# Insight IDR - Custom Detection Rule - Generic Endpoint Acitivity **URL:** \ **Category:** Event Sources\ **Created:** [October 11, 2024, 6:54pm UTC](https://discuss.rapid7.com/t/insight-idr-custom-detection-rule-generic-endpoint-acitivity/43562 "2024-10-11T18:54:21Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![bfraley](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/b/5f8ce5/32.png) [@bfraley](https://discuss.rapid7.com/u/bfraley)\ **Post date:** [October 11, 2024, 6:54pm UTC](https://discuss.rapid7.com/t/insight-idr-custom-detection-rule-generic-endpoint-acitivity/43562/1 "2024-10-11T18:54:21Z")
Howdy all, I have been slowly working my way around the Rapid7 IDR platform. I figured I would take a crack at writing my own detection rules to help alert when a user downloads and installs some PUP/PUA. As my starting point of reference I looked at the built-in rule logic for `Suspicious Registry Event - Unusual Registry Run Keys`. This is an almost idetnical use case for what I want, just replaced with a specific software. Which can be found here - ```auto from( event_type = "endpoint_activity" ) where( event.System.EventID = "13" AND event.EventData.Data.TargetObject ICONTAINS-ANY [ "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\", "\\SOFTWARE\\Microsoft\\WindowsNT\\CurrentVersion\\Run\\", "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\" ] AND NOT event.EventData.Data.Image ICONTAINS-ANY [ "\\system32\\", "\\Program Files", "\\SysWow64\\", "Microsoft\\OneDrive" ] AND NOT event.EventData.Data.Details ICONTAINS-ANY [ "\\system32\\", "\\Program Files", "\\SysWow64\\", "Microsoft\\OneDrive", "bomgar", "(Empty)", "\\teams\\update.exe", "%%ProgramFiles%%", "\\Programs\\Webex\\", "\\Google\\Update\\", "\\SunloginClient\\SunloginClient.exe" ] ) ``` Essentially I wanted to duplicated the rule but swap out the `where` portion to be focused on the specific IoCs we have for this software. I see in the `from` portion the `event_type = endpoint_activity`. Which makes sense. However when I got into the create custom rule window, when I go to select my event source. I see several specific options for `Endpoint Activity` but nothing generic or for lack of a better wording - a wildcard option. See picture: ![image](https://forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/original/2X/e/ea1663cd86974c5cab7c9bea4b2617fbf9d7d50e.png) Any ideas why? Or what I might be able to do to enable that as an event source for custom rules? Checked the documentation [here](https://docs.rapid7.com/insightidr/custom-detection-rules) and [here](https://docs.rapid7.com/insightidr/custom-detection-rules-faq/) and could not find a solution. I checked to see if I needed to enable some other data source in the data collection portion of IDR, however I realized that I would not be getting alerts if the data was not already available. If I am not able to use the generic `Endpoint Acitivity` event source. What would be the next best source to use? Or could I just amend an exsisting rule to meet my needs? Stuck and would love some help and input. ---
**Author:** ![christopher\_kane1](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/c/a88e4f/32.png) [@christopher\_kane1](https://discuss.rapid7.com/u/christopher_kane1)\ **Post date:** [October 14, 2024, 1:50pm UTC](https://discuss.rapid7.com/t/insight-idr-custom-detection-rule-generic-endpoint-acitivity/43562/2 "2024-10-14T13:50:12Z")
The different sub types under “endpoint\_activity” may have different structure, and therefore keys available. Although this rule does not specify the sub type as “sysmon” i believe it will be matching on those events by virtue of the keys used in the where clause. It is my understanding that the “Endpoint Activity - Sysmon” event type is the one you should select here. ---
**Author:** ![bfraley](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/b/5f8ce5/32.png) [@bfraley](https://discuss.rapid7.com/u/bfraley)\ **Post date:** [October 14, 2024, 2:25pm UTC](https://discuss.rapid7.com/t/insight-idr-custom-detection-rule-generic-endpoint-acitivity/43562/3 "2024-10-14T14:25:04Z")
> [@christopher\_kane1](#): > > The different sub types under “endpoint\_activity” may have different structure, and therefore keys available I figured this was the case. Thank you for confirming. > Although this rule does not specify the sub type as “sysmon” i believe it will be matching on those events by virtue of the keys used in the where clause. It is my understanding that the “Endpoint Activity - Sysmon” event type is the one you should select here. Good observation! I had not thought to check some of the rule context to see if I could find key pairs being used and cross reference them with available options in the current data sets. I will go ahead and give it a shot and see. Thanks @christopher_kane1 Is there any documentation or KBs about testing rules prior to being fully implemented? I’d like to test the rule logic prior to pushing it into production. ---
**Author:** ![christopher\_kane1](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/c/a88e4f/32.png) [@christopher\_kane1](https://discuss.rapid7.com/u/christopher_kane1)\ **Post date:** [October 14, 2024, 3:34pm UTC](https://discuss.rapid7.com/t/insight-idr-custom-detection-rule-generic-endpoint-acitivity/43562/4 "2024-10-14T15:34:32Z")
Nice one. You can try it out in log search, and also set the rule action to “Assess Activity” to trial how it would behave. There is some documentation [here](https://docs.rapid7.com/insightidr/custom-detection-rules-faq#how-can-i-test-my-rule-to-make-sure-it-isnt-noisy) describing those options.