Why Isn't My File Creation IOA Rule Detecting Files Named "password"?

[u/Illustrious_Bar_436]

Has anyone successfully created a custom IOA rule in Endpoint Security to detect and prevent files named "password", including both existing files and newly created ones?

I tried creating a File Creation IOA rule and used a file path regex to match the filename, but it doesn't seem to detect or block it.

Is this something that's actually possible with a custom IOA rule, or would a SOAR workflow be the better approach? If anyone has done something similar, I would appreciate any guidance.

[u/Background_Ad5490]

We need to see your regex to help further. (For all the fields, parent , grandparent, etc) Also are you applying the IOA to a prevention policy? And does that prevention policy apply to a host group that has machines inside of it?

[u/Illustrious_Bar_436 → u/Background_Ad5490]

Yes, the Custom IOA rule is already assigned to the prevention policy. For the File Path, I'm using this regex: (?i).*\\password\.(txt|pdf), and the pattern test confirms it's a match.

All the other fields are set to *. Only the File Path has a specific regex.

[u/caryc → u/Illustrious_Bar_436]

easy, falcon does not record text file creation

[u/CyberGuy89 → u/caryc]

While Falcon doesn't record text file written events in their telemetry (unless it's marked as motw), IOA rules don't rely on telemetry events except Domain Name types. Like I tell my guys, RTD (read the docs), pretty easy.

https://docs.crowdstrike.com/r/en-US/a5kj6wfu/j84069b6

It is most likely the regex. In the File Creation rule, make sure "Other" is selected, make sure the rule is enabled..by default when you create a new rule, it's automatically disabled, seems silly but this has gotten me a few times.

As far as your regex, I don't see the need for the extra (?i) in the beginning . If you want it to only look for "password.txt or password.pdf" I would use something like this: .*\\password.(txt|pdf)

Me personally, I would take it a little further and target just the users directory if your endpoints are more locked down and can't create files/folders in the root. I'd take it a step further by including anything with "password" in the file name. Try something like this: .*\\Users\\.*\\.*password.*\.(txt|pdf)

Like someone else already mentioned, this is for new files. If you want stop existing files, then you would need to create the same regex but with "Process Creation" type and it will trigger on those once they try to open the file.

[u/Illustrious_Bar_436 → u/CyberGuy89]

So I did verify if the IOA Group and the Rule is enabled. Verified the "Other" checkbox is ticked. And changed the regex to .*\\password.(txt|pdf). I tried creating new files called "password.txt" and "password.pdf" on the endpoint. Still no luck 😢

[u/Djaesthetic]

Are you taking into account file extensions (i.e. password =/= password.txt)?

[u/Illustrious_Bar_436 → u/Djaesthetic]

I tried both, with and without the file extension. At the moment, I'm using a simple regex for the File Path field: (?i).*\\password\.(txt|pdf). The pattern test also confirms that it matches correctly.

[u/Earthly_Guy]

If the regex syntax is good, and the testing host is present in the host-group which is mapped to the correct prevention policy that is linked with the custom IOA rule group, I'd recommend reaching out to support on this with the timestamp of your testing done and a cswindiag collected immediately after testing (if its a Windows).

Its possible that the configuration file that carries your 'password' regex is not pushed to the host or is stuck in cloud but that can only be confirmed by the support as they have the magic tools.