Control Panel Process with Unusual Arguments

 1[metadata]
 2creation_date = "2021/09/08"
 3integration = ["endpoint", "windows", "system"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2024/03/28"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value.
13Adversaries may abuse control.exe to proxy execution of malicious code.
14"""
15from = "now-9m"
16index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
17language = "eql"
18license = "Elastic License v2"
19name = "Control Panel Process with Unusual Arguments"
20references = ["https://www.joesandbox.com/analysis/476188/1/html"]
21risk_score = 73
22rule_id = "416697ae-e468-4093-a93d-59661fa619ec"
23setup = """## Setup
24
25If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
26events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
27Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
28`event.ingested` to @timestamp.
29For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
30"""
31severity = "high"
32tags = ["Domain: Endpoint",
33        "OS: Windows",
34        "Use Case: Threat Detection",
35        "Tactic: Defense Evasion",
36        "Tactic: Execution",
37        "Data Source: Elastic Endgame", 
38        "Data Source: Elastic Defend"
39        ]
40timestamp_override = "event.ingested"
41type = "eql"
42
43query = '''
44process where host.os.type == "windows" and event.type == "start" and
45 process.executable : ("?:\\Windows\\SysWOW64\\control.exe", "?:\\Windows\\System32\\control.exe") and
46 process.command_line :
47          ("*.jpg*",
48           "*.png*",
49           "*.gif*",
50           "*.bmp*",
51           "*.jpeg*",
52           "*.TIFF*",
53           "*.inf*",
54           "*.cpl:*/*",
55           "*../../..*",
56           "*/AppData/Local/*",
57           "*:\\Users\\Public\\*",
58           "*\\AppData\\Local\\*")
59'''
60
61
62[[rule.threat]]
63framework = "MITRE ATT&CK"
64[[rule.threat.technique]]
65id = "T1218"
66name = "System Binary Proxy Execution"
67reference = "https://attack.mitre.org/techniques/T1218/"
68[[rule.threat.technique.subtechnique]]
69id = "T1218.002"
70name = "Control Panel"
71reference = "https://attack.mitre.org/techniques/T1218/002/"
72
73
74
75[rule.threat.tactic]
76id = "TA0005"
77name = "Defense Evasion"
78reference = "https://attack.mitre.org/tactics/TA0005/"