# False positives on hunting rule

**URL:** https://community.emergingthreats.net/t/false-positives-on-hunting-rule/1741
**Category:** Rule Signatures
**Created:** [June 20, 2024, 7:39am UTC](https://community.emergingthreats.net/t/false-positives-on-hunting-rule/1741 "2024-06-20T07:39:39Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![beshbesh](https://avatars.discourse-cdn.com/v4/letter/b/f05b48/32.png) [@beshbesh](https://community.emergingthreats.net/u/beshbesh)
#### Post date: [June 20, 2024, 7:39am UTC](https://community.emergingthreats.net/t/false-positives-on-hunting-rule/1741/1 "2024-06-20T07:39:39Z")

</div>

Hello,

The rule with 2011341, SID ET HUNTING Suspicious POST With Reference to WINDOWS Folder Possible Malware Infection seems to give me a false positive. When using Elastic and Winlogbeat to transfer logs over HTTP, this rule gets triggered. I noticed a few exclusions in this rule. I think another one should be added for winlogbeat. Some strings:

User-agent: “Elastic-winlogbeat/7.17.10 (windows; amd64; …” (truncated because I don’t know if there is any system-specific info in there).  
URL: “/\_bulk”.

I also think the severity is quite high given the false positive rate.

Thanks in advance!

---

<div class="post-metadata">

### Author: ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)
#### Post date: [June 20, 2024, 3:18pm UTC](https://community.emergingthreats.net/t/false-positives-on-hunting-rule/1741/2 "2024-06-20T15:18:05Z")

</div>

Hey @beshbesh,

Thanks for sharing! I’ll take a look and get an update out in today’s release.

Thanks!  
Isaac

---

<div class="post-metadata">

### Author: ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)
#### Post date: [June 21, 2024, 3:40pm UTC](https://community.emergingthreats.net/t/false-positives-on-hunting-rule/1741/3 "2024-06-21T15:40:15Z")

</div>

@beshbesh - The updated rule should be live now. I did some hunting and found some FP’s for `sentry.io` stuff so I negated that too. This rule is probably prone to FP’s on traffic that is related to statistics or logs but I think negations are the right way to go since the rule is targeting the string `C:\\WINDOWS\`.

Thanks again for the report, let me know if you see any other issues!