[Rule Tuning] Sysmon user.id field is always populated with System SID

[w0rk3r]

Description

Rules that support sysmon and uses the user.id field are prone to FPs and FNs because sysmon don't really have user.id data, as per this screenshot as an example:

The SID is not related to the user that created the process. But it is part of the event metadata:

Rules that uses the user.id field and supports sysmon:

• https://github.com/elastic/detection-rules/blob/main/rules/windows/command_and_control_common_webservices.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/command_and_control_iexplore_via_com.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/credential_access_persistence_network_logon_provider_modification.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/discovery_net_command_system_account.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/discovery_post_exploitation_external_ip_lookup.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/execution_register_server_program_connecting_to_the_internet.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/lateral_movement_service_control_spawned_script_int.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/persistence_local_scheduled_task_creation.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/persistence_run_key_and_startup_broad.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/privilege_escalation_installertakeover.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/privilege_escalation_lsa_auth_package.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/privilege_escalation_port_monitor_print_pocessor_abuse.toml
• https://github.com/elastic/detection-rules/blob/main/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml

Actions that we could take to fix the problem:

A. use (process.Ext.token.integrity_level_name : "System" or winlog.event_data.IntegrityLevel : "System")

• Non ECS fields

B. use user.name or an alternative field

• Will probably miss events where the computer language is not English

C. remove beats and windows integration indexes (support)

[w0rk3r]

Remove Windows Integration & Winlogbeat support:

Solved in #1773

• Connection to Commonly Abused Web Services
• Network Logon Provider Registry Modification -> Remove Sysmon support as the integration fails to parse the registry strings.
• External IP Lookup from Non-Browser Process
• Service Control Spawned via Script Interpreter
• Startup or Run Key Registry Modification
• Potential LSA Authentication Package Abuse
• Potential Port Monitor or Print Processor Registration Abuse -> Remove Sysmon support as the integration fails to parse the registry strings.

Modified to use Integrity fields instead of user.id:

Solved in #1772

• Net command via SYSTEM account -> Solved in #1769
• Network Connection via Registration Utility
• Local Scheduled Task Creation
• Potential Privilege Escalation via InstallerFileTakeOver
• Unusual Print Spooler Child Process

Use user.name on the sequence instead of user.id:

Solved in #1771

• Potential Command and Control via Internet Explorer

[w0rk3r]

Solved as per https://github.com/elastic/detection-rules/issues/1770#issuecomment-1039193389