannot be directly modified. You can tune them with exclusions, or recreate the logic as a custom rule if you need different behavior.

I would not expect Google Support to modify a curated rule for one environment, but they can confirm whether the behavior is intended or review it if the rule appears to have an issue.

I’m sorry. It’s probably not the outcome you were looking for.

Good Luck
 

Yes thanks for your inputs ​@whathehack81 . But I’d still like to have someone from google needs to review the logic once for curated detection rule: Rubeus Indicators where it should target only windows device since it’s windows based utitlity. The rule logic will alert for MacOS devices as well as it contain just the command line regex.

I will be honest with you. I am not equipped to handle this situation. The only thing I found was what I already explained to you. Sorry that I could not provide more assistance.  I am sure that Google will reach out to you soon. Good luck 🤞...

You have a couple of options here.

1. You can copy the rule from Content Hub and custimize the logic. If you navigate to Content Hub the logic of the rule you’re referring to can be found, but there’s a small caveat, you would need to copy and paste it into a custom rule and you would need to comment out some of the outcome variables, they have some clever calculation of risk based on factors but in custom rules we are limited to 20 outcome variables (seems that curated detections doesn’t have that limitation. 
2. In this case there may be a clever way to do an exclusion for the rule if your log source supports it (e.x if you want to limit based on just metadata.log_type = WINEVTLOG or for EDR log types the .platform filed may be present)
3. What you are mentioning too may be a legitimate bug with this curated detection, so that can be something reported to support, as you mentioned the rule is experiencing false positives. I would file a support ticket and provide some sample logs of the false positives, as this may help the team tune the rule globally, but that isn’t something customers can easily do as currently there is no construct of a per-customer curated detection, you can just copy and tweak them or do exclusions. We will also follow up in our own support channels on this. 

Below is an example of a rule that will save that’s obviously not perfect but you can tweak. I added a winevtlog limiter since your post doesn’t clarify which EDR we’re testing against and unfortunately had to comment out a bunch of very nice outcome variables but the limitation for 20 is there. 

I really hope this helps!

rule ttp_windows_rubeus_indicators {

meta:

rule_name = "Rubeus Indicators"

description = "This signature detects the Rubeus Utility being executed on a host. Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project."

severity = "High"

tactic = "TA0006"

technique = "T1558"

reference = "https://github.com/GhostPack/Rubeus?tab=readme-ov-file#rubeus"

events:

$e.metadata.event_type = "PROCESS_LAUNCH"

$e.metadata.log_type = "WINEVTLOG" // add your own filtering

(

re.regex($e.target.process.file.full_path, `\\Rubeus([0-9]{1,2})?\.exe$`) nocase or

re.regex($e.principal.process.file.full_path, `\\Rubeus([0-9]{1,2})?\.exe$`) nocase or

(

re.regex($e.target.process.command_line, `\s(asktgt|asktgs|tgssub|createnetonly|preauthscan|s4u|golden|silver|diamond|tgtdeleg|dump)\s`) nocase and

re.regex($e.target.process.command_line, `\s\/(user[\s:]|enctype|rc4|aes128|aes256|domain|dc|outfile|ptt|luid|certificate|nowrap|getcredentials|servicekey|service|ticket)`) nocase

) or

(

re.regex($e.target.process.command_line, `\s(kerberoast|asreproast)\s`) nocase and

re.regex($e.target.process.command_line, `\/(spns?|user|domain|dc|ou|ldaps|creduser|rc4opsec|ldapfilter|nowrap|outfile)`) nocase

)

)

outcome:

$risk_score = 85

$vendor_name = $e.metadata.vendor_name

$product_name = $e.metadata.product_name

$victim_uid = $e.principal.asset.asset_id

$victim_name = $e.principal.asset.hostname

$victim_netid = array($e.principal.ip)

$adversary_uid = $e.principal.user.userid

$adversary_name = $e.principal.user.user_display_name

$adversary_netid = $e.principal.user.windows_sid

$tmp1 = max(

if($e.security_result.action != "BLOCK" and $e.security_result.action != "UNKNOWN_ACTION", 2)

)

$tmp2 = max(

if($e.security_result.action = "BLOCK", 1)

)

$result = arrays.index_to_str(

strings.split("attempted,failed,succeeded,succeeded"), $tmp1 + $tmp2

)

$result_time = $e.metadata.event_timestamp.seconds

$event_count = 1

$hostname = $e.principal.hostname

$rule_category = "methodology"

$principal_process_command_line = $e.principal.process.command_line

$principal_process_file_full_path = $e.principal.process.file.full_path

$target_process_command_line = $e.target.process.command_line

$target_process_file_full_path = $e.target.process.file.full_path

// $threat_verdict_malicious = if($e.target.file.security_result.threat_verdict = "MALICIOUS", 1, 0)

// $threat_verdict_suspicious = if($e.target.file.security_result.threat_verdict = "SUSPICIOUS", 1, 0)

// $sus_vt_tags = max(if(re.regex(strings.coalesce($e.target.file.tags, "None"), /(cve-|executes-dropped-file|zero-filled|spreader|self-delete|registry|base64-string|exploit|upx|checks-hostname|write-file|contains-embedded-js|sets-process-name|embedded-ole|persistence|revoked-cert|via-tor)/), 1, 0))

// $recent_compile_time = if($e.target.file.pe_file.compilation_time.seconds >= $e.metadata.event_timestamp.seconds - (60 * 60 * 48), 1, 0)

// $invalid_cert = if(any $e.target.file.signature_info.sigcheck.signers.status = /(revoked|untrusted|distrusted|nottrusted)/ nocase, 1, 0)

// $system_user_file_write = if($e.principal.user.userid = "system", 1, 0)

// $sus_file_name_architecture = if(re.regex($e.target.file.full_path, /^.*\[^\/]+(32|64).[^\/.]+$/), 1, 0)

// $single_double_char_filename = if(re.regex($e.target.file.full_path, /^.*([^\/]{1,2}.[^\/.]+)$/), 1, 0)

// $double_extensions = if(re.regex($e.target.file.full_path, /^(?:.*[\/])?([^.\/\]+.[a-zA-Z]{3}.[a-zA-Z]{3})$/), 1, 0)

// $all_numbers_file_name = if(re.regex($e.target.file.full_path, /\d+.[a-zA-Z]{3}$/), 1, 0)

// $common_malicious_file_names = if(re.regex($e.target.file.full_path, /(setup\.exe|update\.js|lsass\.dmp|1\.txt|ntds\.dit|logs\.dat|sqlite3\.dll|pass_1234|system\.dll|readme|mimi)/) nocase, 1, 0)

// $is_archive_file = if(re.regex($e.target.file.full_path, /.(zip|rar|7z|tar|gz|bz2|cab|iso)$/), 1, 0)

// $is_executable_file = if(re.regex($e.target.file.full_path, /.(exe|dll|scr|pif|com|cpl|bat|cmd|vbs|js|jse|wsf|wsh|ps1|psm1|msh|msh1|msh2|scf|lnk|inf|reg|hta|gadget)$/), 1, 0)

// $asset_is_server = if($e.principal.asset.type = "SERVER", 1, 0)

// $producer_risk_score = $threat_verdict_malicious + $threat_verdict_suspicious + $recent_compile_time + $system_user_file_write + $sus_file_name_architecture + $common_malicious_file_names + $asset_is_server + $single_double_char_filename + $double_extensions + $sus_vt_tags + $all_numbers_file_name + $is_executable_file + $is_archive_file + $invalid_cert

// $likely_security_testing = if(re.regex($e.principal.process.file.full_path, /(verodin_backend.exe|safebreach|\sb_|attackiq)/) nocase, 1, 0) + if(re.regex($e.principal.process.parent_process.file.full_path, /(verodin_backend.exe|safebreach|\sb_|attackiq)/) nocase, 1, 0) + if(re.regex($e.principal.process.command_line, /(verodin_backend.exe|safebreach|\sb_|attackiq)/) nocase, 1, 0)

condition:

$e

}

Great post ​@citreno! thank you!