Unusual Executable File Creation by a System Critical Process

  1[metadata]
  2creation_date = "2020/08/19"
  3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies an unexpected executable file being created or modified by a Windows system critical process, which may
 11indicate activity related to remote code execution or other forms of exploitation.
 12"""
 13from = "now-9m"
 14index = [
 15    "winlogbeat-*",
 16    "logs-endpoint.events.file-*",
 17    "logs-windows.sysmon_operational-*",
 18    "endgame-*",
 19    "logs-m365_defender.event-*",
 20    "logs-sentinel_one_cloud_funnel.*",
 21    "logs-crowdstrike.fdr*",
 22]
 23language = "eql"
 24license = "Elastic License v2"
 25name = "Unusual Executable File Creation by a System Critical Process"
 26risk_score = 73
 27rule_id = "e94262f2-c1e9-4d3f-a907-aeab16712e1a"
 28severity = "high"
 29tags = [
 30    "Domain: Endpoint",
 31    "OS: Windows",
 32    "Use Case: Threat Detection",
 33    "Tactic: Defense Evasion",
 34    "Tactic: Execution",
 35    "Resources: Investigation Guide",
 36    "Data Source: Elastic Endgame",
 37    "Data Source: Elastic Defend",
 38    "Data Source: Sysmon",
 39    "Data Source: Microsoft Defender XDR",
 40    "Data Source: SentinelOne",
 41    "Data Source: Crowdstrike",
 42    "Noise: Medium",
 43    "Performance: Normal",
 44    "Rule Type: Event Correlation (EQL)",
 45    "Platform: Windows",
 46]
 47timestamp_override = "event.ingested"
 48type = "eql"
 49
 50query = '''
 51file where host.os.type == "windows" and event.type != "deletion" and
 52  file.extension : ("exe", "dll") and
 53  process.name : ("smss.exe",
 54                  "autochk.exe",
 55                  "csrss.exe",
 56                  "wininit.exe",
 57                  "services.exe",
 58                  "lsass.exe",
 59                  "winlogon.exe",
 60                  "userinit.exe",
 61                  "LogonUI.exe") and
 62  not (
 63    process.name : "smss.exe" and
 64    file.path : (
 65      "?:\\Windows\\System32\\wpbbin.exe",
 66      "\\Device\\HarddiskVolume*\\Windows\\System32\\wpbbin.exe"
 67    )
 68  ) and
 69  not (
 70    process.name : "lsass.exe" and
 71    file.path : (
 72      "?:\\Windows\\System32\\eac_usermode_*.dll",
 73      "\\Device\\HarddiskVolume*\\Windows\\System32\\eac_usermode_*.dll"
 74    )
 75  )
 76'''
 77
 78note = """## Triage and analysis
 79
 80### Investigating Unusual Executable File Creation by a System Critical Process
 81
 82#### Possible investigation steps
 83
 84- What exact critical-process write did the alert preserve?
 85  - Focus: `process.name`, `process.executable`, `file.path`, `file.extension`, and `event.action`; writer should match a critical-process name in the query.
 86  - Implication: escalate faster when it writes an EXE or DLL in user-writable, startup, temp, or other non-servicing paths; lower concern only for protected OS servicing paths or a repaired vendor product tree.
 87- Is the writer the expected protected Windows binary, not a masquerade or tampered copy?
 88  - Why: exploitation for defense evasion can preserve a genuine protected-process identity while changing what that process writes.
 89  - Focus: `process.executable`, `process.code_signature.subject_name`, and `process.code_signature.trusted`; recover `process.hash.sha256` and `process.pe.original_file_name` from matching process-start events on `host.id` and `process.entity_id` when absent. $investigate_1
 90  - Implication: escalate when path, signer, hash, or original file name conflicts with the expected critical process; if identity is the expected Microsoft binary, continue because exploitation can still force a genuine process to write attacker-controlled content.
 91- What launch and user context led to the write?
 92  - Why: client-side or service exploitation often appears as Office, browser, script, archive, or user-profile ancestry before an abnormal critical-process file write.
 93  - Focus: matching process-start event: `process.command_line`, `process.parent.executable`, `process.parent.command_line`, `process.Ext.ancestry`, and `user.id`.
 94  - Implication: escalate when the chain traces to Office, browser, script, archive, LOLBin, or user-profile activity before the critical-process write; lower concern only when parentage and user context align with OS servicing or one bounded product repair.
 95- Does the written artifact look staged or renamed rather than serviced?
 96  - Focus: `file.path`, `file.Ext.original.path`, `file.Ext.original.extension`, `file.Ext.header_bytes`, and `file.Ext.windows.zone_identifier`. $investigate_2
 97  - Implication: escalate when content is renamed into an executable extension, lands in a deceptive or writable path, carries internet provenance, or header bytes do not fit the file name.
 98- Did the written file become an execution target or command-line dependency?
 99  - Focus: same-writer file activity on `host.id` and `process.entity_id`, plus later process starts from `file.path`. $investigate_0
100  - Hint: for EXE reuse, inspect later process starts where `process.executable` equals `file.path`; for DLL writes, search `process.command_line` for the path and treat a quiet result as unresolved, not benign. $investigate_5
101  - Implication: escalate when the artifact executes or is referenced by follow-on commands; if the same-process file view is quiet, use the EXE or DLL recovery cue before lowering urgency.
102- If local evidence remains suspicious or unresolved, does the artifact pattern recur on this host or other hosts?
103  - Focus: related alerts for the same written `file.path`; add writer `process.executable` only after alert or identity confirms it. $investigate_3
104  - Hint: compare related alerts for the same `host.id` and `host.name` before broadening to other assets. $investigate_4
105  - Implication: broaden scope when the same artifact path, writer identity, or follow-on execution appears on multiple hosts or repeats on the same host; localize when evidence stays limited to one short-lived, well-bounded servicing chain.
106- Escalate for abnormal identity, exploit-like lineage, staged content, execution/reference, or recurrence; close only when identity, lineage, artifact, and scope bind one servicing or vendor-maintenance workflow with no contradictions; preserve artifacts and escalate when evidence stays mixed or incomplete.
107
108### False positive analysis
109
110- Windows servicing/component repair or product/security-agent upgrade can replace binaries in protected OS or vendor paths. Confirm writer identity (`process.executable`, `process.code_signature.subject_name`, `process.hash.sha256`, `process.pe.original_file_name`), lineage (`process.parent.executable`, `process.Ext.ancestry`), and `file.path` all match one servicing or product workflow on the same `host.id`; for vendor repair, also require the path to stay inside the vendor directory and no user-writable staging, staged rename, or later execution from that path. If maintenance records are unavailable, use prior alerts from this rule for the same host and require the same protected path pattern without staged rename or later execution.
111- Before creating an exception, require recurrence for the same `host.id` plus stable `process.executable`, `process.code_signature.subject_name`, parent context, and protected `file.path` pattern. Avoid exceptions on `process.name`, `file.extension`, or the whole critical-process list alone.
112
113### Response and remediation
114
115- If confirmed benign, reverse temporary containment and document the servicing or vendor-maintenance evidence: writer identity, parent context, written path, content indicators, and host scope. Create an exception only after the bounded pattern recurs.
116- If suspicious but unconfirmed, export the alert file event and matching process-start event, preserve a copy of the written file when safe, and record the writer `process.entity_id`, `process.command_line`, `process.parent.executable`, `file.path`, and recovered `process.hash.sha256` before containment. Apply reversible containment first, such as heightened monitoring or temporary host isolation when host criticality allows, and avoid deleting the artifact until scope is clearer.
117- If confirmed malicious, isolate the host when writer identity, lineage, artifact, or execution evidence establishes unauthorized activity. Record `process.entity_id`, `process.executable`, `process.command_line`, `file.path`, and recovered hashes before killing processes or deleting files; then terminate the offending process if still active and quarantine only the executable or DLL artifacts identified during investigation.
118- Post-incident hardening should verify why a critical process could write executable content, restore affected files from trusted media when replacement occurred, retain process and file telemetry that supported the case, and document artifact-path or lineage variants in the incident record for future triage.
119"""
120
121setup = """## Setup
122
123This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
124
125Setup instructions: https://ela.st/install-elastic-defend
126
127### Additional data sources
128
129This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
130
131- [CrowdStrike](https://ela.st/crowdstrike-integration)
132- [Microsoft Defender XDR](https://ela.st/m365-defender)
133- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
134- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
135"""
136
137[rule.investigation_fields]
138field_names = [
139    "@timestamp",
140    "host.name",
141    "host.id",
142    "user.id",
143    "process.entity_id",
144    "process.name",
145    "process.executable",
146    "process.code_signature.subject_name",
147    "process.code_signature.trusted",
148    "file.path",
149    "file.extension",
150    "file.Ext.original.path",
151    "file.Ext.header_bytes",
152    "file.Ext.windows.zone_identifier",
153    "event.action",
154]
155
156[transform]
157
158[[transform.investigate]]
159label = "Events for the writing process on this host"
160description = ""
161providers = [
162  [
163    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
164    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
165  ]
166]
167relativeFrom = "now-1h"
168relativeTo = "now"
169
170[[transform.investigate]]
171label = "Process start for the writing process"
172description = ""
173providers = [
174  [
175    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
176    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
177    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
178    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" }
179  ]
180]
181relativeFrom = "now-1h"
182relativeTo = "now"
183
184[[transform.investigate]]
185label = "File activity for the written path on this host"
186description = ""
187providers = [
188  [
189    { excluded = false, field = "file.path", queryType = "phrase", value = "{{file.path}}", valueType = "string" },
190    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
191    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
192  ]
193]
194relativeFrom = "now-1h"
195relativeTo = "now"
196
197[[transform.investigate]]
198label = "Alerts associated with the written file path"
199description = ""
200providers = [
201  [
202    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
203    { excluded = false, field = "file.path", queryType = "phrase", value = "{{file.path}}", valueType = "string" }
204  ]
205]
206relativeFrom = "now-48h/h"
207relativeTo = "now"
208
209[[transform.investigate]]
210label = "Alerts associated with the host"
211description = ""
212providers = [
213  [
214    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
215    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
216  ]
217]
218relativeFrom = "now-48h/h"
219relativeTo = "now"
220
221[[transform.investigate]]
222label = "Process starts from the written file path on this host"
223description = ""
224providers = [
225  [
226    { excluded = false, field = "process.executable", queryType = "phrase", value = "{{file.path}}", valueType = "string" },
227    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
228    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
229    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" }
230  ],
231  [
232    { excluded = false, field = "process.command_line", queryType = "phrase", value = "{{file.path}}", valueType = "string" },
233    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
234    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
235    { excluded = false, field = "event.type", queryType = "phrase", value = "start", valueType = "string" }
236  ]
237]
238relativeFrom = "now-1h"
239relativeTo = "now"
240
241[[rule.threat]]
242framework = "MITRE ATT&CK"
243
244[[rule.threat.technique]]
245id = "T1211"
246name = "Exploitation for Defense Evasion"
247reference = "https://attack.mitre.org/techniques/T1211/"
248
249[rule.threat.tactic]
250id = "TA0005"
251name = "Defense Evasion"
252reference = "https://attack.mitre.org/tactics/TA0005/"
253
254[[rule.threat]]
255framework = "MITRE ATT&CK"
256
257[[rule.threat.technique]]
258id = "T1203"
259name = "Exploitation for Client Execution"
260reference = "https://attack.mitre.org/techniques/T1203/"
261
262[rule.threat.tactic]
263id = "TA0002"
264name = "Execution"
265reference = "https://attack.mitre.org/tactics/TA0002/"
266
267[[rule.threat]]
268framework = "MITRE ATT&CK"
269
270[[rule.threat.technique]]
271id = "T1068"
272name = "Exploitation for Privilege Escalation"
273reference = "https://attack.mitre.org/techniques/T1068/"
274
275[rule.threat.tactic]
276id = "TA0004"
277name = "Privilege Escalation"
278reference = "https://attack.mitre.org/tactics/TA0004/"