Potential Masquerading as Communication Apps

  1[metadata]
  2creation_date = "2023/05/05"
  3integration = ["endpoint", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to
 11conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware.
 12"""
 13from = "now-9m"
 14index = ["logs-endpoint.events.process-*", "logs-sentinel_one_cloud_funnel.*", "endgame-*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Potential Masquerading as Communication Apps"
 18risk_score = 47
 19rule_id = "c9482bfa-a553-4226-8ea2-4959bd4f7923"
 20severity = "medium"
 21tags = [
 22    "Domain: Endpoint",
 23    "OS: Windows",
 24    "Use Case: Threat Detection",
 25    "Tactic: Defense Evasion",
 26    "Data Source: Elastic Defend",
 27    "Resources: Investigation Guide",
 28    "Data Source: SentinelOne",
 29    "Data Source: Elastic Endgame",
 30    "Noise: High",
 31    "Performance: Normal",
 32    "Profile: Aggressive",
 33    "Threat: Masquerading",
 34    "Rule Type: Event Correlation (EQL)",
 35    "Platform: Windows",
 36]
 37timestamp_override = "event.ingested"
 38type = "eql"
 39
 40query = '''
 41process where host.os.type == "windows" and
 42  event.type == "start" and 
 43  not process.code_signature.status like "errorCode_endpoint*" and process.hash.sha256 != null and 
 44  (
 45    /* Slack */
 46    (process.name : "slack.exe" and not
 47      (process.code_signature.subject_name : (
 48        "Slack Technologies, Inc.",
 49        "Slack Technologies, LLC"
 50       ) and process.code_signature.trusted == true)
 51    ) or
 52
 53    /* WebEx */
 54    (process.name : "WebexHost.exe" and not
 55      (process.code_signature.subject_name : ("Cisco WebEx LLC", "Cisco Systems, Inc.") and process.code_signature.trusted == true)
 56    ) or
 57
 58    /* Teams */
 59    (process.name : "Teams.exe" and not
 60      (process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true) and 
 61      process.executable != "C:\\Program Files (x86)\\Teams Installer\\Teams.exe"
 62    ) or
 63
 64    /* Discord */
 65    (process.name : "Discord.exe" and not
 66      (process.code_signature.subject_name : "Discord Inc." and process.code_signature.trusted == true)
 67    ) or
 68
 69    /* RocketChat */
 70    (process.name : "Rocket.Chat.exe" and not
 71      (process.code_signature.subject_name : "Rocket.Chat Technologies Corp." and process.code_signature.trusted == true) and 
 72      process.executable != "C:\\Program Files\\rocketchat\\Rocket.Chat.exe"
 73    ) or
 74
 75    /* Mattermost */
 76    (process.name : "Mattermost.exe" and not
 77      (process.code_signature.subject_name : "Mattermost, Inc." and process.code_signature.trusted == true)
 78    ) or
 79
 80    /* WhatsApp */
 81    (process.name : "WhatsApp.exe" and not
 82      (process.code_signature.subject_name : (
 83        "WhatsApp LLC",
 84        "WhatsApp, Inc",
 85        "24803D75-212C-471A-BC57-9EF86AB91435"
 86       ) and process.code_signature.trusted == true)
 87    ) or
 88
 89    /* Zoom */
 90    (process.name : "Zoom.exe" and not
 91      (process.code_signature.subject_name : (
 92        "Zoom Video Communications, Inc.",
 93        "Zoom Communications, Inc."
 94       ) and process.code_signature.trusted == true)
 95    ) or
 96
 97    /* Outlook */
 98    (process.name : "outlook.exe" and not
 99      (process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
100    ) or
101
102    /* Thunderbird */
103    (process.name : "thunderbird.exe" and not
104      (process.code_signature.subject_name : "Mozilla Corporation" and process.code_signature.trusted == true)
105    )
106  )
107'''
108
109setup = """## Setup
110
111This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
112
113Setup instructions: https://ela.st/install-elastic-defend
114
115### Additional data sources
116
117This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
118
119- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
120"""
121
122note = """## Triage and analysis
123
124> **Disclaimer**:
125> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
126
127### Investigating Potential Masquerading as Communication Apps
128
129Communication apps are integral to modern workflows, facilitating seamless interaction. However, adversaries can exploit these apps by masquerading malicious processes as legitimate ones, bypassing security measures and deceiving users. The detection rule identifies suspicious instances by checking for unsigned or improperly signed processes, ensuring they match known trusted signatures. This helps in flagging potential threats that mimic trusted communication tools, aiding in defense evasion detection.
130
131### Possible investigation steps
132
133- Review the process name and code signature details to confirm if the process is indeed masquerading as a legitimate communication app. Check if the process name matches any of the specified apps like slack.exe, WebexHost.exe, etc., and verify the code signature subject name and trust status.
134- Investigate the origin of the executable file by checking its file path and creation date. Determine if it was recently added or modified, which might indicate suspicious activity.
135- Analyze the parent process to understand how the suspicious process was initiated. This can provide insights into whether it was launched by a legitimate application or a potentially malicious script or program.
136- Check for any network connections initiated by the suspicious process. Look for unusual or unauthorized external connections that might suggest data exfiltration or command and control communication.
137- Review recent system logs and security alerts for any related activities or anomalies that coincide with the start of the suspicious process. This can help identify if the process is part of a larger attack pattern.
138- Consult threat intelligence sources to see if there are any known indicators of compromise (IOCs) associated with the process or its hash value, which can help in assessing the threat level.
139
140### False positive analysis
141
142- Legitimate software updates or installations may temporarily result in unsigned or improperly signed processes. Users can create exceptions for known update processes to prevent false positives during these periods.
143- Custom or internally developed communication tools that mimic the names of popular apps might trigger alerts. Ensure these tools are properly signed and add them to an allowlist if they are trusted.
144- Some third-party security or monitoring tools may interact with communication apps in a way that alters their signature status. Verify the legitimacy of these tools and consider excluding them from the rule if they are deemed safe.
145- In environments where communication apps are deployed via non-standard methods, such as portable versions, ensure these versions are signed correctly or add them to an exception list if they are verified as safe.
146- Temporary network issues or system misconfigurations might cause legitimate apps to appear unsigned. Regularly audit and correct any network or system issues to minimize these occurrences.
147
148### Response and remediation
149
150- Immediately isolate the affected system from the network to prevent further spread of potential malware or unauthorized access.
151- Terminate any suspicious processes identified by the detection rule that are masquerading as communication apps, ensuring they are not legitimate processes.
152- Conduct a thorough scan of the affected system using updated antivirus and anti-malware tools to identify and remove any malicious files or software.
153- Review and validate the code signatures of all communication apps on the affected system to ensure they are properly signed by trusted entities.
154- Restore any compromised systems from a known good backup to ensure the integrity of the system and data.
155- Monitor network traffic and system logs for any signs of lateral movement or further attempts to exploit communication apps.
156- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""
157
158
159[[rule.threat]]
160framework = "MITRE ATT&CK"
161[[rule.threat.technique]]
162id = "T1036"
163name = "Masquerading"
164reference = "https://attack.mitre.org/techniques/T1036/"
165[[rule.threat.technique.subtechnique]]
166id = "T1036.001"
167name = "Invalid Code Signature"
168reference = "https://attack.mitre.org/techniques/T1036/001/"
169
170[[rule.threat.technique.subtechnique]]
171id = "T1036.005"
172name = "Match Legitimate Resource Name or Location"
173reference = "https://attack.mitre.org/techniques/T1036/005/"
174
175
176
177[rule.threat.tactic]
178id = "TA0005"
179name = "Defense Evasion"
180reference = "https://attack.mitre.org/tactics/TA0005/"
181[[rule.threat]]
182framework = "MITRE ATT&CK"
183[[rule.threat.technique]]
184id = "T1554"
185name = "Compromise Host Software Binary"
186reference = "https://attack.mitre.org/techniques/T1554/"
187
188
189[rule.threat.tactic]
190id = "TA0003"
191name = "Persistence"
192reference = "https://attack.mitre.org/tactics/TA0003/"