After signing to HXTool, you can access the Streaming Rules using RULES > MANAGE STREAMING RULES from the main menu. The concept of Rules within HXTool maps directly to the concept of Indicator in the context of IOC Streaming.
After you have been navigated to the Streaming Rules, you are presented with a screen. The details within your main grid may be different; however, the structure is similar. From this view you can perform the following actions:
.png)
Search for specific rules
View the conditions attached to a rule
Edit a rule
Delete a rule
Copy a rule into a new rule
Create a new rule from scratch
Enable or Disable a rule
Export all the rules in the grid to file or clipboard
Export / Import rules
Note
The concept of Rules within HXTool maps directly to the concept of Indicator in the context of IOC Streaming.
.jpg) |
The Rule Grid
The center of the Streaming Rules view is occupied by the Rule Grid. Each row within this grid reveals several properties:
Name | The name assigned to the rule |
Description | The description for the rule. |
Platforms | The platforms targeted by the rule (win / osx / linux / all). |
Category | The category that the rule belongs to. A FireEye category indicates that the rule is a pre-configured rule shipped with the module. Custom indicates that the rule was created by you or someone within your organization. |
Last Updated | The timestamp that the rule was last modified. |
Updated by | The identity of the user who last modified the rule. |
Enabled | Indicates if the rule is currently enabled in your system. |
Action | Activities that you can perform on the rule. |
Searching Specific Rules
To filter the rules that are displayed within the grid, enter text in the Search field located at the upper-right corner of the grid. Rules that have the text entered are displayed and those that do not have the text remains hidden. For example, If you enter Win in the Search field, the rules that contain the text somewhere in their properties are displayed. The topmost rule has Win as a substring within its name property. The others have Win as the name of their target platform.
Viewing Conditions Attached to a Rule
For any rule, you can quickly view the conditions attached to the rule by clicking the VIEW action in the row for that rule. A list appears revealing the conditions attached to the rule. Each condition lists the tests that make up that condition. Each test presents the properties that the test composes. In the figure, the rule contains one condition that is made up of three tests. These three tests should hold true for the condition to be matched and streamed. Specifically, for a particular processEvent to match, all three tests upon that process event instance must be true.
.jpg) |
Editing a Rule
For any rule that is not a FireEye category rule, you can modify its properties by clicking the EDIT action in the row for that rule. A new view appears presenting all the details of the rule. You can modify the properties and submit your updates. Your updates is picked up by the IOC Streaming module. Refer to Creating a New Rule from Scratch for details of this view.
Deleting a Rule
Click REMOVE to delete any rule that is not a FireEye category rule. This action shall disable and flag the rule for deletion. This change is picked up by the IOC Streaming module.
Creating a New Rule from an Existing Rule
To create a copy of a rule as the starting point for a new rule, Click the CLONE action in the row for the rule to copy. A new view appears presenting all the details of the rule being copied. To avoid confusion, you should modify the Rule name of this copy to keep it distinct from the rule it was copied from. You can then adjust any of the properties of the new rule as you require and submit your updates when they are complete. Your updates is picked up by the IOC Streaming module.
.jpg) |
Creating a New Rule from Scratch
To create a new rule, click the CREATE NEW RULE action located in the upper- left corner of the grid. A new view appears with which you can provide all the details for the new rule. After entering your details, submit the rule to be saved. Your new rule is picked up by the IOC Streaming module.
The lower section of this view is dedicated to the definition of the conditions to attach to the rule. For each condition you specify the test(s) to apply to an event, all of which must be true for the match to occur. For a rule with multiple conditions, any of the conditions can be true for a match to occur.
The rule will match when:
An instance of an ImageLoadEvent has the Process attribute equal to pwsh.exe (case sensitive), AND that same event has a Filename attribute that contains system.directoryservices.dll (case sensitive)
OR
An instance of an ImageLoadEvent has the Process attribute equal to powershell.exe (case sensitive), AND that same event has a Filename attribute that contains system.directoryservices.dll (case sensitive)
When working with conditions you can:
Add a new condition by clicking the ADD CONDITION + action at the bottom of the view
Remove a condition (and all its tests) by clicking the REMOVE action in the top row of the condition When working with the tests within a condition you can
Add a new test by clicking the + action to the right of the Matching Value entry field
Remove a test by clicking the REMOVE action in the row of the test to remove
Note
If you do not SUBMIT your updates, they will not be saved.
Enabling or Disabling a Rule
For any rule, you can modify its enabled state by clicking the checkbox .jpg)
in the row for that rule. When a rule is disabled, it is not included in the rule set that an endpoint will use to match to events. Disabling a rule does not delete it, it just omits it from being used. You can find this useful when attempting to isolate detection behaviors, or when you are composing new rules that are not ready to be used. When you modify the enabled state of a rule, this change is picked up by the IOC Streaming module.
Exporting the Rules from the Grid
The upper-right corner of the grid contains several actions to export the contents of the grid.
Name The name assigned to the rule.
Copy Use this action to copy the contents of the grid to the clipboard. Doing so makes the contents available to paste into a target destination.
CSV Use this action to export the contents of the grid to a comma-separated-value text file.
Excel Use this action to export the contents of the grid to a Microsoft Excel compatible file.
Exporting / Importing Rules
You can export rules into a form that can be subsequently imported.
For any rule that is not a FireEye category, click the leftmost column of that rule to mark the rule for export. A checkbox appears indicating the rule is selected. You can select more than one rule for export. Once you select all the rules, click the EXPORT SELECTED action to export those rules to a file. The format of this file is one that can be subsequently imported.
To import rules from a file, click the IMPORT action.