[New Rules] RMM Installation via Internet-Originated MSI

[w0rk3r]

Issues

Part of https://github.com/elastic/ia-trade-team/issues/984

Summary

This PR introduces 2 rules that complement each other, they use the same correlation mechanism, so I'll detail it once:

The logic here correlates 3 events in an ES|QL sequence (yeah, you've read it right): an Internet download identified through Elastic Defend's MoTW enrichment, the same user executing the downloaded MSI with msiexec within 10 minutes, and a same-host msiexec creating a known RMM executable within the next 5 minutes.

This goes beyond what we could express with an EQL sequence here: we normalize the MSI path inside the query, use different correlation keys and time limits between stages, and return the original download event as the alert.

This PR doesn't introduce Investigation Guides on purpose, this will be handled in a separated PR to not distract from what is important to review.

Rules

The rules partition the Internet-originated downloads to avoid duplicate coverage: RMM Software Installation from a Commonly Abused Web Service covers the curated service set, while RMM Software Installation from an Internet-Originated MSI excludes that set and covers the remaining origins.

RMM Software Installation from a Commonly Abused Web Service was tested against a LimeWire-hosted MSI sourced from VirusTotal, link to our stack.

RMM Software Installation from an Internet-Originated MSI was tested against a live malicious ScreenConnect MSI delivery, link to our stack.

Both rules set a min_stack version of 9.5 because FROM subqueries became GA in that version.

[github-actions]

Rule: New - Guidelines

These guidelines serve as a reminder set of considerations when proposing a new rule.

Documentation and Context

• Detailed description of the rule.
• List any new fields required in ECS/data sources.
• Link related issues or PRs.
• Include references.

Rule Metadata Checks

• creation_date matches the date of creation PR initially merged.
• min_stack_version should support the widest stack versions.
• name and description should be descriptive and not include typos.
• query should be inclusive, not overly exclusive, considering performance for diverse environments. Non ecs fields should be added to non-ecs-schema.json if not available in an integration.
• min_stack_comments and min_stack_version should be included if the rule is only compatible starting from a specific stack version.
• index pattern should be neither too specific nor too vague, ensuring it accurately matches the relevant data stream (e.g., use logs-endpoint.process-* for process data).
• integration should align with the index. If the integration is newly introduced, ensure the manifest, schemas, and new_rule.yaml template are updated.
• setup should include the necessary steps to configure the integration.
• note should include any additional information (e.g. Triage and analysis investigation guides, timeline templates).
• tags should be relevant to the threat and align/added to the EXPECTED_RULE_TAGS in the definitions.py file.
• threat, techniques, and subtechniques should map to ATT&CK always if possible.

New BBR Rules

• building_block_type should be included if the rule is a building block and the rule should be located in the rules_building_block folder.
• bypass_bbr_timing should be included if adding custom lookback timing to the rule.

Testing and Validation

• Provide evidence of testing and detecting the expected threat.
• Check for existence of coverage to prevent duplication.

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ RMM Software Installation from an Internet-Originated MSI (esql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ RMM Software Installation from a Commonly Abused Web Service (esql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[Copilot]

Pull request overview

Adds complementary Windows ES|QL rules correlating Internet-originated MSI downloads, msiexec execution, and RMM installation.

Changes:

• Separates commonly abused web services from other Internet origins.
• Correlates download, execution, and RMM executable creation events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 10 comments.

File	Description
command_and_control_rmm_software_installation_from_internet_originated_msi.toml	Detects RMM installation from other Internet origins.
command_and_control_rmm_software_installation_from_commonly_abused_web_service.toml	Detects RMM installation from curated abused services.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ RMM Software Installation from an Internet-Originated MSI (esql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ RMM Software Installation from a Commonly Abused Web Service (esql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[eric-forte-elastic]

ES|QL Validation will continue to fail on this PR until #6665 is merged. The queries do pass validation on this branch, so it is expected that they are valid/correct.

[terrancedejesus]

Quite a bit to unpack! Very cool approach to sequences with nested FROM. Reviewed some of the download locations missing for cloud. Tested queries in TRADE stack, both work. Min-stack seems appropriate

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ RMM Software Installation from an Internet-Originated MSI (esql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ RMM Software Installation from a Commonly Abused Web Service (esql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta