[Rule Tuning] SMB Connections via LOLBin or Untrusted Process

[Mikaayenson]

Link to Rule

https://github.com/elastic/detection-rules/blob/main/rules/windows/lateral_movement_direct_outbound_smb_connection.toml

Rule Tuning Type

Performance - Optimizing resource consumption and execution time of detection rules.

Description

• The sequence uses event.type == "start" until event.type == "end". We should tune this rule to address event aggregation issues where event.type for both will be aggregated within the same event if they fire within 5 seconds causing the sequence to potentially NOP.
• Related to https://github.com/elastic/ia-trade-team/issues/368

Example Data

No response

cc. @nicholasberlin