Unusual Execution via Microsoft Common Console File

  1[metadata]
  2creation_date = "2024/05/12"
  3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the execution of a child process from a Microsoft Common Console file. Adversaries may embed a malicious
 11command in an MSC file in order to trick victims into executing malicious commands.
 12"""
 13from = "now-9m"
 14index = [
 15    "winlogbeat-*",
 16    "logs-endpoint.events.process-*",
 17    "logs-windows.sysmon_operational-*",
 18    "endgame-*",
 19    "logs-m365_defender.event-*",
 20    "logs-sentinel_one_cloud_funnel.*",
 21]
 22language = "eql"
 23license = "Elastic License v2"
 24name = "Unusual Execution via Microsoft Common Console File"
 25references = ["https://www.genians.co.kr/blog/threat_intelligence/facebook"]
 26risk_score = 73
 27rule_id = "e760c72b-bb1f-44f0-9f0d-37d51744ee75"
 28severity = "high"
 29tags = [
 30    "Domain: Endpoint",
 31    "OS: Windows",
 32    "Use Case: Threat Detection",
 33    "Tactic: Execution",
 34    "Tactic: Initial Access",
 35    "Resources: Investigation Guide",
 36    "Data Source: Elastic Endgame",
 37    "Data Source: Elastic Defend",
 38    "Data Source: Sysmon",
 39    "Data Source: Microsoft Defender XDR",
 40    "Data Source: SentinelOne",
 41    "Noise: Low",
 42    "Performance: Normal",
 43    "Profile: Recommended",
 44    "Threat: Living off the Land",
 45    "Rule Type: Event Correlation (EQL)",
 46    "Platform: Windows",
 47]
 48timestamp_override = "event.ingested"
 49type = "eql"
 50
 51query = '''
 52process where host.os.type == "windows" and event.type == "start" and
 53  process.parent.executable : "?:\\Windows\\System32\\mmc.exe" and endswith~(process.parent.args, ".msc") and
 54  not (
 55    process.parent.args : (
 56      "?:\\Windows\\System32\\*.msc",
 57      "?:\\Windows\\SysWOW64\\*.msc",
 58      "?:\\Program files\\*.msc",
 59      "?:\\Program Files (x86)\\*.msc"
 60    ) or
 61    (
 62      process.executable : "?:\\Windows\\System32\\mmc.exe" and
 63      process.command_line : "\"C:\\WINDOWS\\system32\\mmc.exe\" \"C:\\Windows\\System32\\gpme.msc\" /s /gpobject:\"LDAP://*"
 64    ) or
 65    (
 66      process.executable : (
 67        "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
 68        "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
 69        "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
 70        "?:\\Program Files\\internet explorer\\iexplore.exe"
 71      ) and
 72      process.args : "http*://go.microsoft.com/fwlink/*"
 73    ) or
 74    process.executable : (
 75      "?:\\Windows\\System32\\vmconnect.exe",
 76      "?:\\Windows\\System32\\WerFault.exe",
 77      "?:\\Windows\\System32\\wermgr.exe"
 78    )
 79  )
 80'''
 81
 82note = """## Triage and analysis
 83
 84### Investigating Unusual Execution via Microsoft Common Console File
 85
 86#### Possible investigation steps
 87
 88- What ".msc" path and immediate child process triggered the alert?
 89  - Focus: `process.parent.executable`, `process.parent.args`, `process.parent.command_line`, `process.executable`, and `process.command_line`.
 90  - Implication: escalate when "mmc.exe" opens a user-writable, download, cloud-sync, archive-extraction, or document-like ".msc" and the child is a shell, script host, "mshta.exe", "schtasks.exe", or another LOLBin; lower suspicion only when the exact ".msc" path and child command fit a recognized administrative console workflow on this host.
 91
 92- Does the child command line expose second-stage or persistence intent?
 93  - Focus: `process.command_line`, checking for "WScript.Shell", "schtasks /create", "OneDriveUpdate", "wscript.exe /b", "start /min", "mshta", ".hta", remote URLs, or script/batch names.
 94  - Hint: review same-child file and network events for staged scripts, task artifacts, or remote retrieval. Missing network telemetry is unresolved, not benign. $investigate_3
 95  - Implication: escalate when the command creates tasks, hides/minimizes execution, starts script hosts, or embeds remote retrieval; lower suspicion only when the arguments perform a narrow helper action expected from the same console.
 96
 97- Does the child identity and session context fit expected administration?
 98  - Focus: `process.executable`, `process.code_signature.subject_name`, `process.code_signature.trusted`, `process.Ext.relative_file_creation_time`, and the `user.id` + `host.id` pair.
 99  - Implication: escalate when the child runs from a user-writable or recently created path, has a signer mismatch, or appears under an unexpected administrative user/session; identity confirmation alone never clears an unsafe command line.
100
101- Do descendants continue the MSC-launched chain into scripting, tasks, or delayed execution?
102  - Why: MSC lures can store task commands that create a scheduled task, run VBS, then launch HTA through "mshta.exe"; the first child may be only the handoff.
103  - Focus: descendant starts on the same `host.id`, linked by `process.parent.entity_id` or `process.Ext.ancestry`, checking `process.name` and `process.command_line`. $investigate_2
104  - Hint: if entity linkage is absent, match `process.parent.pid` to the alerting `process.pid` within a tight alert-time window and treat matches as weaker.
105  - Hint: after a suspicious descendant, expand that descendant's file and network events from Timeline.
106  - Implication: escalate when descendants show "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "powershell.exe", "pwsh.exe", "schtasks.exe", repeated shells, Microsoft-themed task names, or command-line URLs; lower suspicion when the tree ends at one expected helper with no delayed script or task process.
107
108- If local evidence remains suspicious or unresolved, what related alerts change scope or containment?
109  - Focus: related alerts for the same `user.id`, especially document delivery, script execution, task creation, or outbound staging. $investigate_0
110  - Hint: review same-`host.id` alerts to separate one-host lure execution from repeated activity across assets. $investigate_1
111  - Implication: broaden containment when the same user or host also shows initial-access, script-host, scheduled-task, or outbound-staging alerts; keep response local when those alerts are absent, but leave benign closure to the process-chain synthesis.
112
113- Escalate for lure-driven ".msc" execution, script staging, scheduled-task creation, remote retrieval, or suspicious descendants; close only when alert-local evidence and process recovery bind one exact recognized console workflow with no contradictory descendants; preserve artifacts and escalate when evidence is mixed or visibility incomplete.
114
115### False positive analysis
116
117- Custom administrative consoles, vendor MMC snap-ins, or IT troubleshooting bundles stored outside default Windows console paths can launch helpers, browsers, viewers, or support utilities. Confirm that `process.parent.args`, `process.parent.command_line`, `process.executable`, `process.command_line`, `process.code_signature.subject_name`, `user.id`, and `host.id` all align with one exact console package or affected cohort. If inventory, ticketing, or owner confirmation is unavailable, close only when process and descendant telemetry still prove that helper workflow with no unresolved script, task, hidden execution, or remote-retrieval behavior.
118- Before creating an exception, validate prior alerts from this rule for the same ".msc" path in `process.parent.args`, child `process.executable`, signer in `process.code_signature.subject_name`, stable `process.command_line`, and bounded `user.id` and `host.id` scope. Build the exception from that full workflow pattern; avoid exceptions on `process.parent.name` value "mmc.exe" or the child `process.executable` alone.
119
120### Response and remediation
121
122- If confirmed benign, reverse any temporary containment and document the exact ".msc" path, child command pattern, signer, `user.id`, and `host.id`. Create an exception only after the same workflow pattern recurs consistently across prior alerts from this rule.
123- If suspicious but unconfirmed, preserve a case export for the alerting process instance (`host.id` plus `process.entity_id` or `process.pid` and alert time), the parent MSC path, child and descendant command lines, executable hash/signer, task names, script names, and URLs visible in command lines before making destructive changes. Apply reversible containment first, such as temporary URL/domain blocking, disabling a newly created scheduled task after preserving its command, or heightened monitoring on the affected `host.id` and `user.id`.
124- If confirmed malicious, isolate the host or contain the affected account only after preserving the process chain, scheduled-task names, script names, hashes, and command-line indicators. Terminate malicious child or descendant processes after preservation, block confirmed command-line URLs or domains, and hand off the preserved artifact set if endpoint response is unavailable.
125- Eradicate only the malicious ".msc", scripts, scheduled tasks, and staged payloads identified during the investigation, then remediate the delivery path that let the lure execute. Review related hosts and users for the same `process.parent.args` path or descendant `process.command_line` pattern before broad cleanup.
126- Post-incident hardening: restrict or warn on ".msc" launches from user-writable, download, archive-extraction, or cloud-sync paths, and retain process lineage and command-line telemetry needed to distinguish future admin consoles from MSC lures.
127"""
128
129setup = """## Setup
130
131This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
132
133Setup instructions: https://ela.st/install-elastic-defend
134
135### Additional data sources
136
137This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
138
139- [Microsoft Defender XDR](https://ela.st/m365-defender)
140- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
141- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
142"""
143
144[rule.investigation_fields]
145field_names = [
146    "@timestamp",
147    "host.id",
148    "user.id",
149    "process.entity_id",
150    "process.pid",
151    "process.executable",
152    "process.command_line",
153    "process.code_signature.subject_name",
154    "process.code_signature.trusted",
155    "process.hash.sha256",
156    "process.Ext.session_info.logon_type",
157    "process.Ext.relative_file_creation_time",
158    "process.parent.executable",
159    "process.parent.command_line",
160    "process.parent.args",
161]
162
163[transform]
164
165[[transform.investigate]]
166label = "Alerts associated with the user"
167description = ""
168providers = [
169  [
170    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
171    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
172  ]
173]
174relativeFrom = "now-48h/h"
175relativeTo = "now"
176
177[[transform.investigate]]
178label = "Alerts associated with the host"
179description = ""
180providers = [
181  [
182    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
183    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
184  ]
185]
186relativeFrom = "now-48h/h"
187relativeTo = "now"
188
189[[transform.investigate]]
190label = "Descendant processes from the MMC-launched child"
191description = ""
192providers = [
193  [
194    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
195    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
196    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
197  ],
198  [
199    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
200    { excluded = false, field = "process.parent.pid", queryType = "phrase", value = "{{process.pid}}", valueType = "string" },
201    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
202  ]
203]
204relativeFrom = "now-1h"
205relativeTo = "now"
206
207[[transform.investigate]]
208label = "File and network events for the MMC-launched child"
209description = ""
210providers = [
211  [
212    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
213    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
214    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
215  ],
216  [
217    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
218    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
219    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
220  ]
221]
222relativeFrom = "now-1h"
223relativeTo = "now"
224
225[[rule.threat]]
226framework = "MITRE ATT&CK"
227
228[[rule.threat.technique]]
229id = "T1204"
230name = "User Execution"
231reference = "https://attack.mitre.org/techniques/T1204/"
232
233[[rule.threat.technique.subtechnique]]
234id = "T1204.002"
235name = "Malicious File"
236reference = "https://attack.mitre.org/techniques/T1204/002/"
237
238[rule.threat.tactic]
239id = "TA0002"
240name = "Execution"
241reference = "https://attack.mitre.org/tactics/TA0002/"
242
243[[rule.threat]]
244framework = "MITRE ATT&CK"
245
246[[rule.threat.technique]]
247id = "T1566"
248name = "Phishing"
249reference = "https://attack.mitre.org/techniques/T1566/"
250
251[[rule.threat.technique.subtechnique]]
252id = "T1566.001"
253name = "Spearphishing Attachment"
254reference = "https://attack.mitre.org/techniques/T1566/001/"
255
256[[rule.threat.technique.subtechnique]]
257id = "T1566.002"
258name = "Spearphishing Link"
259reference = "https://attack.mitre.org/techniques/T1566/002/"
260
261[rule.threat.tactic]
262id = "TA0001"
263name = "Initial Access"
264reference = "https://attack.mitre.org/tactics/TA0001/"
265
266[[rule.threat]]
267framework = "MITRE ATT&CK"
268
269[[rule.threat.technique]]
270id = "T1218"
271name = "System Binary Proxy Execution"
272reference = "https://attack.mitre.org/techniques/T1218/"
273
274[[rule.threat.technique.subtechnique]]
275id = "T1218.014"
276name = "MMC"
277reference = "https://attack.mitre.org/techniques/T1218/014/"
278
279[rule.threat.tactic]
280id = "TA0005"
281name = "Defense Evasion"
282reference = "https://attack.mitre.org/tactics/TA0005/"