From 2c6abc661971f10fb36e2b5f89522c583f5d9868 Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:03:56 +0100
Subject: [PATCH 01/15] Update and rename
 rules_building_block/defense_evasion_masquerading_windows_dll.toml to
 rules/windows/defense_evasion_masquerading_windows_dll.toml

---
 ...ense_evasion_masquerading_windows_dll.toml | 41 +++++++++++++------
 1 file changed, 29 insertions(+), 12 deletions(-)
 rename {rules_building_block => rules/windows}/defense_evasion_masquerading_windows_dll.toml (96%)

diff --git a/rules_building_block/defense_evasion_masquerading_windows_dll.toml b/rules/windows/defense_evasion_masquerading_windows_dll.toml
similarity index 96%
rename from rules_building_block/defense_evasion_masquerading_windows_dll.toml
rename to rules/windows/defense_evasion_masquerading_windows_dll.toml
index 7a42e416ca9..7b52ef60ab5 100644
--- a/rules_building_block/defense_evasion_masquerading_windows_dll.toml
+++ b/rules/windows/defense_evasion_masquerading_windows_dll.toml
@@ -3,11 +3,10 @@ bypass_bbr_timing = true
 creation_date = "2023/08/18"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2026/03/24"
+updated_date = "2026/06/17"
 
 [rule]
 author = ["Elastic"]
-building_block_type = "default"
 description = """
 Identifies suspicious instances of default system32 DLLs either unsigned or signed with non-MS certificates. This can
 potentially indicate the attempt to masquerade as system DLLs, perform DLL Search Order Hijacking or backdoor and resign
@@ -18,23 +17,22 @@ index = ["logs-endpoint.events.library-*"]
 language = "eql"
 license = "Elastic License v2"
 name = "Potential Masquerading as System32 DLL"
-risk_score = 21
+risk_score = 73
 rule_id = "fb01d790-9f74-4e76-97dd-b4b0f7bf6435"
-severity = "low"
+severity = "high"
 tags = [
     "Domain: Endpoint",
     "Data Source: Elastic Defend",
     "OS: Windows",
     "Use Case: Threat Detection",
     "Tactic: Defense Evasion",
-    "Tactic: Persistence",
-    "Rule Type: BBR",
+    "Tactic: Persistence"
 ]
 timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-library where event.action == "load" and dll.Ext.relative_file_creation_time <= 3600 and
+library where event.action == "load" and (dll.Ext.relative_file_creation_time <= 3600 or or dll.Ext.relative_file_name_modify_time <= 3600) and
     not (
       dll.path : (
         "?:\\Windows\\System32\\*",
@@ -80,26 +78,45 @@ library where event.action == "load" and dll.Ext.relative_file_creation_time <=
       ) or
       (
         dll.name : "ucrtbase.dll" and dll.code_signature.subject_name in (
-          "Proofpoint, Inc.", "Rapid7 LLC", "Eclipse.org Foundation, Inc.", "Amazon.com Services LLC", "Windows Phone"
+          "Proofpoint, Inc.", "Rapid7 LLC", "Eclipse.org Foundation, Inc.", "Amazon.com Services LLC", "Windows Phone", "London Jamocha Community CIC", "Palo Alto Networks (Netherlands) B.V.", "Sophos Ltd"
         ) and dll.code_signature.trusted == true
       ) or
       (
-        dll.name : ("libcrypto.dll", "wmi.dll", "geolocation.dll", "kerberos.dll") and
+        dll.name : "d3d9.dll" and dll.code_signature.subject_name == "Open Source Developer Alban CLIQUET" and dll.code_signature.trusted == true
+      ) or
+      (
+        dll.name : ("libcrypto.dll", "wmi.dll", "geolocation.dll", "kerberos.dll", "UpdateAgent.dll") and
         dll.code_signature.subject_name == "Bitdefender SRL" and dll.code_signature.trusted == true
       ) or
       (dll.name : "ICMP.dll" and dll.code_signature.subject_name == "Paessler AG" and dll.code_signature.trusted == true) or
       (dll.name : "dbghelp.dll" and dll.code_signature.trusted == true) or
       (dll.name : "DirectML.dll" and dll.code_signature.subject_name == "Adobe Inc." and dll.code_signature.trusted == true) or
       (dll.name : "icsvc.dll" and dll.code_signature.subject_name in ("Dell Inc", "Dell Technologies Inc.") and dll.code_signature.trusted == true) or
-      (dll.name : "offreg.dll" and dll.code_signature.subject_name == "Malwarebytes Inc." and dll.code_signature.trusted == true) or
-      (dll.name : "AppMgr.dll" and dll.code_signature.subject_name == "Autodesk, Inc" and dll.code_signature.trusted == true) or
+      (dll.name : "offreg.dll" and dll.code_signature.subject_name in ("Malwarebytes Inc.", "Malwarebytes Inc") and dll.code_signature.trusted == true) or
+      (dll.name : ("AppMgr.dll", "icuuc.dll") and dll.code_signature.subject_name in ("Autodesk, Inc", "Autodesk, Inc.") and dll.code_signature.trusted == true) or
       (dll.name : ("SsShim.dll", "Msi.dll", "wdscore.dll") and process.name : "DismHost.exe" and dll.path : "C:\\Windows\\Temp\\*") or
+      (dll.code_signature.trusted == true and 
+       dll.code_signature.subject_name in (
+        "ALIBABA CLOUD COMPUTING LTD", 
+        "Epic Systems Corporation", 
+        "Google LLC"
+        "Agilysys, Inc.", 
+        "CD PROJEKT S.A.", 
+        "Check Point Software Technologies Ltd.", 
+        "Dedalus Italia S.P.A.", 
+        "AOMEI International Network Limited", 
+        "CHENGDU AOMEI TECHNOLOGY CO., LTD.", 
+        "GN Hearing A/S", 
+        "Paessler GmbH", 
+        "Symantec Corporation")) or
       (
         dll.path : (
           "?:\\Windows\\SystemApps\\*\\dxgi.dll",
           "?:\\Windows\\SystemApps\\*\\wincorlib.dll",
           "?:\\Windows\\dxgi.dll",
-          "?:\\Users\\*\\AppData\\Local\\LINE\\bin\\current\\dbghelp.dll"
+          "?:\\Users\\*\\AppData\\Local\\LINE\\bin\\current\\dbghelp.dll", 
+          "?:\\Program Files (x86)\\SAP\\FrontEnd\\SAPgui\\dbghelp.dll", 
+          "?:\\Program Files (x86)\\Common Files\\Crystal Decision\\2.0\\bin\\atl.dll"
         )
       )
     )

From b2e2ec59f5217b03315e97c34a26928263ed5ac6 Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:06:44 +0100
Subject: [PATCH 02/15] Update defense_evasion_masquerading_windows_dll.toml

---
 rules/windows/defense_evasion_masquerading_windows_dll.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/defense_evasion_masquerading_windows_dll.toml b/rules/windows/defense_evasion_masquerading_windows_dll.toml
index 7b52ef60ab5..d296c6fefc8 100644
--- a/rules/windows/defense_evasion_masquerading_windows_dll.toml
+++ b/rules/windows/defense_evasion_masquerading_windows_dll.toml
@@ -32,7 +32,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-library where event.action == "load" and (dll.Ext.relative_file_creation_time <= 3600 or or dll.Ext.relative_file_name_modify_time <= 3600) and
+library where event.action == "load" and (dll.Ext.relative_file_creation_time <= 3600 or dll.Ext.relative_file_name_modify_time <= 3600) and
     not (
       dll.path : (
         "?:\\Windows\\System32\\*",

From 3cba5c23246ebbdb42188a02164781825c0a763e Mon Sep 17 00:00:00 2001
From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Date: Wed, 17 Jun 2026 11:13:16 -0300
Subject: [PATCH 03/15] Apply suggestion from @w0rk3r

---
 rules/windows/defense_evasion_masquerading_windows_dll.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/defense_evasion_masquerading_windows_dll.toml b/rules/windows/defense_evasion_masquerading_windows_dll.toml
index d296c6fefc8..67876bdc26c 100644
--- a/rules/windows/defense_evasion_masquerading_windows_dll.toml
+++ b/rules/windows/defense_evasion_masquerading_windows_dll.toml
@@ -99,7 +99,7 @@ library where event.action == "load" and (dll.Ext.relative_file_creation_time <=
        dll.code_signature.subject_name in (
         "ALIBABA CLOUD COMPUTING LTD", 
         "Epic Systems Corporation", 
-        "Google LLC"
+        "Google LLC",
         "Agilysys, Inc.", 
         "CD PROJEKT S.A.", 
         "Check Point Software Technologies Ltd.", 

From 799ef74c4c0df2faa760fe561ee6954041f009d1 Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:15:43 +0100
Subject: [PATCH 04/15] Update defense_evasion_masquerading_windows_dll.toml

---
 rules/windows/defense_evasion_masquerading_windows_dll.toml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/rules/windows/defense_evasion_masquerading_windows_dll.toml b/rules/windows/defense_evasion_masquerading_windows_dll.toml
index 67876bdc26c..a70b456b78d 100644
--- a/rules/windows/defense_evasion_masquerading_windows_dll.toml
+++ b/rules/windows/defense_evasion_masquerading_windows_dll.toml
@@ -1,5 +1,4 @@
 [metadata]
-bypass_bbr_timing = true
 creation_date = "2023/08/18"
 integration = ["endpoint"]
 maturity = "production"

From 0b8c2e4f6eca156d22afa2ffe39164bdc8007038 Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Wed, 17 Jun 2026 17:23:03 +0100
Subject: [PATCH 05/15] Update defense_evasion_masquerading_windows_dll.toml

---
 ...ense_evasion_masquerading_windows_dll.toml | 43 ++++++++++++++++++-
 1 file changed, 42 insertions(+), 1 deletion(-)

diff --git a/rules/windows/defense_evasion_masquerading_windows_dll.toml b/rules/windows/defense_evasion_masquerading_windows_dll.toml
index a70b456b78d..c6f09ac88d7 100644
--- a/rules/windows/defense_evasion_masquerading_windows_dll.toml
+++ b/rules/windows/defense_evasion_masquerading_windows_dll.toml
@@ -16,6 +16,46 @@ index = ["logs-endpoint.events.library-*"]
 language = "eql"
 license = "Elastic License v2"
 name = "Potential Masquerading as System32 DLL"
+note = """## Triage and analysis
+
+### Investigating Potential Masquerading as System32 DLL
+
+This rule fires when a DLL with a name matching a known Windows System32 library is loaded from an unexpected path, is unsigned or signed by a non-Microsoft certificate, and was recently created or modified (within the last hour). This pattern is consistent with DLL Search Order Hijacking, DLL planting, or backdooring/resigning of legitimate system DLLs — all common defense evasion and persistence techniques used by both commodity malware and sophisticated threat actors.
+
+#### Possible investigation steps
+
+- Examine the full `dll.path` to determine where the suspicious DLL was loaded from. Paths under user-writable directories (`AppData`, `Temp`, `Downloads`, `ProgramData`) or application directories are high-fidelity indicators.
+- Review `dll.code_signature` fields — check whether the DLL is unsigned, self-signed, or signed by an unexpected publisher. A trusted signature from a legitimate vendor may indicate a false positive; an invalid or absent signature warrants deeper investigation.
+- Check `dll.Ext.relative_file_creation_time` and `dll.Ext.relative_file_name_modify_time` — a DLL dropped and loaded within seconds or minutes of each other strongly suggests staged execution.
+- Identify the loading process (`process.name`, `process.executable`, `process.pid`) and examine its parent chain for unusual ancestry (e.g. Office spawning a loader, or a browser dropping a DLL).
+- Retrieve the DLL and hash it with `Get-FileHash -Algorithm SHA256`. Search the hash across VirusTotal, Hybrid-Analysis, MalwareBazaar, and CISCO Talos.
+- Check whether other hosts in the environment have loaded the same DLL path or hash — a single host is likely targeted or hands-on, widespread hits may indicate a worm or supply chain issue.
+- Correlate with process creation events around the same timestamp to identify what dropped the DLL (downloaders, document macros, installers, etc.).
+- Inspect the directory containing the DLL for other recently created files, scripts, or executables that may be part of the same drop.
+
+### False positive analysis
+
+- Legitimate third-party software occasionally ships DLLs with names that collide with System32 libraries (e.g. security vendors, game engines, virtualization software, and enterprise tooling). Validate the publisher via `dll.code_signature.subject_name` and cross-reference against known software installed on the host.
+- Installer and update workflows may briefly stage DLLs in temp paths before moving them to their final location — check whether the loading process is a known installer (`msiexec.exe`, `setup.exe`, vendor updaters) and whether the DLL path disappears after a short window.
+- DismHost.exe staging certain DLLs under `C:\Windows\Temp\` during servicing operations is a known benign pattern already excluded in the query.
+
+### Related rules
+
+- Suspicious DLL Loaded for Persistence via Desktop File - c4818812-d44f-47be-aaef-4cfb2f9cc799
+- Suspicious Process from Conhost - 28896382-7d4f-4d50-9b72-67091901fd26
+- Potential DLL Side-Loading via Trusted Microsoft Programs - 1160dcdb-0a0a-4a79-91d8-9b84af7e0240
+
+### Response and remediation
+
+- Initiate the incident response process based on triage outcome. If the DLL is confirmed malicious, treat the host as compromised.
+- Isolate the affected host and preserve a memory dump and disk image before remediation to retain forensic evidence.
+- Delete the malicious DLL and any associated files identified during investigation.
+- If DLL Search Order Hijacking is confirmed, identify the vulnerable application and remediate by patching, applying a safe DLL search mode (`HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode`), or restricting write permissions on directories in the application's search path.
+- If a legitimate binary was backdoored and resigned, treat all binaries delivered via the same channel as suspect and investigate the supply chain.
+- Block identified file hashes and signer certificates as appropriate at the endpoint and perimeter.
+- Hunt for lateral movement or persistence mechanisms established after the DLL was loaded — check scheduled tasks, services, registry run keys, and WMI subscriptions created around the same timeframe.
+- Determine the initial access vector and remediate to prevent reinfection.
+"""
 risk_score = 73
 rule_id = "fb01d790-9f74-4e76-97dd-b4b0f7bf6435"
 severity = "high"
@@ -25,7 +65,8 @@ tags = [
     "OS: Windows",
     "Use Case: Threat Detection",
     "Tactic: Defense Evasion",
-    "Tactic: Persistence"
+    "Tactic: Persistence",
+    "Resources: Investigation Guide",
 ]
 timestamp_override = "event.ingested"
 type = "eql"

From 04c9c1c2184ca7b5cdfa6d522f7098ee6bd6c919 Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Wed, 17 Jun 2026 17:56:55 +0100
Subject: [PATCH 06/15] Fix TOML parse error in masquerading Windows DLL rule
 note

Escape backslashes in Windows paths within the investigation guide so pytoml can load the rule file.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 rules/windows/defense_evasion_masquerading_windows_dll.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/windows/defense_evasion_masquerading_windows_dll.toml b/rules/windows/defense_evasion_masquerading_windows_dll.toml
index c6f09ac88d7..5243ace1e1b 100644
--- a/rules/windows/defense_evasion_masquerading_windows_dll.toml
+++ b/rules/windows/defense_evasion_masquerading_windows_dll.toml
@@ -37,7 +37,7 @@ This rule fires when a DLL with a name matching a known Windows System32 library
 
 - Legitimate third-party software occasionally ships DLLs with names that collide with System32 libraries (e.g. security vendors, game engines, virtualization software, and enterprise tooling). Validate the publisher via `dll.code_signature.subject_name` and cross-reference against known software installed on the host.
 - Installer and update workflows may briefly stage DLLs in temp paths before moving them to their final location — check whether the loading process is a known installer (`msiexec.exe`, `setup.exe`, vendor updaters) and whether the DLL path disappears after a short window.
-- DismHost.exe staging certain DLLs under `C:\Windows\Temp\` during servicing operations is a known benign pattern already excluded in the query.
+- DismHost.exe staging certain DLLs under `C:\\Windows\\Temp\\` during servicing operations is a known benign pattern already excluded in the query.
 
 ### Related rules
 
@@ -50,7 +50,7 @@ This rule fires when a DLL with a name matching a known Windows System32 library
 - Initiate the incident response process based on triage outcome. If the DLL is confirmed malicious, treat the host as compromised.
 - Isolate the affected host and preserve a memory dump and disk image before remediation to retain forensic evidence.
 - Delete the malicious DLL and any associated files identified during investigation.
-- If DLL Search Order Hijacking is confirmed, identify the vulnerable application and remediate by patching, applying a safe DLL search mode (`HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode`), or restricting write permissions on directories in the application's search path.
+- If DLL Search Order Hijacking is confirmed, identify the vulnerable application and remediate by patching, applying a safe DLL search mode (`HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\SafeDllSearchMode`), or restricting write permissions on directories in the application's search path.
 - If a legitimate binary was backdoored and resigned, treat all binaries delivered via the same channel as suspect and investigate the supply chain.
 - Block identified file hashes and signer certificates as appropriate at the endpoint and perimeter.
 - Hunt for lateral movement or persistence mechanisms established after the DLL was loaded — check scheduled tasks, services, registry run keys, and WMI subscriptions created around the same timeframe.

From b9f16c8b377a37559d8971ed6ce03e798ed34cd9 Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Fri, 3 Jul 2026 15:07:16 +0100
Subject: [PATCH 07/15] Update command_and_control_dns_tunneling_nslookup.toml

---
 .../windows/command_and_control_dns_tunneling_nslookup.toml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/rules/windows/command_and_control_dns_tunneling_nslookup.toml b/rules/windows/command_and_control_dns_tunneling_nslookup.toml
index 3d3ef7149db..f1ef9340de0 100644
--- a/rules/windows/command_and_control_dns_tunneling_nslookup.toml
+++ b/rules/windows/command_and_control_dns_tunneling_nslookup.toml
@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2020/11/11"
-integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
+integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
 maturity = "production"
-updated_date = "2026/05/04"
+updated_date = "2026/07/03"
 
 [rule]
 author = ["Elastic"]
@@ -19,6 +19,7 @@ index = [
     "logs-system.security*",
     "logs-windows.forwarded*",
     "logs-windows.sysmon_operational-*",
+    "logs-crowdstrike.fdr*",
     "winlogbeat-*",
 ]
 language = "eql"
@@ -91,6 +92,7 @@ tags = [
     "Data Source: Microsoft Defender XDR",
     "Data Source: SentinelOne",
     "Data Source: Sysmon",
+    "Data Source: Crowdstrike",
 ]
 type = "eql"
 

From bffddbf91b5bfd80f41b38dcbff8866efa9c1edf Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Fri, 3 Jul 2026 15:16:28 +0100
Subject: [PATCH 08/15] Update command_and_control_dns_tunneling_nslookup.toml

---
 rules/windows/command_and_control_dns_tunneling_nslookup.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rules/windows/command_and_control_dns_tunneling_nslookup.toml b/rules/windows/command_and_control_dns_tunneling_nslookup.toml
index f1ef9340de0..f70c3f846aa 100644
--- a/rules/windows/command_and_control_dns_tunneling_nslookup.toml
+++ b/rules/windows/command_and_control_dns_tunneling_nslookup.toml
@@ -74,6 +74,7 @@ This rule also supports the following third-party data sources. For setup instru
 - [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
 - [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
 - [Windows Process Creation Logs](https://ela.st/audit-process-creation)
+- [CrowdStrike](https://ela.st/crowdstrike-integration)
 """
 
 references = ["https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/"]

From 34e3605a18eac4384546f63a4532fb7e39729270 Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Fri, 3 Jul 2026 15:20:57 +0100
Subject: [PATCH 09/15] Create exfiltration_dns_excessive_chunked_queries.toml

---
 ...tration_dns_excessive_chunked_queries.toml | 154 ++++++++++++++++++
 1 file changed, 154 insertions(+)
 create mode 100644 rules/windows/exfiltration_dns_excessive_chunked_queries.toml

diff --git a/rules/windows/exfiltration_dns_excessive_chunked_queries.toml b/rules/windows/exfiltration_dns_excessive_chunked_queries.toml
new file mode 100644
index 00000000000..051933affd8
--- /dev/null
+++ b/rules/windows/exfiltration_dns_excessive_chunked_queries.toml
@@ -0,0 +1,154 @@
+[metadata]
+creation_date = "2026/07/03"
+integration = ["endpoint", "windows", "crowdstrike"]
+maturity = "development"
+updated_date = "2026/07/03"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies potential DNS exfiltration on Windows hosts by detecting a high volume of DNS queries whose subdomain labels
+follow a chunked encoding pattern (index-payload.base_domain). Attackers split stolen data across many DNS queries to
+evade volume-based detection; this rule aggregates queries per process, base domain, and five-minute window and flags
+sessions with many distinct chunk indices and sufficiently long encoded payloads.
+"""
+from = "now-9m"
+interval = "5m"
+language = "esql"
+license = "Elastic License v2"
+name = "Potential DNS Exfiltration via Excessive Chunked Queries"
+note = """## Triage and analysis
+
+### Investigating Potential DNS Exfiltration via Excessive Chunked Queries
+
+DNS tunneling and exfiltration often encode data in subdomain labels using a chunk index prefix (for example,
+`42-<base64-or-hex-payload>.attacker.example`). A large number of distinct chunk indices to the same base domain from
+one process within a short window strongly suggests staged data transfer rather than normal resolution behavior.
+
+### Possible investigation steps
+
+- Review **Esql.base_domain**, **Esql.unique_chunks**, and **Esql.max_index** on the alert to gauge exfil volume and
+  whether chunk indices form a contiguous or near-contiguous sequence.
+- Identify **process.name** and **process.executable** (from related network events on the same host) and inspect the
+  process tree for scripting runtimes, LOLBins, or unsigned binaries.
+- Pivot on **host.id** for other DNS, network, or exfiltration alerts in the past 48 hours.
+- Inspect sample **dns.question.name** values for the session to confirm encoded payload subdomains and estimate data
+  volume (**Esql.avg_payload_len** × **Esql.unique_chunks**).
+- Check whether the base domain is newly observed, lacks business justification, or resolves to infrastructure outside
+  approved DNS allowlists.
+
+### False positive analysis
+
+- Legitimate software that encodes telemetry or session tokens in DNS labels is rare; validate against known vendor
+  behavior before closing.
+- Security scanners or research tools that generate synthetic chunked DNS labels may match; confirm process identity and
+  organizational ownership.
+
+### Response and remediation
+
+- If confirmed malicious: isolate the host, block the **Esql.base_domain** at DNS and egress controls, and preserve
+  DNS/network logs for scoping.
+- Hunt for the same **Esql.base_domain** and process hash across other hosts and users.
+- Reset credentials and review data accessible to the involved user or process if exfiltration is confirmed.
+"""
+
+setup = """## Setup
+
+This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
+
+Setup instructions: https://ela.st/install-elastic-defend
+
+### Additional data sources
+
+This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
+
+- [CrowdStrike](https://ela.st/crowdstrike-integration)
+- [Sysmon Event ID 22 - DNS Query](https://ela.st/sysmon-event-22-setup)
+"""
+
+references = [
+    "https://attack.mitre.org/techniques/T1048/003/",
+    "https://attack.mitre.org/techniques/T1572/",
+    "https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/",
+]
+risk_score = 47
+rule_id = "882a39ad-a404-45e3-b5d4-bc11d2b09818"
+severity = "medium"
+tags = [
+    "Domain: Endpoint",
+    "OS: Windows",
+    "Use Case: Threat Detection",
+    "Tactic: Exfiltration",
+    "Resources: Investigation Guide",
+    "Data Source: Elastic Defend",
+    "Data Source: Crowdstrike",
+    "Data Source: Sysmon",
+]
+timestamp_override = "event.ingested"
+type = "esql"
+
+query = '''
+FROM logs-crowdstrike.fdr*, logs-endpoint.events.network-*, logs-windows.sysmon_operational-*
+| WHERE host.os.type == "windows"
+    AND event.category == "network"
+    AND event.action IN ("lookup_requested", "DNSEvent (DNS query)", "DnsRequest")
+    AND process.name != "svchost.exe"
+    AND dns.question.name RLIKE """[0-9]{1,5}-[A-Za-z0-9+/=]{15,63}\..+"""
+| GROK dns.question.name "%{INT:chunk_index}-%{DATA:chunk_payload}\\.%{GREEDYDATA:Esql.base_domain}"
+| WHERE chunk_index IS NOT NULL
+| EVAL payload_len = LENGTH(chunk_payload)
+| STATS
+    Esql.occurrences = COUNT(*),
+    Esql.unique_chunks = COUNT_DISTINCT(chunk_index),
+    Esql.max_index = MAX(TO_INTEGER(chunk_index)),
+    Esql.avg_payload_len = AVG(payload_len)
+  BY process.name, Esql.base_domain, user.id, user.name, host.id, host.name, data_stream.namespace, DATE_TRUNC(5 minutes, @timestamp)
+| WHERE Esql.occurrences >= 30
+    AND Esql.unique_chunks >= 30
+    AND Esql.avg_payload_len >= 20
+| SORT Esql.unique_chunks DESC
+| LIMIT 20
+| KEEP host.id, host.name, process.name, user.id, user.name, Esql.base_domain, Esql.*
+'''
+
+[rule.investigation_fields]
+field_names = [
+    "@timestamp",
+    "host.id",
+    "host.name",
+    "user.id",
+    "user.name",
+    "process.name",
+    "dns.question.name",
+]
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+
+[[rule.threat.technique]]
+id = "T1048"
+name = "Exfiltration Over Alternative Protocol"
+reference = "https://attack.mitre.org/techniques/T1048/"
+
+[[rule.threat.technique.subtechnique]]
+id = "T1048.003"
+name = "Exfiltration Over Unencrypted Non-C2 Protocol"
+reference = "https://attack.mitre.org/techniques/T1048/003/"
+
+[rule.threat.tactic]
+id = "TA0010"
+name = "Exfiltration"
+reference = "https://attack.mitre.org/tactics/TA0010/"
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+
+[[rule.threat.technique]]
+id = "T1572"
+name = "Protocol Tunneling"
+reference = "https://attack.mitre.org/techniques/T1572/"
+
+[rule.threat.tactic]
+id = "TA0011"
+name = "Command and Control"
+reference = "https://attack.mitre.org/tactics/TA0011/"

From 18f2c93d29340149d71700bf7b903991dbf0f69f Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Fri, 21 Aug 2026 23:44:25 +0100
Subject: [PATCH 10/15] [New] Potential Evasion via Boot Time Removal Tool

Identify abuse of BTR driver (microsoft driver) to tamper with system objects from kernel mode such as locked file deletion. Normal process that drops changelist ADS or modify Args registry is the MRT.exe (malware removal tool). This rule fies on other than MRT.
---
 ...efense_evasion_boot_time_removal_tool.toml | 210 ++++++++++++++++++
 1 file changed, 210 insertions(+)
 create mode 100644 rules/windows/defense_evasion_boot_time_removal_tool.toml

diff --git a/rules/windows/defense_evasion_boot_time_removal_tool.toml b/rules/windows/defense_evasion_boot_time_removal_tool.toml
new file mode 100644
index 00000000000..9dfdd2b3b8f
--- /dev/null
+++ b/rules/windows/defense_evasion_boot_time_removal_tool.toml
@@ -0,0 +1,210 @@
+[metadata]
+creation_date = "2026/08/21"
+integration = ["endpoint"]
+maturity = "production"
+updated_date = "2026/08/21"
+
+[rule]
+author = ["Elastic"]
+description = """
+Identifies creation of a `:changelist` NTFS alternate data stream or a Windows service Args registry value pointing to
+a `:changelist` path. Microsoft Defender's Boot-Time Removal (BTR.sys) driver reads an RC4-encrypted transaction blob
+from a driver ADS named `:changelist`, referenced by HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Args. Adversaries can
+reproduce this staging outside Defender to abuse BTR.sys as a signed kernel primitive for arbitrary file and registry
+operations. This rule focuses on non-System writers and excludes Microsoft-signed MRT.exe running as SYSTEM, which may
+perform related remediation staging.
+"""
+from = "now-9m"
+language = "esql"
+license = "Elastic License v2"
+name = "Potential Evasion via Boot Time Removal Tool"
+note = """## Triage and analysis
+
+### Investigating Potential Evasion via Boot Time Removal Tool
+
+Windows Defender's Boot-Time Removal driver (`BTR.sys`) is instructed via an encrypted configuration stored in an
+Alternate Data Stream named `:changelist` on a `.sys` image. The service `Args` value under
+`HKLM\\SYSTEM\\*ControlSet*\\Services\\<name>\\Args` points at that ADS path. Check Point Research (BTR Reforged)
+showed that the same staging can be performed by non-Defender tooling (for example BTR_CLI) to drive Ring-0 file and
+registry actions, including neutralization of security products during early boot.
+
+#### Possible investigation steps
+
+- Identify whether the alert is a file ADS creation or a service `Args` registry write using `event.category`,
+  `file.name` / `file.path`, and `registry.path` / `registry.data.strings`.
+- Review `process.executable`, `process.name`, `process.pid`, `process.parent.executable`, and `user.id` to determine
+  whether a Defender component, MRT, or an unexpected user-mode binary staged the `:changelist` artifact.
+- For file events, inspect the base `.sys` path (strip `:changelist`), size, hash, and code signature. Confirm whether
+  the driver was recently dropped under a user-writable path (Downloads, Temp, Desktop) versus a Defender-managed path.
+- For registry events, note the service key name under `Services\\*` and check sibling values (`ImagePath`, `Type`,
+  `Group`). Abuse tooling often sets `Group` to `Boot Bus Extender` and may create the service via direct registry
+  writes / `NtLoadDriver` without a corresponding SCM service-install event (7045).
+- Hunt on the same `host.id` for related activity: creation of `*.sys:*.dat` feedback ADS, load of a Microsoft-signed
+  driver matching BTR, creation/deletion of `\\\\SystemRoot\\\\Temp\\\\BootClean.log` by PID 4, and deletions of security
+  binaries attributed to System.
+- Correlate with other alerts for the same `user.id` and `host.id` in the prior 48 hours for privilege escalation,
+  driver load, or Defender tampering.
+
+### False positive analysis
+
+- Legitimate Defender or MRT reboot remediation may create `:changelist` ADS and related service Args values. This rule
+  excludes PID 4 and Microsoft-signed `MRT.exe` as SYSTEM; unsigned or differently signed `MRT.exe` still alerts. Rare
+  Defender paths (for example `MsMpEng.exe`) may still match and should be validated before exceptioning.
+- Security research labs intentionally exercising BTR_CLI or similar PoCs will generate true-positive-looking events;
+  confirm host cohort and change windows.
+
+### Response and remediation
+
+- If activity is unexplained: isolate the host, preserve the `.sys` file and `:changelist` stream, export the service
+  registry key, and capture the staging process tree before cleanup.
+- Search the estate for the same `file.name` / ADS pattern, service `Args` values containing `:changelist`, and related
+  driver hashes.
+- Remove unauthorized service keys and staged drivers, restore any deleted security components from known-good media,
+  and rotate credentials for accounts that held `SeLoadDriverPrivilege` on the host.
+- Restrict and monitor assignment/use of `SeLoadDriverPrivilege`; treat signed remediation drivers as LOLDrivers that
+  require lineage and ADS context monitoring, not signature blocking alone.
+"""
+
+setup = """## Setup
+
+This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
+
+Setup instructions: https://ela.st/install-elastic-defend
+"""
+
+references = [
+    "https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/",
+    "https://github.com/Dump-GUY/BTR_CLI",
+]
+risk_score = 73
+rule_id = "942c8f59-f01c-4dc0-a05f-2f5bba836ad8"
+severity = "high"
+tags = [
+    "Domain: Endpoint",
+    "OS: Windows",
+    "Use Case: Threat Detection",
+    "Tactic: Defense Evasion",
+    "Tactic: Persistence",
+    "Resources: Investigation Guide",
+    "Data Source: Elastic Defend",
+]
+timestamp_override = "event.ingested"
+type = "esql"
+
+query = '''
+from logs-endpoint.events.file-*, logs-endpoint.events.registry-* metadata _id, _version, _index
+| where host.os.type == "windows"
+  and process.pid != 4
+  and not (
+    user.id == "S-1-5-18"
+    and to_lower(process.executable) like """?:\\windows\\system32\\mrt.exe"""
+    and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation")
+  )
+  and (
+    (
+      event.category == "file"
+      and event.type == "creation"
+      and ends_with(to_lower(file.name), ":changelist")
+    )
+    or (
+      event.category == "registry"
+      and event.type == "change"
+      and to_lower(registry.path) like """*\\system\\*controlset*\\services\\*\\args"""
+      and to_lower(registry.data.strings) like "*:changelist"
+    )
+  )
+| keep
+    @timestamp,
+    host.id,
+    host.name,
+    user.id,
+    user.name,
+    process.pid,
+    process.name,
+    process.executable,
+    process.code_signature.subject_name,
+    event.category,
+    event.type,
+    file.path,
+    file.name,
+    file.size,
+    registry.path,
+    registry.value,
+    registry.data.strings,
+    data_stream.namespace,
+    _id,
+    _version,
+    _index
+| limit 100
+'''
+
+[rule.investigation_fields]
+field_names = [
+    "@timestamp",
+    "host.id",
+    "host.name",
+    "user.id",
+    "user.name",
+    "process.pid",
+    "process.name",
+    "process.executable",
+    "process.code_signature.subject_name",
+    "event.category",
+    "file.path",
+    "file.name",
+    "file.size",
+    "registry.path",
+    "registry.value",
+    "registry.data.strings",
+]
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+
+[[rule.threat.technique]]
+id = "T1564"
+name = "Hide Artifacts"
+reference = "https://attack.mitre.org/techniques/T1564/"
+
+[[rule.threat.technique.subtechnique]]
+id = "T1564.004"
+name = "NTFS File Attributes"
+reference = "https://attack.mitre.org/techniques/T1564/004/"
+
+[[rule.threat.technique]]
+id = "T1112"
+name = "Modify Registry"
+reference = "https://attack.mitre.org/techniques/T1112/"
+
+[[rule.threat.technique]]
+id = "T1562"
+name = "Impair Defenses"
+reference = "https://attack.mitre.org/techniques/T1562/"
+
+[[rule.threat.technique.subtechnique]]
+id = "T1562.001"
+name = "Disable or Modify Tools"
+reference = "https://attack.mitre.org/techniques/T1562/001/"
+
+[rule.threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+
+[[rule.threat.technique]]
+id = "T1543"
+name = "Create or Modify System Process"
+reference = "https://attack.mitre.org/techniques/T1543/"
+
+[[rule.threat.technique.subtechnique]]
+id = "T1543.003"
+name = "Windows Service"
+reference = "https://attack.mitre.org/techniques/T1543/003/"
+
+[rule.threat.tactic]
+id = "TA0003"
+name = "Persistence"
+reference = "https://attack.mitre.org/tactics/TA0003/"

From 55f990e6101f46c58c5977b056bbb2cdb707177a Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Fri, 21 Aug 2026 23:47:14 +0100
Subject: [PATCH 11/15] Delete
 rules/windows/exfiltration_dns_excessive_chunked_queries.toml

---
 ...tration_dns_excessive_chunked_queries.toml | 154 ------------------
 1 file changed, 154 deletions(-)
 delete mode 100644 rules/windows/exfiltration_dns_excessive_chunked_queries.toml

diff --git a/rules/windows/exfiltration_dns_excessive_chunked_queries.toml b/rules/windows/exfiltration_dns_excessive_chunked_queries.toml
deleted file mode 100644
index 051933affd8..00000000000
--- a/rules/windows/exfiltration_dns_excessive_chunked_queries.toml
+++ /dev/null
@@ -1,154 +0,0 @@
-[metadata]
-creation_date = "2026/07/03"
-integration = ["endpoint", "windows", "crowdstrike"]
-maturity = "development"
-updated_date = "2026/07/03"
-
-[rule]
-author = ["Elastic"]
-description = """
-Identifies potential DNS exfiltration on Windows hosts by detecting a high volume of DNS queries whose subdomain labels
-follow a chunked encoding pattern (index-payload.base_domain). Attackers split stolen data across many DNS queries to
-evade volume-based detection; this rule aggregates queries per process, base domain, and five-minute window and flags
-sessions with many distinct chunk indices and sufficiently long encoded payloads.
-"""
-from = "now-9m"
-interval = "5m"
-language = "esql"
-license = "Elastic License v2"
-name = "Potential DNS Exfiltration via Excessive Chunked Queries"
-note = """## Triage and analysis
-
-### Investigating Potential DNS Exfiltration via Excessive Chunked Queries
-
-DNS tunneling and exfiltration often encode data in subdomain labels using a chunk index prefix (for example,
-`42-<base64-or-hex-payload>.attacker.example`). A large number of distinct chunk indices to the same base domain from
-one process within a short window strongly suggests staged data transfer rather than normal resolution behavior.
-
-### Possible investigation steps
-
-- Review **Esql.base_domain**, **Esql.unique_chunks**, and **Esql.max_index** on the alert to gauge exfil volume and
-  whether chunk indices form a contiguous or near-contiguous sequence.
-- Identify **process.name** and **process.executable** (from related network events on the same host) and inspect the
-  process tree for scripting runtimes, LOLBins, or unsigned binaries.
-- Pivot on **host.id** for other DNS, network, or exfiltration alerts in the past 48 hours.
-- Inspect sample **dns.question.name** values for the session to confirm encoded payload subdomains and estimate data
-  volume (**Esql.avg_payload_len** × **Esql.unique_chunks**).
-- Check whether the base domain is newly observed, lacks business justification, or resolves to infrastructure outside
-  approved DNS allowlists.
-
-### False positive analysis
-
-- Legitimate software that encodes telemetry or session tokens in DNS labels is rare; validate against known vendor
-  behavior before closing.
-- Security scanners or research tools that generate synthetic chunked DNS labels may match; confirm process identity and
-  organizational ownership.
-
-### Response and remediation
-
-- If confirmed malicious: isolate the host, block the **Esql.base_domain** at DNS and egress controls, and preserve
-  DNS/network logs for scoping.
-- Hunt for the same **Esql.base_domain** and process hash across other hosts and users.
-- Reset credentials and review data accessible to the involved user or process if exfiltration is confirmed.
-"""
-
-setup = """## Setup
-
-This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
-
-Setup instructions: https://ela.st/install-elastic-defend
-
-### Additional data sources
-
-This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
-
-- [CrowdStrike](https://ela.st/crowdstrike-integration)
-- [Sysmon Event ID 22 - DNS Query](https://ela.st/sysmon-event-22-setup)
-"""
-
-references = [
-    "https://attack.mitre.org/techniques/T1048/003/",
-    "https://attack.mitre.org/techniques/T1572/",
-    "https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/",
-]
-risk_score = 47
-rule_id = "882a39ad-a404-45e3-b5d4-bc11d2b09818"
-severity = "medium"
-tags = [
-    "Domain: Endpoint",
-    "OS: Windows",
-    "Use Case: Threat Detection",
-    "Tactic: Exfiltration",
-    "Resources: Investigation Guide",
-    "Data Source: Elastic Defend",
-    "Data Source: Crowdstrike",
-    "Data Source: Sysmon",
-]
-timestamp_override = "event.ingested"
-type = "esql"
-
-query = '''
-FROM logs-crowdstrike.fdr*, logs-endpoint.events.network-*, logs-windows.sysmon_operational-*
-| WHERE host.os.type == "windows"
-    AND event.category == "network"
-    AND event.action IN ("lookup_requested", "DNSEvent (DNS query)", "DnsRequest")
-    AND process.name != "svchost.exe"
-    AND dns.question.name RLIKE """[0-9]{1,5}-[A-Za-z0-9+/=]{15,63}\..+"""
-| GROK dns.question.name "%{INT:chunk_index}-%{DATA:chunk_payload}\\.%{GREEDYDATA:Esql.base_domain}"
-| WHERE chunk_index IS NOT NULL
-| EVAL payload_len = LENGTH(chunk_payload)
-| STATS
-    Esql.occurrences = COUNT(*),
-    Esql.unique_chunks = COUNT_DISTINCT(chunk_index),
-    Esql.max_index = MAX(TO_INTEGER(chunk_index)),
-    Esql.avg_payload_len = AVG(payload_len)
-  BY process.name, Esql.base_domain, user.id, user.name, host.id, host.name, data_stream.namespace, DATE_TRUNC(5 minutes, @timestamp)
-| WHERE Esql.occurrences >= 30
-    AND Esql.unique_chunks >= 30
-    AND Esql.avg_payload_len >= 20
-| SORT Esql.unique_chunks DESC
-| LIMIT 20
-| KEEP host.id, host.name, process.name, user.id, user.name, Esql.base_domain, Esql.*
-'''
-
-[rule.investigation_fields]
-field_names = [
-    "@timestamp",
-    "host.id",
-    "host.name",
-    "user.id",
-    "user.name",
-    "process.name",
-    "dns.question.name",
-]
-
-[[rule.threat]]
-framework = "MITRE ATT&CK"
-
-[[rule.threat.technique]]
-id = "T1048"
-name = "Exfiltration Over Alternative Protocol"
-reference = "https://attack.mitre.org/techniques/T1048/"
-
-[[rule.threat.technique.subtechnique]]
-id = "T1048.003"
-name = "Exfiltration Over Unencrypted Non-C2 Protocol"
-reference = "https://attack.mitre.org/techniques/T1048/003/"
-
-[rule.threat.tactic]
-id = "TA0010"
-name = "Exfiltration"
-reference = "https://attack.mitre.org/tactics/TA0010/"
-
-[[rule.threat]]
-framework = "MITRE ATT&CK"
-
-[[rule.threat.technique]]
-id = "T1572"
-name = "Protocol Tunneling"
-reference = "https://attack.mitre.org/techniques/T1572/"
-
-[rule.threat.tactic]
-id = "TA0011"
-name = "Command and Control"
-reference = "https://attack.mitre.org/tactics/TA0011/"

From 8698d48edf774a89892defbccdeb039149cdb87c Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Fri, 21 Aug 2026 23:48:22 +0100
Subject: [PATCH 12/15] Update command_and_control_dns_tunneling_nslookup.toml

---
 .../windows/command_and_control_dns_tunneling_nslookup.toml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/rules/windows/command_and_control_dns_tunneling_nslookup.toml b/rules/windows/command_and_control_dns_tunneling_nslookup.toml
index f70c3f846aa..e32bf9c6f58 100644
--- a/rules/windows/command_and_control_dns_tunneling_nslookup.toml
+++ b/rules/windows/command_and_control_dns_tunneling_nslookup.toml
@@ -1,8 +1,8 @@
 [metadata]
 creation_date = "2020/11/11"
-integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
+integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
 maturity = "production"
-updated_date = "2026/07/03"
+updated_date = "2026/05/04"
 
 [rule]
 author = ["Elastic"]
@@ -19,7 +19,6 @@ index = [
     "logs-system.security*",
     "logs-windows.forwarded*",
     "logs-windows.sysmon_operational-*",
-    "logs-crowdstrike.fdr*",
     "winlogbeat-*",
 ]
 language = "eql"
@@ -93,7 +92,6 @@ tags = [
     "Data Source: Microsoft Defender XDR",
     "Data Source: SentinelOne",
     "Data Source: Sysmon",
-    "Data Source: Crowdstrike",
 ]
 type = "eql"
 

From 77e454a2dd698df5f280b636a1380c34a87a96b1 Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Fri, 21 Aug 2026 23:48:42 +0100
Subject: [PATCH 13/15] Update command_and_control_dns_tunneling_nslookup.toml

---
 rules/windows/command_and_control_dns_tunneling_nslookup.toml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/rules/windows/command_and_control_dns_tunneling_nslookup.toml b/rules/windows/command_and_control_dns_tunneling_nslookup.toml
index e32bf9c6f58..3d3ef7149db 100644
--- a/rules/windows/command_and_control_dns_tunneling_nslookup.toml
+++ b/rules/windows/command_and_control_dns_tunneling_nslookup.toml
@@ -73,7 +73,6 @@ This rule also supports the following third-party data sources. For setup instru
 - [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
 - [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
 - [Windows Process Creation Logs](https://ela.st/audit-process-creation)
-- [CrowdStrike](https://ela.st/crowdstrike-integration)
 """
 
 references = ["https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/"]

From c50e22852fac771a53b180d467ec30c2291466bb Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Sat, 22 Aug 2026 00:47:13 +0100
Subject: [PATCH 14/15] Update defense_evasion_boot_time_removal_tool.toml

---
 rules/windows/defense_evasion_boot_time_removal_tool.toml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rules/windows/defense_evasion_boot_time_removal_tool.toml b/rules/windows/defense_evasion_boot_time_removal_tool.toml
index 9dfdd2b3b8f..24e60278c77 100644
--- a/rules/windows/defense_evasion_boot_time_removal_tool.toml
+++ b/rules/windows/defense_evasion_boot_time_removal_tool.toml
@@ -98,7 +98,8 @@ from logs-endpoint.events.file-*, logs-endpoint.events.registry-* metadata _id,
   and not (
     user.id == "S-1-5-18"
     and to_lower(process.executable) like """?:\\windows\\system32\\mrt.exe"""
-    and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation")
+    and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation") 
+    and process.code_signature.trusted == true
   )
   and (
     (

From 464821fc2b26d94e20cecd5f77d53571aa911ac4 Mon Sep 17 00:00:00 2001
From: Samirbous <64742097+Samirbous@users.noreply.github.com>
Date: Wed, 26 Aug 2026 14:41:47 +0100
Subject: [PATCH 15/15] Update
 rules/windows/defense_evasion_boot_time_removal_tool.toml

Co-authored-by: Bryan Porras <bryan.porras@elastic.co>
---
 rules/windows/defense_evasion_boot_time_removal_tool.toml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/rules/windows/defense_evasion_boot_time_removal_tool.toml b/rules/windows/defense_evasion_boot_time_removal_tool.toml
index 24e60278c77..49141efc295 100644
--- a/rules/windows/defense_evasion_boot_time_removal_tool.toml
+++ b/rules/windows/defense_evasion_boot_time_removal_tool.toml
@@ -7,9 +7,9 @@ updated_date = "2026/08/21"
 [rule]
 author = ["Elastic"]
 description = """
-Identifies creation of a `:changelist` NTFS alternate data stream or a Windows service Args registry value pointing to
-a `:changelist` path. Microsoft Defender's Boot-Time Removal (BTR.sys) driver reads an RC4-encrypted transaction blob
-from a driver ADS named `:changelist`, referenced by HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Args. Adversaries can
+Identifies creation of a ":changelist" NTFS alternate data stream or a Windows service Args registry value pointing to
+a ":changelist" path. Microsoft Defender's Boot-Time Removal (BTR.sys) driver reads an RC4-encrypted transaction blob
+from a driver ADS named ":changelist", referenced by HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Args. Adversaries can
 reproduce this staging outside Defender to abuse BTR.sys as a signed kernel primitive for arbitrary file and registry
 operations. This rule focuses on non-System writers and excludes Microsoft-signed MRT.exe running as SYSTEM, which may
 perform related remediation staging.