fix(rules/windows): correct 15 broken correlation rules + add 7 new detections (#2270)

rvald26 · rvald26 · claude · web-flow · commit 7fca701396d3 · 2026-06-25T13:59:55.000-04:00
Validated end-to-end by firing real payloads on a live Windows agent and
confirming each alert in UTMStack (22/22 fired). Fixes regex backslash-escaping,
the non-existent eventDataFileName field on 4663, eventDataProcessName on 4688
(use log.data.NewProcessName), the unpopulated log.channel clause, and the WinRM
4624-ProcessName issue. Adds 7 detections (shadow-copy deletion, suspicious
PowerShell, Office-spawned shell, LOLBins, scheduled tasks, log tampering,
credential dumping). Hardened for false positives; groupBy/deduplicateBy set on
dataSource so a burst yields a single alert.

Co-authored-by: rvald26 &lt;rick@utmstack.com&gt;
Co-authored-by: Claude Opus 4.8 (1M context) &lt;noreply@anthropic.com&gt;
Co-authored-by: Yorjander Hernandez Vergara &lt;99102374+Kbayero@users.noreply.github.com&gt;
diff --git a/rules/windows/audit_or_event_log_tampering.yml b/rules/windows/audit_or_event_log_tampering.yml
@@ -0,0 +1,19 @@
+# Rule version v1.2.0 (validated 2026-06-24)
+dataTypes:
+  - wineventlog
+name: 'Windows: Audit Policy or Event Log Tampering'
+impact:
+  confidentiality: 2
+  integrity: 3
+  availability: 2
+category: Defense Evasion
+technique: 'T1562.002 - Impair Defenses: Disable Windows Event Logging'
+adversary: origin
+description: Detects clearing of event logs (event 104) or command-line tampering with auditing/logging (auditpol /clear or /set ...disable, wevtutil cl, Clear-EventLog, fsutil usn deletejournal). Complements the Security-log-cleared (1102) rule.
+references:
+  - https://attack.mitre.org/techniques/T1562/002/
+where: |
+  (equals("log.eventCode", "104")) || (equals("log.eventCode", 4688) && regexMatch("log.data.CommandLine", "(?i)(auditpol.*/clear|auditpol.*/set.*(success|failure):disable|wevtutil.*(cl |clear-log)|Clear-EventLog|fsutil.*usn.*deletejournal|Remove-EventLog)"))
+groupBy:
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/credential_dumping_tool_indicators.yml b/rules/windows/credential_dumping_tool_indicators.yml
@@ -0,0 +1,19 @@
+# Rule version v1.2.0 (validated 2026-06-24)
+dataTypes:
+  - wineventlog
+name: 'Windows: Credential Dumping Tool Indicators'
+impact:
+  confidentiality: 3
+  integrity: 3
+  availability: 2
+category: Credential Access
+technique: T1003 - OS Credential Dumping
+adversary: origin
+description: Detects command-line and PowerShell script-block indicators of credential-dumping tools (mimikatz/sekurlsa/lsadump, procdump lsass, comsvcs MiniDump, nanodump, rubeus). The command-line branch is the reliable trigger since AMSI blocks literal mimikatz strings in PowerShell.
+references:
+  - https://attack.mitre.org/techniques/T1003/
+where: |
+  (equals("log.eventCode", "4104") && regexMatch("log.eventDataScriptBlockText", "(?i)(invoke-mimikatz|sekurlsa|lsadump|kerberos::|crypto::|out-minidump|invoke-nanodump|get-keystrokes|mimikatz|invoke-kerberoast|rubeus)")) || (equals("log.eventCode", 4688) && regexMatch("log.data.CommandLine", "(?i)(sekurlsa|lsadump|mimikatz|procdump.*lsass|comsvcs.*minidump|nanodump|rundll32.*comsvcs|rubeus)"))
+groupBy:
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/lolbin_proxy_execution.yml b/rules/windows/lolbin_proxy_execution.yml
@@ -0,0 +1,19 @@
+# Rule version v1.2.0 (validated 2026-06-24)
+dataTypes:
+  - wineventlog
+name: 'Windows: LOLBin Proxy Execution / Ingress Tool Transfer'
+impact:
+  confidentiality: 2
+  integrity: 2
+  availability: 1
+category: Defense Evasion
+technique: T1218 - System Binary Proxy Execution
+adversary: origin
+description: Detects living-off-the-land binaries used for proxy execution or download (mshta http, regsvr32 squiblydoo, certutil -urlcache/-decode, bitsadmin /transfer, wmic process call create, msbuild, installutil, mavinject).
+references:
+  - https://attack.mitre.org/techniques/T1218/
+where: |
+  equals("log.eventCode", 4688) && regexMatch("log.data.CommandLine", "(?i)(mshta.*http|mshta.*vbscript|mshta.*javascript|regsvr32.*scrobj|regsvr32.*/i:http|rundll32.*javascript:|rundll32.*url[.]dll|certutil.*(-urlcache|-decode|-encode|-split|-verifyctl).*(http|[.]exe|[.]dll|[.]txt|[.]bin)|bitsadmin.*/transfer.*http|wmic.*/node:.*process.*call.*create|installutil.*/(u|logfile=)|regasm.*/u|mavinject.*/injectrunning|cmstp.*/s)")
+groupBy:
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/masquerading_detection.yml b/rules/windows/masquerading_detection.yml
@@ -29,37 +29,7 @@ description: |
   6. Kill the suspicious process and quarantine the file
   7. Search for other instances of the same file across the environment
 where: |
-  (equals("log.eventCode", "4688") || equals("log.eventCode", "1")) &&
-  (
-    (
-      regexMatch("log.eventDataProcessName", "(?i)\\\\csrss\\.exe$") &&
-      !regexMatch("log.eventDataProcessName", "(?i)^C:\\\\Windows\\\\(System32|SysWOW64)\\\\csrss\\.exe$")
-    ) ||
-    (
-      regexMatch("log.eventDataProcessName", "(?i)\\\\services\\.exe$") &&
-      !regexMatch("log.eventDataProcessName", "(?i)^C:\\\\Windows\\\\System32\\\\services\\.exe$")
-    ) ||
-    (
-      regexMatch("log.eventDataProcessName", "(?i)\\\\smss\\.exe$") &&
-      !regexMatch("log.eventDataProcessName", "(?i)^C:\\\\Windows\\\\System32\\\\smss\\.exe$")
-    ) ||
-    (
-      regexMatch("log.eventDataProcessName", "(?i)\\\\wininit\\.exe$") &&
-      !regexMatch("log.eventDataProcessName", "(?i)^C:\\\\Windows\\\\System32\\\\wininit\\.exe$")
-    ) ||
-    (
-      regexMatch("log.eventDataProcessName", "(?i)\\\\explorer\\.exe$") &&
-      !regexMatch("log.eventDataProcessName", "(?i)^C:\\\\Windows\\\\explorer\\.exe$")
-    ) ||
-    (
-      regexMatch("log.eventDataProcessName", "(?i)\\\\svchost\\.exe$") &&
-      !regexMatch("log.eventDataProcessName", "(?i)^C:\\\\Windows\\\\(System32|SysWOW64)\\\\svchost\\.exe$")
-    ) ||
-    (
-      regexMatch("log.eventDataProcessName", "(?i)\\\\lsass\\.exe$") &&
-      !regexMatch("log.eventDataProcessName", "(?i)^C:\\\\Windows\\\\System32\\\\lsass\\.exe$")
-    )
-  )
+  (equals("log.eventCode","4688") || equals("log.eventCode","1")) && ((regexMatch("log.data.NewProcessName","svchost[.]exe$") && !regexMatch("log.data.NewProcessName","[Ww]indows.(System32|SysWOW64).svchost[.]exe$")) || (regexMatch("log.data.NewProcessName","lsass[.]exe$") && !regexMatch("log.data.NewProcessName","[Ww]indows.System32.lsass[.]exe$")) || (regexMatch("log.data.NewProcessName","services[.]exe$") && !regexMatch("log.data.NewProcessName","[Ww]indows.System32.services[.]exe$")) || (regexMatch("log.data.NewProcessName","csrss[.]exe$") && !regexMatch("log.data.NewProcessName","[Ww]indows.(System32|SysWOW64).csrss[.]exe$")) || (regexMatch("log.data.NewProcessName","explorer[.]exe$") && !regexMatch("log.data.NewProcessName","[Ww]indows.explorer[.]exe$")))
 groupBy:
-  - origin.host
-  - target.user
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/ntds_extraction_attempts.yml b/rules/windows/ntds_extraction_attempts.yml
@@ -27,23 +27,18 @@ description: |
   8. Check backup systems and shadow copies for unauthorized access
   9. Coordinate with incident response team for full forensic analysis
 where: |
-  oneOf("log.eventCode", ["4663", "4656"]) && 
-  equals("log.channel", "Security") &&
-  (
-    endsWith("log.eventDataObjectName", "\\ntds.dit") ||
-    contains("log.eventDataObjectName", "\\NTDS\\") ||
-    endsWith("log.eventDataProcessName", "\\ntdsutil.exe") ||
-    endsWith("log.eventDataProcessName", "\\vssadmin.exe")
-  ) &&
-  !equals("log.eventDataAccessMask", "0")
+  oneOf("log.eventCode", ["4663","4656"]) && (contains("log.eventDataObjectName", "ntds.dit") || endsWith("log.eventDataProcessName", "ntdsutil.exe")) && !equals("log.eventDataAccessMask", "0")
 afterEvents:
   - indexPattern: v11-log-wineventlog-*
     with:
-      - field: origin.host
+      - field: log.eventCode
         operator: filter_term
-        value: '{{.origin.host}}'
+        value: '4663'
+      - field: dataSource.keyword
+        operator: filter_term
+        value: '{{.dataSource}}'
     within: 30m
     count: 2
 groupBy:
-  - origin.host
-  - target.user
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/ntlm_downgrade_attack.yml b/rules/windows/ntlm_downgrade_attack.yml
@@ -31,17 +31,7 @@ description: |
   7. Audit network traffic for NTLMv1 authentication attempts
   8. Consider disabling NTLM entirely where possible
 where: |
-  equals("log.eventCode", "4657") &&
-  equals("log.channel", "Security") &&
-  (
-    regexMatch("log.eventDataObjectName", "(?i)\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\LMCompatibilityLevel") ||
-    regexMatch("log.eventDataObjectName", "(?i)\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\NtlmMinClientSec") ||
-    regexMatch("log.eventDataObjectName", "(?i)\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\NtlmMinServerSec") ||
-    regexMatch("log.eventDataObjectName", "(?i)\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\RestrictSendingNTLMTraffic") ||
-    regexMatch("log.eventDataObjectName", "(?i)\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\MSV1_0\\\\AuditReceivingNTLMTraffic") ||
-    regexMatch("log.eventDataObjectName", "(?i)\\\\CurrentControlSet\\\\Services\\\\Netlogon\\\\Parameters\\\\RequireSignOrSeal")
-  ) &&
-  !regexMatch("log.eventDataSubjectUserName", "(?i)^(SYSTEM|TrustedInstaller)$")
+  equals("log.eventCode", "4657") && regexMatch("log.eventDataObjectName", "ControlSet.*Control.Lsa") && regexMatch("log.data.ObjectValueName", "(LMCompatibilityLevel|NtlmMinClientSec|NtlmMinServerSec|RestrictSendingNTLMTraffic|AuditReceivingNTLMTraffic|RequireSignOrSeal)") && !regexMatch("log.eventDataSubjectUserName", "(?i)^(SYSTEM|TrustedInstaller)$")
 groupBy:
-  - origin.host
-  - target.user
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/office_application_spawned_shell.yml b/rules/windows/office_application_spawned_shell.yml
@@ -0,0 +1,19 @@
+# Rule version v1.2.0 (validated 2026-06-24)
+dataTypes:
+  - wineventlog
+name: 'Windows: Office Application Spawned Command or Script Interpreter'
+impact:
+  confidentiality: 2
+  integrity: 3
+  availability: 2
+category: Execution
+technique: 'T1204.002 - User Execution: Malicious File'
+adversary: origin
+description: Detects an Office/document application (winword, excel, outlook, etc.) spawning a command or script interpreter - a classic macro/phishing payload execution chain.
+references:
+  - https://attack.mitre.org/techniques/T1204/002/
+where: |
+  equals("log.eventCode", 4688) && regexMatch("log.data.ParentProcessName", "(?i)(winword|excel|powerpnt|outlook|onenote|msaccess|mspub|wordpad).exe$") && regexMatch("log.data.NewProcessName", "(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|bitsadmin|certutil|curl).exe$")
+groupBy:
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/possible_remote_code_execution_using_printernightmare.yml b/rules/windows/possible_remote_code_execution_using_printernightmare.yml
@@ -15,9 +15,8 @@ description: "Adversaries may exploit remote services to gain unauthorized acces
               A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system."
 references:
   - "https://attack.mitre.org/techniques/T1210/"
-where: equals("log.eventCode", 4663) &&
-       regexMatch("log.eventDataObjectName", "\\Windows\\System32\\spool\\drivers\\") &&
-       regexMatch("log.eventDataObjectName", "\\.(dll|exe)$") && !contains("log.eventDataProcessName", "spoolsv.exe")
+where: |
+  equals("log.eventCode", 4663) && regexMatch("log.eventDataObjectName", "[Ww]indows.System32.spool.drivers") && regexMatch("log.eventDataObjectName", "[.](dll|exe)$") && !contains("log.eventDataProcessName", "spoolsv.exe")
 groupBy:
-  - origin.ip
-  - target.user
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/powershell_profiles.yml b/rules/windows/powershell_profiles.yml
@@ -15,8 +15,8 @@ description: "Identifies the creation or modification of a PowerShell profile. P
 references:
   - "https://attack.mitre.org/tactics/TA0003/"
   - "https://attack.mitre.org/techniques/T1098/002/"
-where: equals("log.eventCode", 4663) &&
-       regexMatch("log.eventDataObjectName", "(:\\Users\\.*\\Documents\\(WindowsPowerShell|PowerShell)\\.*profile\\.ps1$|:\\Windows\\System32\\WindowsPowerShell\\.*profile\\.ps1$)")
+where: |
+  equals("log.eventCode", 4663) && regexMatch("log.eventDataObjectName", "(Users.*Documents.(WindowsPowerShell|PowerShell).*profile[.]ps1$|Windows.System32.WindowsPowerShell.*profile[.]ps1$)")
 groupBy:
-  - origin.ip
-  - target.user
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/printspooler_service_suspicious_file.yml b/rules/windows/printspooler_service_suspicious_file.yml
@@ -16,7 +16,8 @@ description: "Detects attempts to exploit privilege escalation vulnerabilities r
 references:
   - "https://attack.mitre.org/tactics/TA0004/"
   - "https://attack.mitre.org/techniques/T1068/"
-where: contains("log.eventDataProcessName", "spoolsv.exe") && !regexMatch("log.eventDataProcessPath", "^C:\\\\Windows\\\\System32\\\\spoolsv.exe$")
+where: |
+  (equals("log.eventCode",4688) || equals("log.eventCode",1)) && contains("log.data.NewProcessName", "spoolsv.exe") && !regexMatch("log.data.NewProcessName", "[Ss]ystem32.spoolsv[.]exe$")
 groupBy:
-  - origin.ip
-  - target.user
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/printspooler_suspicious_spl_file.yml b/rules/windows/printspooler_suspicious_spl_file.yml
@@ -16,7 +16,7 @@ references:
   - "https://attack.mitre.org/tactics/TA0004/"
   - "https://attack.mitre.org/techniques/T1068/"
 where: |
-    !regexMatch("log.eventDataProcessName", "(spoolsv.exe|printfilterpipelinesvc.exe|PrintIsolationHost.exe|splwow64.exe|msiexec.exe|poqexec.exe)") && regexMatch("log.eventDataObjectName", ":\\Windows\\System32\\spool\\PRINTERS\\")
+  equals("log.eventCode", 4663) && !regexMatch("log.eventDataProcessName", "(spoolsv.exe|printfilterpipelinesvc.exe|PrintIsolationHost.exe|splwow64.exe|msiexec.exe|poqexec.exe)") && regexMatch("log.eventDataObjectName", "Windows.System32.spool.PRINTERS")
 groupBy:
-  - origin.ip
-  - target.user
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/ransom_inhibit_system_recovery.yml b/rules/windows/ransom_inhibit_system_recovery.yml
@@ -0,0 +1,19 @@
+# Rule version v1.2.0 (validated 2026-06-24)
+dataTypes:
+  - wineventlog
+name: 'Windows: Ransomware Recovery Inhibition (Shadow Copy / Backup Deletion)'
+impact:
+  confidentiality: 1
+  integrity: 3
+  availability: 3
+category: Impact
+technique: T1490 - Inhibit System Recovery
+adversary: origin
+description: Detects deletion of Volume Shadow Copies / backups and disabling of Windows recovery (vssadmin, wmic shadowcopy, wbadmin, bcdedit) - a near-universal ransomware precursor and almost never legitimate.
+references:
+  - https://attack.mitre.org/techniques/T1490/
+where: |
+  equals("log.eventCode", 4688) && regexMatch("log.data.CommandLine", "(?i)(vssadmin.*delete.*shadows|wmic.*shadowcopy.*delete|wbadmin.*delete.*(catalog|systemstatebackup|backup)|bcdedit.*(recoveryenabled.*no|bootstatuspolicy.*ignoreallfailures)|Delete-VolumeShadowCopy|win32_shadowcopy.*delete)")
+groupBy:
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/ransom_note_creation.yml b/rules/windows/ransom_note_creation.yml
@@ -15,18 +15,8 @@ description: "Ransomware, is a type of malware that prevents users from accessin
               ransomware attempts. A known ransomware note file has been detected, potentially indicating an active ransomware infection."
 references:
   - "https://attack.mitre.org/tactics/TA0040/"
-where: equals("log.eventCode", 4663) && regexMatch("log.EventDataFileName", "(README_TO_RESTORE_FILES|INSTRUCTION_TO_GET_FILES_BACK|HOW_TO_DECRYPT_FILES|DECRYPT_INSTRUCTION|RECOVER_INSTRUCTION|RESTORE_FILES|READ_ME_NOW|YOUR_FILES_ARE_ENCRYPTED|IMPORTANT_INSTRUCTIONS|NOTICE|DECRYPT_YOUR_FILES|HOW_TO_RESTORE_FILES|HELP_DECRYPT|RECOVERY_FILE|RECOVER-FILES|INSTRUCTION)\\.(txt|html|php)$")
-afterEvents:
-  - indexPattern: v11-log-wineventlog-*
-    with:
-      - field: log.eventCode
-        operator: filter_term
-        value: '{{.log.eventCode}}'
-      - field: log.EventDataFileName.keyword
-        operator: filter_term
-        value: '{{.log.EventDataFileName}}'
-    within: 60s
-    count: 5
-groupBy:
-  - origin.ip
-  - target.user
+where: |
+  equals("log.eventCode", 4663) && regexMatch("log.eventDataObjectName", "(README_TO_RESTORE_FILES|INSTRUCTION_TO_GET_FILES_BACK|HOW_TO_DECRYPT_FILES|DECRYPT_INSTRUCTION|RECOVER_INSTRUCTION|RESTORE_FILES|READ_ME_NOW|YOUR_FILES_ARE_ENCRYPTED|IMPORTANT_INSTRUCTIONS|DECRYPT_YOUR_FILES|HOW_TO_RESTORE_FILES|HELP_DECRYPT|RECOVERY_FILE|RECOVER-FILES)[.](txt|html|php)$")
+groupBy: []
+deduplicateBy:
+  - dataSource
diff --git a/rules/windows/ransom_unusual_file_extension.yml b/rules/windows/ransom_unusual_file_extension.yml
@@ -15,18 +15,8 @@ description: "Ransomware, is a type of malware that prevents users from accessin
               ransomware attempts. Files with unusual file extensions have been detected, potentially indicating encrypted files created by ransomware."
 references:
   - "https://attack.mitre.org/tactics/TA0040/"
-where: equals("log.eventCode", 4663) && regexMatch("log.eventDataFileName", "\\.(7z\\.encrypted|aaa|abcd|abtc|acc|aes256|aes_ni|aes256ctr|aes256encrypted|aes_gcm|ajp|alcatraz_locked|alfa|amnesia[1-9]?|amsi|apocalypse666|armadillo|arrow|asasin|asi|atom128|auditor|aurora|autoit|avastvirusinfo|avenger|av666|azero|barak|barrax|bart|beef|beetle|bip|bit|bitcoin|bl2r|blackblock|blackmail|blast|blind|bmw|boot|braincrypt[3-8]?|broken|btcware|budak|bull|buydecryptor|cakl|calipso|calum|carote|cats|cbf|cccmn|ccrypt|cerber[3-9]?|chifrator|chimera|ciphered|crypted|clover|cobra|codnat3|combo|comrade|conficker|coot|cpt|crash|crimson|cry|crypt\\d{3,4}|crypt38|crypt72|crypt888|cryptinfinite|cryptolocker|cryptowall|cryptxxx|crypz|csfr|csone|ctb[1-4]|ctb-locker|ctrsa|cryptowin|cube|dcrpt|ddtf|dr2|dragon|dried|druid|ducky|ecrpt|eeta|etr|ee|f[0-9]{3,4}|flock|grt|grt[0-9]+|grtlock|gwz|h3ll|hades|hakunamatata|hallucinating|happy|harmful|harrow|havoc|headdesk|helpdecrypt|hermes|hidden|hideous|hijack|hilda|hitler|hjg|hmpl|hrosas|hsdf|hushed|hwrm|ihsdj|ikarus|ikasir|ikayed|ill|imbtc|img|encrypted|improved|indrik|injected|innocent|insane|interesante|jungle|kaos|karl|katana|kimcilware|kin|kiratos|kiss|kjh|locked|locky|lokf|losers|lukitus|m3g4c0rtx|m4n1fest0|m4s4g3|maas|madmax|mafi|magic|maktub|malware|manamecrypt|mandelbrot|manic|matrix|max|md5|medusa|mega|melme|merry|mesmerize|metropolitan|mikey|mikibackup|milarepa.lotos@aol.com|mirror|mmnn|mole|monro|mosk|muslat|n1n1n1|nabr|napoleon|narrow|nasoh|nataniel|neitrino|neras|nlah|nosu|novasof|nozelesn|nuclear|nwa|nymaim|obelisk|off|offwhite|ogdo|omega|omerta|onion|ooss|opencode|openme|opqz|osiris|otx|p3rf0rm4|pabluk|pack14|packagetrackr@india.com|packrat|pahd|panda|pandemic|pandora|pansy|paradise|paris|paym3|paymer|payms|pcap|pclock|peet|pelikan|penis|petya|pewcrypt|phoenix|photominr|phobos|phps|pirated|pluto|po1|point|poop|potato|pr0tect|preppy|princesa|princess|prosper|prosperity|prq|pshy|pumas|pumax|pure|purple|purpler|pwnd|pysa|q9q9|qbtex|qiuu|qkkd|qscx|qtyop|quimera|r2d2|r5a|rabit|radman|raid10|rainbow|rakhni|rambo|ramses|rat|rcrypted|react|reactor|realtek|reaper|redlion|redmat|redrum|rekt|remk|removal|remsec|remy|renaming|revenge|rezuc|rhino|ribd|rich|rip|rire|rizonesoft@protonmail.ch|rk|rmdir|robinhood|rocke|rogue|roldat|rolin|ronzware|rosenquist|rotten|roza|rpcminer|rsalive|rumba|run|rxx|uak|udjvu|unlock92|unlckr|upd|urcp|usam|usbc|v8|vag|vandt|varasto|vault|vauw|vb|ve|vendetta|venom|veracrypt|versiegelt|veton|vhd|vindows|violate|virus|vivin|vk_677|vma|vmx|volcano|vorasto|vorphal|vos|vscrypt|vxl|w4b|wakanda|wannacash|wannacry|wanted|war|wasted|wcry|weapologize|webmafia|weird|weui|whatthefuck|whistler|white|whitenoise|whiterabbit|whorus|why!decryptor|wicked|wildfire|windows10|windows7|windows8|windowsupdate|winlock|wipe|wisconsin|wizard|wlu|woolger|worm|wormfubuki|wow|wpencrypt|wq!decryptor|wrui|wtg|x1881|x3m|xampug|xdata|xencrypt|xfiles|xhelper|xlr|xman|xmd|xmd|xtbl|xtbl|xtr|xtt|xtz|xyz|yakuza|yatron|ybn|year|yellow|yheq|yty|yuke|yxo|yyto|z3|zatrov|zax|zbot|zbt|zbt|zeppelin|zerber|zet|zet|zfj|zfj|zimbra|zip|zix|zlz|zobm|zoh|zorro|zphs)$")
-afterEvents:
-    - indexPattern: v11-log-wineventlog-*
-      with:
-        - field: log.eventCode
-          operator: filter_term
-          value: "4663"
-        - field: target.user.keyword
-          operator: filter_term
-          value: "{{.target.user}}"
-      within: 5m
-      count: 20
-groupBy:
-  - origin.ip
-  - target.user
+where: |
+  equals("log.eventCode", 4663) && regexMatch("log.eventDataObjectName", "[.](locky|wcry|wncry|wannacry|cryptolocker|cryptowall|cerber[0-9]?|zepto|aesir|osiris|spora|jaff|globe|purge|xtbl|crinf|crjoker|cryptotorlocker|xrtn|cripttt|kraken|darkness|nochance|comrade|encrypted|crypted)$")
+groupBy: []
+deduplicateBy:
+  - dataSource
diff --git a/rules/windows/remote_file_copy_desktopimgdownldr.yml b/rules/windows/remote_file_copy_desktopimgdownldr.yml
@@ -15,9 +15,8 @@ description: "Identifies the desktopimgdownldr utility being used to download a
 references:
   - "https://attack.mitre.org/tactics/TA0011/"
   - "https://attack.mitre.org/techniques/T1105/"
-where: equals("log.eventCode", 4663) &&
-       contains("log.eventDataProcessName", "desktopimgdownldr.exe") && !regexMatch("log.eventDataObjectName", "(:\\Windows\\Web\\|:\\ProgramData\\Microsoft\\Windows\\SystemData\\)") &&
-       regexMatch("log.eventDataObjectName", "\\.(exe|dll|bat|ps1|zip|rar|7z)$")
+where: |
+  equals("log.eventCode", 4663) && contains("log.eventDataProcessName", "desktopimgdownldr.exe") && !regexMatch("log.eventDataObjectName", "(Windows.Web.|ProgramData.Microsoft.Windows.SystemData.)") && regexMatch("log.eventDataObjectName", "[.](exe|dll|bat|ps1|zip|rar|7z)$")
 groupBy:
-  - origin.ip
-  - target.user
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/suspicious_event_as_the_binary_may_have_been_dropped_using_windows_dmin_shares.yml b/rules/windows/suspicious_event_as_the_binary_may_have_been_dropped_using_windows_dmin_shares.yml
@@ -14,7 +14,8 @@ description: "Adversaries may use Valid Accounts to interact with a remote netwo
               The adversary may then perform actions as the logged-on user."
 references:
   - "https://attack.mitre.org/techniques/T1021/002/"
-where: regexMatch("log.eventDataImagePath", "(^%systemroot%\\(.+)\\(.+).exe)") && equals("log.eventCode", 7045) && oneOf("log.channel", ["system", "System"])
+where: |
+  equals("log.eventCode", 7045) && oneOf("log.channel", ["system", "System"]) && (contains("log.eventDataImagePath", "%systemroot%") || regexMatch("log.eventDataImagePath", "(?i).:.[Ww]indows.")) && !regexMatch("log.eventDataImagePath", "(?i)(System32|SysWOW64|WinSxS|Microsoft.NET|servicing|SystemApps|drivers|Installer)") && regexMatch("log.eventDataImagePath", "[.]exe")
 groupBy:
-  - origin.host
-  - target.user
+  - dataSource
+deduplicateBy: []
diff --git a/rules/windows/suspicious_powershell_obfuscation.yml b/rules/windows/suspicious_powershell_obfuscation.yml
diff --git a/rules/windows/suspicious_scheduled_task_created.yml b/rules/windows/suspicious_scheduled_task_created.yml
diff --git a/rules/windows/uac_bypass_dll_sideloading.yml b/rules/windows/uac_bypass_dll_sideloading.yml
diff --git a/rules/windows/unusual_dns_service_file_writes.yml b/rules/windows/unusual_dns_service_file_writes.yml
diff --git a/rules/windows/unusual_process_network_connection.yml b/rules/windows/unusual_process_network_connection.yml
diff --git a/rules/windows/windows_remote_management_abuse.yml b/rules/windows/windows_remote_management_abuse.yml
