Creating alert when event didn't occur

Elastic Security
1

Hey,
For past few days I have been trying to create a rule that will trigger when something doesn't happen. So let's say we have two executables, malware.exe and antivirus.exe. I want to write a rule that would trigger an alert when malware.exe process is run and, within next hour, antivirus.exe is not run. I thought of many ways of doing it but no luck. Anyone got an idea how this can be achieved?

Cheers!

2

It's not perfect, but the closest thing that comes to mind for me is EQL until (docs).

Basically it works like this:

sequence
  [ < A: the first thing that must happen > ]
  [ < C: the third thing that must happen > ]
until
  [ < B: the second thing that should not happen > ]

Basically how it works, is that it looks for A followed by C, and if B happens in between then the sequence is invalid and will not generate an alert. I'm not totally sure if this fits well with your use case, but it might be worth a shot.

One way we've used it before is like this, to watch out for pid reuse. This example query stops tracking when a termination is seen, that way it won't match across a reused process ID.

sequence by process.pid
  [ process where < creation > ]
  [ network where < connect > ]
until
  [ process where <termination> ]

There might options at your disposal, and this is just what I'm most familiar with. Hope this is a start!

3

Your sequence might look something like

sequence with maxspan=1h
  [ process where process.name : "malware.exe" ] 
  [ < unsure what goes here, if you have something that reliably kicks off after? > ]
until
  [ process where process.name : "antivirus.exe" ]
4

Hey Ross, thanks for reply! :slight_smile:
I tried it this way. We kinda need something like not until.
Basically, if A is followed by a C and B doesn't happen I want to generate an alert. The problem is that B event is not present.
I'm trying to generate an alert for malware.exe after which antivirus.exe process didn't start.

5

I think until is still what you want.

sequence
  [ A ]
  [ C ]
until
  [ B ]

If B does exist between A and C then you don't get an alert for [A, C].
If B does not exist between A and C then you do get an alert for [A, C].

I'm just not sure what your C is.

6

Yup it's a good way I see it now, but, still not really working, I don't have any C sadly.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.