From 2bf2c33002f08fec1d9cc64da9795bb189625e4d Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Tue, 9 Mar 2021 12:11:06 +0100
Subject: [PATCH] [Rule Tuning] Unusual Process Execution Path - Alternate Data
 Stream

---
 rules/.idea/workspace.xml                     | 89 +++++++++++++++++++
 .../defense_evasion_unusual_dir_ads.toml      |  6 +-
 2 files changed, 92 insertions(+), 3 deletions(-)
 create mode 100644 rules/.idea/workspace.xml

diff --git a/rules/.idea/workspace.xml b/rules/.idea/workspace.xml
new file mode 100644
index 000000000..d9e4d564b
--- /dev/null
+++ b/rules/.idea/workspace.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="BranchesTreeState">
+    <expand>
+      <path>
+        <item name="ROOT" type="e8cecc67:BranchNodeDescriptor" />
+        <item name="LOCAL_ROOT" type="e8cecc67:BranchNodeDescriptor" />
+      </path>
+      <path>
+        <item name="ROOT" type="e8cecc67:BranchNodeDescriptor" />
+        <item name="LOCAL_ROOT" type="e8cecc67:BranchNodeDescriptor" />
+        <item name="GROUP_NODE:EggShell-RAT-for-MacOS" type="e8cecc67:BranchNodeDescriptor" />
+      </path>
+      <path>
+        <item name="ROOT" type="e8cecc67:BranchNodeDescriptor" />
+        <item name="REMOTE_ROOT" type="e8cecc67:BranchNodeDescriptor" />
+      </path>
+      <path>
+        <item name="ROOT" type="e8cecc67:BranchNodeDescriptor" />
+        <item name="REMOTE_ROOT" type="e8cecc67:BranchNodeDescriptor" />
+        <item name="GROUP_NODE:origin" type="e8cecc67:BranchNodeDescriptor" />
+      </path>
+      <path>
+        <item name="ROOT" type="e8cecc67:BranchNodeDescriptor" />
+        <item name="REMOTE_ROOT" type="e8cecc67:BranchNodeDescriptor" />
+        <item name="GROUP_NODE:origin" type="e8cecc67:BranchNodeDescriptor" />
+        <item name="GROUP_NODE:pr" type="e8cecc67:BranchNodeDescriptor" />
+      </path>
+    </expand>
+    <select />
+  </component>
+  <component name="ChangeListManager">
+    <list default="true" id="22f5d28a-8382-4d88-8ddf-8aa144e75a02" name="Default Changelist" comment="">
+      <change beforePath="$PROJECT_DIR$/windows/defense_evasion_unusual_dir_ads.toml" beforeDir="false" afterPath="$PROJECT_DIR$/windows/defense_evasion_unusual_dir_ads.toml" afterDir="false" />
+    </list>
+    <option name="SHOW_DIALOG" value="false" />
+    <option name="HIGHLIGHT_CONFLICTS" value="true" />
+    <option name="HIGHLIGHT_NON_ACTIVE_CHANGELIST" value="false" />
+    <option name="LAST_RESOLUTION" value="IGNORE" />
+  </component>
+  <component name="Git.Settings">
+    <option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$/.." />
+  </component>
+  <component name="ProjectId" id="1pTGLFYecBdn7jMrkfV8oEDyNzU" />
+  <component name="ProjectLevelVcsManager" settingsEditedManually="true" />
+  <component name="ProjectViewState">
+    <option name="hideEmptyMiddlePackages" value="true" />
+    <option name="showLibraryContents" value="true" />
+  </component>
+  <component name="PropertiesComponent">
+    <property name="RunOnceActivity.OpenProjectViewOnStart" value="true" />
+    <property name="RunOnceActivity.ShowReadmeOnStart" value="true" />
+  </component>
+  <component name="RecentsManager">
+    <key name="MoveFile.RECENT_KEYS">
+      <recent name="C:\Users\bouss\Documents\GitHub\detection-rules\rules\cross-platform" />
+    </key>
+  </component>
+  <component name="SvnConfiguration">
+    <configuration />
+  </component>
+  <component name="TaskManager">
+    <task active="true" id="Default" summary="Default task">
+      <changelist id="22f5d28a-8382-4d88-8ddf-8aa144e75a02" name="Default Changelist" comment="" />
+      <created>1615199608901</created>
+      <option name="number" value="Default" />
+      <option name="presentableId" value="Default" />
+      <updated>1615199608901</updated>
+    </task>
+    <servers />
+  </component>
+  <component name="Vcs.Log.Tabs.Properties">
+    <option name="TAB_STATES">
+      <map>
+        <entry key="MAIN">
+          <value>
+            <State />
+          </value>
+        </entry>
+      </map>
+    </option>
+  </component>
+  <component name="WindowStateProjectService">
+    <state x="669" y="271" width="581" height="520" key="find.popup" timestamp="1615286918395">
+      <screen x="0" y="0" width="1920" height="1040" />
+    </state>
+    <state x="669" y="271" width="581" height="520" key="find.popup/0.0.1920.1040@0.0.1920.1040" timestamp="1615286918395" />
+  </component>
+</project>
\ No newline at end of file
diff --git a/rules/windows/defense_evasion_unusual_dir_ads.toml b/rules/windows/defense_evasion_unusual_dir_ads.toml
index 395e9f422..9b1739fc0 100644
--- a/rules/windows/defense_evasion_unusual_dir_ads.toml
+++ b/rules/windows/defense_evasion_unusual_dir_ads.toml
@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/12/04"
 maturity = "production"
-updated_date = "2021/03/03"
+updated_date = "2021/03/09"
 
 [rule]
 author = ["Elastic"]
@@ -22,8 +22,8 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-process where event.type in ("start", "process_started") and
-  process.args : "C:\\*:*"
+process where event.type == "start" and
+  process.args : ("C:\\*:*", "D:\\*:*", "E:\\*:*")  and process.args_count == 1
 '''