Endpoint Security Exper rule - match all events into single threat event..

[mcn1k]

Hi guys, 

I am writing a rule against a following TTP - https://attack.mitre.org/techniques/T1105/

Rule is working and being able to do report/block  as it should: 

Rule {
Process {
Include OBJECT_NAME {
-v "*certutil*"
}
Include PROCESS_CMD_LINE { -l "*-urlcache*" | -l "*-split*" | -l "*-f*" | -l "*-verifyctl*" | -l "*-encode*" | -l "*-decode" | -l "*-decodehex*"}
}
Target {
Match SECTION {
Include -access "CREATE"
}
}
}

Problem that I encounter is that is it is generating 2 many events for single activity. For example if you run certutil -f it will generate ~20 events since certutil is accessing many processes like netapi32.dll, ntdsapi.dll,  cabinet.dll etc. 

Question is how to combine (if possible) all events into single one within the rule. I guess there should be sort of "catch" but I can't find anything in the product guide or anywhere else.

Thank you in advance.

[Tares1]

Hello @mcn1k 

Thank you for reaching out to the support community.

The rule is working as expected generating events for each access of the certutil.exe process.

If you would limit it to a specific event for the process you could generate less events, but also miss legitimate events you would be trying to catch if it doesn't meet all the requirements in the rule.

You can generate more consolidated reports to try and have a better visualization for those events as well.

Hope this was helpful.