[Testing] Unusual Parent-Child Relationship

[Mikaayenson]

Trigger context

Field	Value
Rule	Unusual Parent-Child Relationship
Rule ID	35df0dd8-092d-4a83-88c1-5151a804f31b
Rule type	eql

---

Elastic Workflow — SIEM Rule Tuning PR (genai-tradecraft)

---

Summary

This tuning reduces false positive alerts for the Unusual Parent-Child Relationship rule by expanding parent process allowlists for known benign Windows system process behaviors observed broadly across production telemetry.

Classification

Category	Pattern	30-day Alerts	Clusters	Assessment
Self-spawning system processes	WmiPrvSE.exe ← WmiPrvSE.exe	~31K	82	FP — WMI provider host legitimate restart
Self-spawning system processes	dllhost.exe ← dllhost.exe	~2.8K	105	FP — COM surrogate legitimate restart
Self-spawning system processes	spoolsv.exe ← spoolsv.exe	~2.5K	142	FP — Print spooler service restart
Self-spawning system processes	taskhostw.exe ← taskhostw.exe	~3.9K	53	FP — Task host worker restart
Self-spawning system processes	SearchProtocolHost.exe, SearchIndexer.exe, LogonUI.exe, RuntimeBroker.exe, TiWorker.exe, consent.exe, wsmprovhost.exe	~4.5K combined	41–85 each	FP — legitimate Windows service restarts
Console host children	conhost.exe → powershell.exe / cmd.exe	~66K	33–57	FP — legitimate console host parent-child relationship across Elastic Defend, CrowdStrike, M365 Defender, Sysmon, and Windows Security data sources
Endpoint management	svchost.exe ← rpcnet.exe / rpcnetp.exe	~15.7K	17	FP — Absolute Software Computrace/Persistence agent
Kernel boot	smss.exe ← ntoskrnl.exe	~314	9	FP — legitimate Windows kernel spawning Session Manager

Query Modifications

Suspicious parent processes — self-spawning allowlists

Added the process's own name to the parent allowlist for the following system processes, as Windows legitimately restarts these services and the self-spawning pattern is observed broadly across 40–142 clusters:

• consent.exe, RuntimeBroker.exe, TiWorker.exe — added self-names to parent allowlist
• SearchIndexer.exe — added SearchIndexer.exe to parent allowlist
• SearchProtocolHost.exe — added SearchProtocolHost.exe to parent allowlist
• dllhost.exe — added dllhost.exe to parent allowlist
• spoolsv.exe — added spoolsv.exe to parent allowlist
• taskhostw.exe — added taskhostw.exe to parent allowlist
• LogonUI.exe — added LogonUI.exe to parent allowlist
• wmiprvse.exe, wsmprovhost.exe — added self-names to parent allowlist

Note: lsass.exe self-spawning was intentionally not excluded (19 clusters) as it may indicate credential dumping or process hollowing.

Suspicious parent processes — additional legitimate parents

• svchost.exe — added rpcnet.exe and rpcnetp.exe (Absolute Software Computrace endpoint management agent, 17 clusters)
• smss.exe — added ntoskrnl.exe (legitimate Windows kernel boot process, 9 clusters)

Suspicious child processes — conhost.exe children

• Added powershell.exe and cmd.exe to the conhost.exe child exclusion list. The Console Window Host (conhost.exe) legitimately appears as a parent of command-line interpreters across all major data sources (Elastic Defend, CrowdStrike, M365 Defender, Sysmon, Windows Security Event Logs) and 57+ clusters.

Simulation

Metric	Baseline	After Tuning	Change
Alerts (30-day, v≥319)	133,962	9,419	−93.0%
Clusters	447	256	−42.7%
Agents	4,713	818	−82.6%

Detection Gap Risk: Low

• All excluded patterns are well-documented benign Windows system behaviors
• Self-spawning exclusions require exact process name match (attacker would need to spoof both process and parent name identically)
• conhost.exe → powershell.exe/cmd.exe abuse is covered by other detection rules targeting PowerShell and command-line interpreter misuse
• lsass.exe self-spawning intentionally preserved as a detection surface
• Rule retains coverage across 256 clusters after tuning

Verification

Baseline query:

kibana.alert.rule.name:"Unusual Parent-Child Relationship" AND kibana.alert.rule.version >= 319

Excluded patterns query:

kibana.alert.rule.name:"Unusual Parent-Child Relationship" AND kibana.alert.rule.version >= 319 AND ((process.name:process.parent.name AND process.name:("WmiPrvSE.exe" OR "dllhost.exe" OR "spoolsv.exe" OR "taskhostw.exe" OR "SearchProtocolHost.exe" OR "LogonUI.exe" OR "SearchIndexer.exe" OR "RuntimeBroker.exe" OR "TiWorker.exe" OR "consent.exe" OR "wsmprovhost.exe")) OR (process.parent.name:"conhost.exe" AND process.name:("powershell.exe" OR "cmd.exe")) OR (process.name:"svchost.exe" AND process.parent.name:("rpcnet.exe" OR "rpcnetp.exe")) OR (process.name:"smss.exe" AND process.parent.name:"ntoskrnl.exe"))

[github-actions]

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

• Detailed description of the suggested changes.
• Provide example JSON data or screenshots.
• Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
• Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
• Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
• Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
• Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
• Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
• Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
• Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
• Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
• Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

• updated_date matches the date of tuning PR merged.
• min_stack_version should support the widest stack versions.
• name and description should be descriptive and not include typos.
• query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

• Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
• Ensure that the tuned rule has a low false positive rate.

[tradebot-elastic]

⛔️ Test failed

Results

• ❌ Unusual Parent-Child Relationship (eql)
  • stack_validation_failed: no_alerts - 0 alerts

[Copilot]

Pull request overview

This PR tunes the existing Unusual Parent-Child Relationship Windows EQL rule to reduce false positives by expanding “benign parent” allowlists for several common system-process relationships and adding additional benign conhost.exe child processes.

Changes:

• Expanded suspicious-parent allowlists to include additional legitimate parents (including self-spawning behaviors) for multiple Windows system processes.
• Added additional benign conhost.exe children (powershell.exe, cmd.exe) to reduce noise.
• Added additional benign parent processes for svchost.exe and smss.exe in observed enterprise scenarios.

[Mikaayenson]

Testing. closing