[Rule Tuning] Potential Machine Account Relay Attack via SMB (d84a11c0-eb12-4e7d-8a0a-718e38351e29)

## Rule Tuning Analysis

**Rule ID:** `d84a11c0-eb12-4e7d-8a0a-718e38351e29`
**Rule Name:** Potential Machine Account Relay Attack via SMB
**Rule Type:** eql

---

### Classification

| Metric | Value |
|--------|-------|
| **Category** | NOISY_PERFORMANT |
| **Priority** | MEDIUM |
| **Tuning Score** | 60.81 |
| **Version Status** | ✅ Established (6 release cycles) |

---

### Alert Telemetry

| Metric | Value |
|--------|-------|
| Total Alerts (3d) | 21,413 |
| Unique Clusters | 2 |
| Cluster Coverage | 0.1% |
| Daily Average | 10706 |
| Days Active | 3 |
| Coefficient of Variation | 0.46 (MODERATE) |

---

### Analysis Flags

- 🔴 Noisy on Latest Version: ✅ Yes
- 🔴 Widespread False Positive: ❌ No
- ⚠️ Version Regression: ❌ No
- ⚠️ Stale and Noisy: ❌ No
- ⚠️ Low Version / High Volume: ❌ No
- ℹ️ Low Activity: ❌ No

---

### Recommendation

**Action:** Add an EQL exclusion for the observed benign SYSVOL root and policy-audit file reads, and only move to an IPC$/ADMIN$-focused version if the conservative exclusion does not reduce the alert storm enough.

**Rationale:** This EQL rule is currently too broad for domain-controller-heavy environments: all 4 sample alerts from the 2 noisy clusters are benign-looking SYSVOL accesses (`\\*\SYSVOL`) performed with the target server's own machine account, with `RelativeTargetName` limited to the SYSVOL root (`\`) or policy `...\Microsoft\Windows NT\Audit\audit.csv` reads. That pattern is consistent with normal SYSVOL/GPO activity rather than high-signal SMB relay behavior. The best first fix is a conservative EQL exclusion for the observed SYSVOL read patterns; if noise remains, a second-stage change can narrow the rule to relay-relevant shares such as `IPC$`/`ADMIN$` after testing.

#### Query Modifications

**The query matches benign SYSVOL machine-account activity because it has no share/path exclusion for routine domain-controller policy reads.** *(Impact: both)*

**Current:**
```sql
file where host.os.type == "windows" and event.code == "5145" and endswith(user.name, "$") and
startswith~(concat(winlog.computer_name, "."), concat(substring(user.name, 0, -1), ".")) and
not endswith(string(source.ip), string(host.ip)) and
source.ip != "::" and source.ip != null and source.ip != "::1" and source.ip != "127.0.0.1"
```

**Modify →**
```sql
file where host.os.type == "windows" and event.code == "5145" and endswith(user.name, "$") and
not (
winlog.event_data.ShareName == "\\*\SYSVOL" and
(
winlog.event_data.RelativeTargetName == "\\" or
endswith~(winlog.event_data.RelativeTargetName, "\\Microsoft\\Windows NT\\Audit\\audit.csv")
)
) and
startswith~(concat(winlog.computer_name, "."), concat(substring(user.name, 0, -1), ".")) and
not endswith(string(source.ip), string(host.ip)) and
source.ip != "::" and source.ip != null and source.ip != "::1" and source.ip != "127.0.0.1"
```

> This is the most conservative copy-paste change supported by the evidence. Every provided sample is a SYSVOL read, with `RelativeTargetName` either `\` or an `audit.csv` path. Adding this exclusion should remove the observed false positives while preserving detection of machine-account access to other shares.

**If SYSVOL noise remains high, the rule still lacks positive focus on relay-relevant shares and will continue to alert on lower-signal file-share activity.** *(Impact: both)*

**Current:**
```sql
No share restriction beyond `event.code == "5145"`.
```

**Modify →**
```sql
file where host.os.type == "windows" and event.code == "5145" and endswith(user.name, "$") and
startswith~(concat(winlog.computer_name, "."), concat(substring(user.name, 0, -1), ".")) and
not endswith(string(source.ip), string(host.ip)) and
source.ip != "::" and source.ip != null and source.ip != "::1" and source.ip != "127.0.0.1" and
winlog.event_data.ShareName in ("\\*\IPC$", "\\*\ADMIN$")
```

> This is a stronger, higher-risk alternative that aligns the rule more closely with common SMB relay follow-on activity on admin shares. It is not as conservative as the SYSVOL exclusion, so it should only be used after testing against historical true positives and expected relay simulations.

#### Exception Recommendations

**Add exception:** `winlog.event_data.ShareName` is `"\\*\SYSVOL"` *(Confidence: HIGH)*

> All 4 sample alerts across both noisy clusters used `winlog.event_data.ShareName = \\*\SYSVOL`. This is the strongest common benign indicator in the evidence. If implemented as an exception instead of a query change, do not exclude `SYSVOL` alone; combine it with the observed relative target patterns (`\` or `*\Microsoft\Windows NT\Audit\audit.csv`) to avoid a broad detection gap.

**Modify →**
```sql
and winlog.event_data.ShareName is "\\*\SYSVOL"
```

**Add exception:** `winlog.event_data.RelativeTargetName` is `"\"` *(Confidence: MEDIUM)*

> Events 1 and 2 show the target machine account accessing only the SYSVOL root (`RelativeTargetName = "\\"`) on `\\*\SYSVOL`, which is typical of benign share enumeration or policy access. Use this only in combination with `winlog.event_data.ShareName == "\\\\*\\SYSVOL"` rather than as a standalone exception.

**Modify →**
```sql
and winlog.event_data.RelativeTargetName is "\"
```

**Add exception:** `winlog.event_data.RelativeTargetName` wildcard `"*\Microsoft\Windows NT\Audit\audit.csv"` *(Confidence: HIGH)*

> Events 3 and 4 repeatedly accessed `...\Policies\...\Microsoft\Windows NT\Audit\audit.csv` under SYSVOL, which is consistent with normal Group Policy/audit policy reads. This is a precise, evidence-backed exclusion candidate, but it should still be paired with `ShareName == \\*\SYSVOL` for safety.

**Modify →**
```sql
and winlog.event_data.RelativeTargetName wildcard "*\Microsoft\Windows NT\Audit\audit.csv"
```

#### Field-Level Recommendations

| Field | Value | Alert % | Cluster % | Confidence | Type |
|-------|-------|---------|-----------|------------|------|
| `winlog.event_data.ShareName` | `\\*\SYSVOL` | 0.0% | 100.0% | HIGH | EXCEPTION |
| `winlog.event_data.RelativeTargetName` | `\` | 0.0% | 50.0% | MEDIUM | EXCEPTION |
| `winlog.event_data.RelativeTargetName` | `*\Microsoft\Windows NT\Audit\a...` | 0.0% | 50.0% | HIGH | EXCEPTION |

---

*This issue was generated by the GenAI Tradecraft Rule Tuning Advisor.*
*Analysis timestamp: 2026-07-29T06:59:05.044120*