MsiExec Service Child Process With Network Connection

  1[metadata]
  2creation_date = "2024/09/09"
  3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
  6min_stack_version = "8.14.0"
  7updated_date = "2025/01/15"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies the execution of an MsiExec service child process followed by network or dns lookup activity. Adversaries may
 13abuse Windows Installers for initial access and delivery of malware.
 14"""
 15from = "now-9m"
 16index = ["logs-endpoint.events.process-*", "logs-endpoint.events.network-*", "logs-windows.sysmon_operational-*", "logs-sentinel_one_cloud_funnel.*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "MsiExec Service Child Process With Network Connection"
 20risk_score = 47
 21rule_id = "65432f4a-e716-4cc1-ab11-931c4966da2d"
 22severity = "medium"
 23tags = [
 24    "Domain: Endpoint",
 25    "OS: Windows",
 26    "Use Case: Threat Detection",
 27    "Tactic: Defense Evasion",
 28    "Data Source: Elastic Defend",
 29    "Data Source: Sysmon",
 30    "Data Source: SentinelOne",
 31    "Resources: Investigation Guide",
 32]
 33type = "eql"
 34
 35query = '''
 36sequence by process.entity_id with maxspan=1m
 37 [process where host.os.type == "windows" and event.type : "start" and
 38  process.parent.name : "msiexec.exe" and process.parent.args : "/v" and
 39  not process.executable :
 40        ("?:\\Windows\\System32\\msiexec.exe",
 41         "?:\\Windows\\sysWOW64\\msiexec.exe",
 42         "?:\\Windows\\system32\\srtasks.exe",
 43         "?:\\Windows\\syswow64\\srtasks.exe",
 44         "?:\\Windows\\sys*\\taskkill.exe",
 45         "?:\\Program Files\\*.exe",
 46         "?:\\Program Files (x86)\\*.exe",
 47         "?:\\Windows\\Installer\\MSI*.tmp",
 48         "?:\\Windows\\Microsoft.NET\\Framework*\\RegSvcs.exe") and
 49 not (process.name : ("rundll32.exe", "regsvr32.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*"))]
 50[any where host.os.type == "windows" and event.category in ("network", "dns") and process.name != null]
 51'''
 52note = """## Triage and analysis
 53
 54> **Disclaimer**:
 55> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 56
 57### Investigating MsiExec Service Child Process With Network Connection
 58
 59MsiExec is a Windows utility for installing, maintaining, and removing software. Adversaries exploit it to execute malicious payloads by disguising them as legitimate installations. The detection rule identifies suspicious child processes spawned by MsiExec that initiate network activity, which is atypical for standard installations. By focusing on unusual executable paths and network connections, the rule helps uncover potential misuse indicative of malware delivery or initial access attempts.
 60
 61### Possible investigation steps
 62
 63- Review the process tree to identify the parent and child processes of the suspicious MsiExec activity, focusing on the process.entity_id and process.parent.name fields to understand the execution flow.
 64- Examine the process.executable path to determine if it deviates from typical installation paths, as specified in the query, to assess the likelihood of malicious activity.
 65- Analyze the network or DNS activity associated with the process by reviewing the event.category field for network or dns events, and correlate these with the process.name to identify any unusual or unauthorized connections.
 66- Check the process.args for any unusual or suspicious command-line arguments that might indicate an attempt to execute malicious payloads or scripts.
 67- Investigate the host's recent activity and security logs to identify any other indicators of compromise or related suspicious behavior, leveraging data sources like Elastic Defend, Sysmon, or SentinelOne as mentioned in the rule's tags.
 68- Assess the risk and impact of the detected activity by considering the context of the alert, such as the host's role in the network and any potential data exposure or system compromise.
 69
 70### False positive analysis
 71
 72- Legitimate software installations or updates may trigger the rule if they involve network activity. Users can create exceptions for known software update processes that are verified as safe.
 73- Custom enterprise applications that use MsiExec for deployment and require network access might be flagged. Identify these applications and exclude their specific executable paths from the rule.
 74- Automated deployment tools that utilize MsiExec and perform network operations could be misidentified. Review these tools and whitelist their processes to prevent false alerts.
 75- Security software or system management tools that leverage MsiExec for legitimate purposes may cause false positives. Confirm these tools' activities and add them to an exclusion list if necessary.
 76- Regularly review and update the exclusion list to ensure it reflects the current environment and any new legitimate software that may interact with MsiExec.
 77
 78### Response and remediation
 79
 80- Isolate the affected system from the network immediately to prevent further malicious activity and lateral movement.
 81- Terminate the suspicious child process spawned by MsiExec to halt any ongoing malicious operations.
 82- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any malicious payloads or remnants.
 83- Review and analyze the process execution and network activity logs to identify any additional indicators of compromise (IOCs) and assess the scope of the intrusion.
 84- Reset credentials and review access permissions for any accounts that may have been compromised or used during the attack.
 85- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
 86- Implement enhanced monitoring and detection rules to identify similar threats in the future, focusing on unusual MsiExec activity and network connections."""
 87
 88
 89[[rule.threat]]
 90framework = "MITRE ATT&CK"
 91[[rule.threat.technique]]
 92id = "T1218"
 93name = "System Binary Proxy Execution"
 94reference = "https://attack.mitre.org/techniques/T1218/"
 95[[rule.threat.technique.subtechnique]]
 96id = "T1218.007"
 97name = "Msiexec"
 98reference = "https://attack.mitre.org/techniques/T1218/007/"
 99
100
101
102[rule.threat.tactic]
103id = "TA0005"
104name = "Defense Evasion"
105reference = "https://attack.mitre.org/tactics/TA0005/"