Suspicious Managed Code Hosting Process

  1[metadata]
  2creation_date = "2020/08/21"
  3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious
 11code execution.
 12"""
 13from = "now-9m"
 14index = [
 15    "winlogbeat-*",
 16    "logs-endpoint.events.file-*",
 17    "logs-windows.sysmon_operational-*",
 18    "logs-m365_defender.event-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "endgame-*",
 21    "logs-crowdstrike.fdr*",
 22]
 23language = "eql"
 24license = "Elastic License v2"
 25name = "Suspicious Managed Code Hosting Process"
 26references = [
 27    "http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html",
 28]
 29risk_score = 73
 30rule_id = "acf738b5-b5b2-4acc-bad9-1e18ee234f40"
 31severity = "high"
 32tags = [
 33    "Domain: Endpoint",
 34    "OS: Windows",
 35    "Use Case: Threat Detection",
 36    "Tactic: Defense Evasion",
 37    "Data Source: Elastic Defend",
 38    "Data Source: Sysmon",
 39    "Data Source: Microsoft Defender XDR",
 40    "Data Source: SentinelOne",
 41    "Data Source: Elastic Endgame",
 42    "Data Source: Crowdstrike",
 43    "Resources: Investigation Guide",
 44    "Noise: Low",
 45    "Performance: Normal",
 46    "Profile: Recommended",
 47    "Threat: Living off the Land",
 48    "Rule Type: Event Correlation (EQL)",
 49    "Platform: Windows",
 50]
 51timestamp_override = "event.ingested"
 52type = "eql"
 53
 54query = '''
 55file where host.os.type == "windows" and event.type != "deletion" and
 56  file.name : ("wscript.exe.log",
 57               "cscript.exe.log",
 58               "mshta.exe.log",
 59               "wmic.exe.log",
 60               "svchost.exe.log",
 61               "dllhost.exe.log",
 62               "cmstp.exe.log",
 63               "regsvr32.exe.log")
 64'''
 65
 66note = """## Triage and analysis
 67
 68### Investigating Suspicious Managed Code Hosting Process
 69
 70#### Possible investigation steps
 71
 72- What CLR UsageLog behavior did the alert preserve?
 73  - Focus: `file.path`, `file.name`, `event.type`, and acting `process.name` / `process.executable`.
 74  - Implication: escalate when the UsageLog host has no stable process/user pattern; lower suspicion only as an initial read when the same path and process recur for the same product, deployment, login-script, COM, or service-host context.
 75- Is the managed host the genuine Windows binary rather than a lookalike?
 76  - Focus: same-process start evidence for `host.id` and `process.entity_id`: `process.executable`, hash, original file name, signer, and trust. $investigate_0
 77  - Hint: if a source lacks `process.entity_id`, fall back to `process.pid` plus `host.id` in a tight alert-time window to avoid PID reuse. $investigate_3
 78  - Implication: escalate when the host binary runs from a user-writable path, has a mismatched original file name, or has an unexpected signer; lower suspicion only when identity, signer, path, and the UsageLog host name all point to the same genuine Windows host.
 79- Does the launch chain explain why this host loaded managed code?
 80  - Focus: `process.command_line`, parent executable/command line, `user.id`, and session context.
 81  - Implication: escalate when Office, browsers, archive tools, remote sessions, or user-writable scripts drive mshta, wscript, cscript, wmic, regsvr32, or cmstp; lower suspicion when the same command line, parent, user, and session match a recognized installer, scheduled task, management agent, COM component, or login script.
 82- Does this UsageLog path recur with the same process and user pattern?
 83  - Focus: historical file and process events for the same `host.id`, comparing `file.path`, `event.type`, process/parent executable, and `user.id`. $investigate_4
 84  - Implication: escalate when a first create, new `process.executable`, new parent, new user, or unusual update appears for a process that normally should not host managed code; lower suspicion when prior events show the same path, process identity, parent, and user with no follow-on artifacts.
 85- Does the UsageLog artifact or same-process activity expose payload staging?
 86  - Why: HTA/JS managed-code hosting and repeat UsageLog updates can hide intent in process text, so preserve the UsageLog while using same-process file/process telemetry for the decision.
 87  - Focus: preserve `file.path`, then query file and process events for the same `host.id` and `process.entity_id`, comparing name, extension, size, and later `process.executable` reuse of written paths. $investigate_5 $investigate_6
 88  - Hint: if only `process.pid` is available, keep the file/process correlation tightly scoped to the alert time and host; empty or multiple PID matches are unresolved, not benign.
 89  - Implication: escalate when the process writes scriptable or executable content to user-writable paths, creates unusual payload-sized files, or later executes a written artifact; lower suspicion when artifacts stay inside the same recognized product or deployment path with no follow-on execution.
 90- If local evidence remains suspicious or unresolved, does the same user or host show related managed-host abuse?
 91  - Focus: related alerts for `user.id` and `host.id`: repeated UsageLog paths, script-host execution, payload staging, injection, or persistence.
 92  - Hint: same-user alert view: $investigate_1
 93  - Hint: same-host alert view: $investigate_2
 94  - Implication: broaden scope only when UsageLog, identity, launch, recurrence, or artifact evidence remains suspicious or incomplete; keep local when the alert is isolated and all supported evidence resolves to one recognized workflow.
 95- Escalate for unauthorized managed-code execution through a script host or LOLBin; close only when UsageLog, identity, launch, recurrence, artifact, and related-alert evidence bind to one recognized workflow with no contradictions; preserve artifacts and escalate when evidence is mixed or incomplete.
 96
 97### False positive analysis
 98
 99- Packaging, deployment, login-script, management-agent, product, COM, and service-hosted workflows can legitimately update CLR UsageLogs for wscript.exe, cscript.exe, mshta.exe, wmic.exe, cmstp.exe, svchost.exe, dllhost.exe, or regsvr32.exe. Confirm `file.path`, process identity, signer or hash history, parent or service/COM launch context, user/session context, artifact behavior, and same-process file/process activity all point to one workflow. If inventories are unavailable, require stable UsageLog path, parent chain, process identity, and user-host pairing across prior alerts before closing as benign.
100- Build exceptions only from the minimum confirmed workflow pattern: `file.path`, `process.executable`, `process.parent.executable`, stable signer or hash, and the relevant `host.id` or `user.id` scope. Avoid exceptions on `file.name`, process name, or host name alone.
101
102### Response and remediation
103
104- If confirmed benign, reverse any temporary containment and document the UsageLog path, process identity, launch chain, user/session context, recurrence pattern, and artifact evidence that proved the workflow. Create an exception only after the same pattern recurs consistently across prior alerts.
105- If suspicious but unconfirmed, preserve the UsageLog artifact, process start event, command line, parent chain, same-process file/process timeline, written artifacts, related alerts, and case notes before containment or cleanup.
106- If suspicious but unconfirmed, apply reversible containment tied to the findings, such as heightened monitoring or temporary isolation of the affected `host.id` when process/file evidence suggests payload execution. Avoid process termination or file deletion until the artifact set is preserved.
107- If confirmed malicious, isolate the endpoint when process identity, launch context, artifact behavior, or related alerts establish unauthorized managed-code execution. Before suspending or terminating the host process, record the recovered `process.entity_id`, command line, parent chain, UsageLog path, and staged files.
108- Scope related hosts and users for the same UsageLog path, parent process, process identity, and staged artifacts before deleting files or terminating additional processes.
109- Remove only malicious scripts, HTA/JS payloads, assemblies, staged binaries, or persistence artifacts identified during the investigation, then remediate the delivery path or launcher that caused the managed host to load CLR.
110- Post-incident hardening: restrict script-host and LOLBin execution through application control where feasible, keep endpoint file/process telemetry for CLR UsageLog triage, and document the confirmed benign workflow or malicious artifact set for future analysts."""
111
112setup = """## Setup
113
114This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
115
116Setup instructions: https://ela.st/install-elastic-defend
117
118### Additional data sources
119
120This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
121
122- [CrowdStrike](https://ela.st/crowdstrike-integration)
123- [Microsoft Defender XDR](https://ela.st/m365-defender)
124- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
125- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
126"""
127
128[rule.investigation_fields]
129field_names = [
130    "@timestamp",
131    "event.type",
132    "host.name",
133    "host.id",
134    "user.id",
135    "process.entity_id",
136    "process.pid",
137    "process.executable",
138    "process.command_line",
139    "process.parent.executable",
140    "process.parent.command_line",
141    "process.pe.original_file_name",
142    "process.code_signature.subject_name",
143    "process.code_signature.trusted",
144    "file.path",
145]
146
147[transform]
148
149[[transform.investigate]]
150label = "Process events for the same process"
151description = ""
152providers = [
153  [
154    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
155    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
156    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
157  ]
158]
159relativeFrom = "now-1h"
160relativeTo = "now"
161
162[[transform.investigate]]
163label = "Alerts associated with the user"
164description = ""
165providers = [
166  [
167    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
168    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
169  ]
170]
171relativeFrom = "now-48h/h"
172relativeTo = "now"
173
174[[transform.investigate]]
175label = "Alerts associated with the host"
176description = ""
177providers = [
178  [
179    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
180    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
181  ]
182]
183relativeFrom = "now-48h/h"
184relativeTo = "now"
185
186[[transform.investigate]]
187label = "Process events for the same PID"
188description = ""
189providers = [
190  [
191    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
192    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
193    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
194  ]
195]
196relativeFrom = "now-1h"
197relativeTo = "now"
198
199[[transform.investigate]]
200label = "File events for the same UsageLog path"
201description = ""
202providers = [
203  [
204    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
205    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
206    { excluded = false, field = "file.path", queryType = "phrase", value = "{{file.path}}", valueType = "string" }
207  ]
208]
209relativeFrom = "now-7d/d"
210relativeTo = "now"
211
212[[transform.investigate]]
213label = "File events for the same process or PID"
214description = ""
215providers = [
216  [
217    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
218    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
219    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
220  ],
221  [
222    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
223    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
224    { excluded = false, field = "process.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
225  ]
226]
227relativeFrom = "now-1h"
228relativeTo = "now"
229
230[[transform.investigate]]
231label = "Child process events for the managed host"
232description = ""
233providers = [
234  [
235    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
236    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
237    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
238  ],
239  [
240    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
241    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
242    { excluded = false, field = "process.parent.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" }
243  ]
244]
245relativeFrom = "now-1h"
246relativeTo = "now"
247
248[[rule.threat]]
249framework = "MITRE ATT&CK"
250
251[[rule.threat.technique]]
252id = "T1055"
253name = "Process Injection"
254reference = "https://attack.mitre.org/techniques/T1055/"
255
256[[rule.threat.technique]]
257id = "T1218"
258name = "System Binary Proxy Execution"
259reference = "https://attack.mitre.org/techniques/T1218/"
260
261[[rule.threat.technique.subtechnique]]
262id = "T1218.003"
263name = "CMSTP"
264reference = "https://attack.mitre.org/techniques/T1218/003/"
265
266[[rule.threat.technique.subtechnique]]
267id = "T1218.005"
268name = "Mshta"
269reference = "https://attack.mitre.org/techniques/T1218/005/"
270
271[[rule.threat.technique.subtechnique]]
272id = "T1218.010"
273name = "Regsvr32"
274reference = "https://attack.mitre.org/techniques/T1218/010/"
275
276[[rule.threat.technique]]
277id = "T1620"
278name = "Reflective Code Loading"
279reference = "https://attack.mitre.org/techniques/T1620/"
280
281[rule.threat.tactic]
282id = "TA0005"
283name = "Defense Evasion"
284reference = "https://attack.mitre.org/tactics/TA0005/"
285
286[[rule.threat]]
287framework = "MITRE ATT&CK"
288
289[[rule.threat.technique]]
290id = "T1047"
291name = "Windows Management Instrumentation"
292reference = "https://attack.mitre.org/techniques/T1047/"
293
294[rule.threat.tactic]
295id = "TA0002"
296name = "Execution"
297reference = "https://attack.mitre.org/tactics/TA0002/"