Endpoint Detection Rules
Develop endpoint detection rules based on CrowdStrike and Microsoft Defender concepts.
Project objective
Translate the kind of detection logic CrowdStrike Falcon and Microsoft Defender for Endpoint ship out of the box — suspicious child-process relationships, living-off-the-land binary (LOLBin) abuse, credential-access tooling — into a working custom rule on a lab endpoint instrumented with Sysmon and Wazuh, and prove it fires on the intended behavior.
Core work
The target behavior for this rule: certutil.exe being used to download and decode a remote file, a well-known LOLBin technique for delivering payloads while evading naive allow/deny-list detection.
# 1. Install Sysmon with a community-maintained detection-oriented config
sysmon64.exe -accepteula -i sysmonconfig-export.xml
# 2. Ship the Sysmon Operational channel to the Wazuh manager
<localfile>
<location>Microsoft-Windows-Sysmon/Operational</location>
<log_format>eventchannel</log_format>
</localfile>
# 3. Custom rule: certutil invoked with download/decode flags (Sysmon Event ID 1)
<rule id="100020" level="12">
<if_group>sysmon_event1</if_group>
<field name="win.eventdata.image" type="pcre2">(?i)certutil\.exe</field>
<field name="win.eventdata.commandLine" type="pcre2">(?i)urlcache|-decode</field>
<description>Possible LOLBin abuse: certutil used to download/decode a file</description>
<mitre><id>T1105</id></mitre>
</rule>
# 4. Simulate the behavior in the lab to trigger and confirm the rule
certutil.exe -urlcache -split -f http://127.0.0.1:8000/test.txt test.txt
# 5. Confirm the alert fired
sudo tail -f /var/ossec/logs/alerts/alerts.json | jq 'select(.rule.id=="100020")'The same pattern was repeated for two more behaviors: an Office process (winword.exe) spawning powershell.exe as a child process, and a process reading from lsass.exe memory outside of Task Manager/known EDR agents — both mapped to their respective MITRE ATT&CK techniques and validated the same way, with a benign local simulation rather than live malware.
Test detections fired per MITRE ATT&CK tactic during rule validation — Defense Evasion (LOLBin abuse) was the primary focus of this iteration.
What to document
Each rule is documented with the exact behavior it targets, the Sysmon event ID and fields it keys on, the simulation command used to trigger it safely, the resulting alert, and a short false-positive note (e.g., legitimate IT scripts that also use certutil, and how to scope the rule to reduce noise in a real environment).