[Rule Tuning] Access to a Sensitive LDAP Attribute (764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66)

## Rule Tuning Analysis

**Rule ID:** `764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66`
**Rule Name:** Access to a Sensitive LDAP Attribute
**Rule Type:** eql

---

### Classification

| Metric | Value |
|--------|-------|
| **Category** | NOISY_PERFORMANT |
| **Priority** | MEDIUM |
| **Tuning Score** | 46.45 |
| **Version Status** | ✅ Established (5 release cycles) |

---

### Alert Telemetry

| Metric | Value |
|--------|-------|
| Total Alerts (3d) | 34,995 |
| Unique Clusters | 6 |
| Cluster Coverage | 0.2% |
| Daily Average | 11665 |
| Days Active | 3 |
| Coefficient of Variation | 0.41 (MODERATE) |

---

### Analysis Flags

- 🔴 Noisy on Latest Version: ✅ Yes
- 🔴 Widespread False Positive: ❌ No
- ⚠️ Version Regression: ❌ No
- ⚠️ Stale and Noisy: ❌ No
- ⚠️ Low Version / High Volume: ❌ No
- ℹ️ Low Activity: ❌ No

---

### Recommendation

**Action:** Add EQL exclusions for the two observed benign read-only service/computer account SIDs, scoped to `winlog.event_data.AccessMask == "0x10"` so write-property activity remains detected.

**Rationale:** This rule is producing high local noise (34,995 alerts in 3 days) from repeated Windows 4662 directory access events, but the evidence points to environment-specific benign activity rather than a universal rule flaw. In the samples, 4 of 5 alerts are successful `Read Property` (`AccessMask 0x10`) operations by recurring machine/service accounts (`VM-CONDK-APP-02$` and `SM-COHESITY$`), which is consistent with legitimate application or backup/compliance access on domain controllers; the single `Write Property` (`0x20`) event by user `bhull` is materially higher risk and should remain in scope. The safest tuning is to add targeted exclusions for the repeated read-only service/computer account SIDs and, after testing, optionally narrow the AccessMask clause to the property read/write values actually observed.

#### Query Modifications

**The rule does not suppress repeated benign read-only access from known service/computer accounts, so high-volume operational activity generates alerts continuously.** *(Impact: accuracy)*

**Current:**
```sql
not winlog.event_data.SubjectUserSid : "S-1-5-18"
```

**Modify →**
```sql
and not (
winlog.event_data.AccessMask == "0x10" and
winlog.event_data.SubjectUserSid in (
"S-1-5-21-3056016517-1137718658-1326997561-96241",
"S-1-5-21-3198440210-2264107108-2586541909-101813"
)
)
```

> This preserves detection for human accounts and higher-risk write activity while removing the two repeated benign patterns observed in 4 of the 5 provided sample events.

**The AccessMask filter is broad and allows unrelated 4662 variants to reach the expensive wildcard match on `winlog.event_data.Properties`.** *(Impact: both)*

**Current:**
```sql
not winlog.event_data.AccessMask in ("0x0", "0x100")
```

**Modify →**
```sql
winlog.event_data.AccessMask in ("0x10", "0x20")
```

> All supplied matched events use `0x10` (Read Property) or `0x20` (Write Property). Restricting to those values better aligns the rule with sensitive attribute access, can reduce noise from other 4662 permutations, and may slightly improve performance by shrinking the candidate event set before evaluating the wildcard GUID matches. Test first in case your environment logs combined mask values that also need to remain in scope.

#### Exception Recommendations

**Add exception:** `winlog.event_data.SubjectUserSid` is `"S-1-5-21-3056016517-1137718658-1326997561-96241"` *(Confidence: MEDIUM)*

> Events 1 and 2 show the same machine account `VM-CONDK-APP-02$` on host `sv-dc1r1-dl-ad1.tra.go.tz` repeatedly generating successful 4662 `Read Property` alerts with `AccessMask 0x10` and a matched sensitive GUID (`{612cb747-c0e8-4f92-9221-fdd5f15b550d}` / unixUserPassword). This is a duplicated, read-only service/computer-account pattern and is a strong false-positive candidate for this environment. Safer insertion guidance for the EQL query: `and not (winlog.event_data.AccessMask == "0x10" and winlog.event_data.SubjectUserSid == "S-1-5-21-3056016517-1137718658-1326997561-96241")`.

**Modify →**
```sql
and winlog.event_data.SubjectUserSid is "S-1-5-21-3056016517-1137718658-1326997561-96241"
```

**Add exception:** `winlog.event_data.SubjectUserSid` is `"S-1-5-21-3198440210-2264107108-2586541909-101813"` *(Confidence: MEDIUM)*

> Events 3 and 4 show repeated successful 4662 `Read Property` alerts from `SM-COHESITY$` on `sm-ad8.roblox.local`, again with `AccessMask 0x10`. The account name strongly suggests Cohesity backup/compliance activity, and the repeated matched events indicate a benign operational scanner rather than interactive abuse. Safer insertion guidance for the EQL query: `and not (winlog.event_data.AccessMask == "0x10" and winlog.event_data.SubjectUserSid == "S-1-5-21-3198440210-2264107108-2586541909-101813")`.

**Modify →**
```sql
and winlog.event_data.SubjectUserSid is "S-1-5-21-3198440210-2264107108-2586541909-101813"
```

#### Field-Level Recommendations

| Field | Value | Alert % | Cluster % | Confidence | Type |
|-------|-------|---------|-----------|------------|------|
| `winlog.event_data.SubjectUserSid` | `S-1-5-21-3056016517-1137718658...` | 0.0% | 16.7% | MEDIUM | EXCEPTION |
| `winlog.event_data.SubjectUserSid` | `S-1-5-21-3198440210-2264107108...` | 0.0% | 16.7% | MEDIUM | EXCEPTION |

---

*This issue was generated by the GenAI Tradecraft Rule Tuning Advisor.*
*Analysis timestamp: 2026-07-25T06:51:10.356582*