[Rule Tuning] Merge and Delete duplicate rules for Registration Utilities (#1028)

* [Rule Tuning] Merge and Delete duplicate rules for Registration Utilities

* Update rules/windows/execution_register_server_program_connecting_to_the_internet.toml

Co-authored-by: Justin Ibarra <[email protected]>

* restored Execution via Regsvcs/Regasm

* restored changes

* deprecated 1rule, deleted 1 and tuned 1

Co-authored-by: Justin Ibarra <[email protected]>

Author: Samirbous

rules/windows/execution_via_net_com_assemblies.toml renamed to rules/_deprecated/execution_via_net_com_assemblies.toml

@@ -1,7 +1,8 @@
 [metadata]
 creation_date = "2020/03/25"
-maturity = "production"
-updated_date = "2021/03/03"
+deprecation_date = "2021/03/17"
+maturity = "deprecated"
+updated_date = "2021/03/17"
 
 [rule]
 author = ["Elastic"]

rules/windows/defense_evasion_reg_beacon.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/02/18"
 maturity = "production"
-updated_date = "2021/03/03"
+updated_date = "2021/03/17"
 
 [rule]
 author = ["Elastic"]
@@ -28,12 +28,15 @@ type = "eql"
 
 query = '''
 sequence by process.entity_id
-  [process where (process.name : "regsvr32.exe" or process.name : "regsvr64.exe" or
-                  process.name : "RegAsm.exe" or process.name : "RegSvcs.exe") and
-     event.type == "start"]
-  [network where (process.name : "regsvr32.exe" or process.name : "regsvr64.exe" or
-                  process.name : "RegAsm.exe" or process.name : "RegSvcs.exe") and
-     not cidrmatch(destination.ip, "10.0.0.0/8", "169.254.169.254", "172.16.0.0/12", "192.168.0.0/16")]
+  [process where event.type == "start" and
+   process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe") and
+   not (
+         user.id == "S-1-5-18" and
+         (process.parent.name : "msiexec.exe" or process.parent.executable : ("C:\\Program Files (x86)\\*.exe", "C:\\Program Files\\*.exe"))
+       )
+   ]
+  [network where process.name : ("regsvr32.exe", "RegAsm.exe", "RegSvcs.exe")  and
+   not cidrmatch(destination.ip, "10.0.0.0/8", "169.254.169.254", "172.16.0.0/12", "192.168.0.0/16") and network.protocol != "dns"]
 '''
 
 
@@ -61,4 +64,3 @@ reference = "https://attack.mitre.org/techniques/T1218/010/"
 id = "TA0005"
 name = "Defense Evasion"
 reference = "https://attack.mitre.org/tactics/TA0005/"
-