[Rule Tuning] SMB Connections via LOLBin or Untrusted Process

[Mikaayenson]

Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/windows/lateral_movement_direct_outbound_smb_connection.toml

Rule Tuning Type

Performance - Optimizing resource consumption and execution time of detection rules.

Description

• The sequence uses event.type == "start" until event.type == "end". We should tune this rule to address event aggregation issues where event.type for both will be aggregated within the same event if they fire within 5 seconds causing the sequence to potentially NOP.
• Related to https://github.com/elastic/ia-trade-team/issues/368

Example Data

No response

cc. @nicholasberlin

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.