[Rule Tuning] Remote Execution via File Shares - False positive for CrowdStrike updates

[htbcallan]

Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/windows/lateral_movement_execution_via_file_shares_sequence.toml

Rule Tuning Type

False Positives - Reducing benign events mistakenly identified as threats.

Description

'Remote Execution via File Shares' generating false positives for normal CrowdStrike sensor update activity.
Propose adding the following to query NOT filter

        (process.executable : "?:\\Windows\\System32\\drivers\\CrowdStrike\\*-FalconSensor_Windows.*.exe" and 
         process.code_signature.trusted == true and process.code_signature.subject_name : "CrowdStrike, Inc.")

In my current use case, process.executable is "19011-FalconSensor_Windows.x64.exe", where 19011 is a release number and x64 is the platform type. process.code_signature.* should be static across releases and platforms.

_source from example ancestor events from logs-endpoint.events.file and logs-endpoint.events.process attached

Example Data

endpoint.events.file.json
endpoint.events.process.json

[w0rk3r]

Hey @htbcallan, I just pushed this PR to exclude this activity. Thanks for letting us know, and I'm looking forward to the next contributions!