Potential Command and Control via Internet Explorer

 1[metadata]
 2creation_date = "2020/11/28"
 3integration = ["endpoint"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2024/04/08"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies instances of Internet Explorer (iexplore.exe) being started via the Component Object Model (COM) making
13unusual network connections. Adversaries could abuse Internet Explorer via COM to avoid suspicious processes making
14network connections and bypass host-based firewall restrictions.
15"""
16false_positives = ["Processes such as MS Office using IEproxy to render HTML content."]
17from = "now-9m"
18index = ["logs-endpoint.events.library-*", "logs-endpoint.events.process-*", "logs-endpoint.events.network-*"]
19language = "eql"
20license = "Elastic License v2"
21name = "Potential Command and Control via Internet Explorer"
22risk_score = 47
23rule_id = "acd611f3-2b93-47b3-a0a3-7723bcc46f6d"
24severity = "medium"
25tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Command and Control", "Data Source: Elastic Defend"]
26type = "eql"
27
28query = '''
29sequence by host.id, user.name with maxspan = 5s
30  [library where host.os.type == "windows" and dll.name : "IEProxy.dll" and process.name : ("rundll32.exe", "regsvr32.exe")]
31  [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "iexplore.exe" and process.parent.args : "-Embedding"]
32  /* IE started via COM in normal conditions makes few connections, mainly to Microsoft and OCSP related domains, add FPs here */
33  [network where host.os.type == "windows" and network.protocol == "dns" and process.name : "iexplore.exe" and
34   not dns.question.name :
35   (
36    "*.microsoft.com",
37    "*.digicert.com",
38    "*.msocsp.com",
39    "*.windowsupdate.com",
40    "*.bing.com",
41    "*.identrust.com",
42    "*.sharepoint.com",
43    "*.office365.com",
44    "*.office.com"
45    )
46  ] /* with runs=5 */
47'''
48
49
50[[rule.threat]]
51framework = "MITRE ATT&CK"
52[[rule.threat.technique]]
53id = "T1071"
54name = "Application Layer Protocol"
55reference = "https://attack.mitre.org/techniques/T1071/"
56
57
58[rule.threat.tactic]
59id = "TA0011"
60name = "Command and Control"
61reference = "https://attack.mitre.org/tactics/TA0011/"
62[[rule.threat]]
63framework = "MITRE ATT&CK"
64[[rule.threat.technique]]
65id = "T1559"
66name = "Inter-Process Communication"
67reference = "https://attack.mitre.org/techniques/T1559/"
68[[rule.threat.technique.subtechnique]]
69id = "T1559.001"
70name = "Component Object Model"
71reference = "https://attack.mitre.org/techniques/T1559/001/"
72
73
74
75[rule.threat.tactic]
76id = "TA0002"
77name = "Execution"
78reference = "https://attack.mitre.org/tactics/TA0002/"