Suspicious Explorer Child Process
Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or executables from a trusted parent process.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/10/29"
3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
4maturity = "production"
5updated_date = "2024/10/15"
6min_stack_version = "8.14.0"
7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
8
9[rule]
10author = ["Elastic"]
11description = """
12Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or
13executables from a trusted parent process.
14"""
15from = "now-9m"
16index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-m365_defender.event-*", "logs-sentinel_one_cloud_funnel.*"]
17language = "eql"
18license = "Elastic License v2"
19name = "Suspicious Explorer Child Process"
20risk_score = 47
21rule_id = "9a5b4e31-6cde-4295-9ff7-6be1b8567e1b"
22severity = "medium"
23tags = [
24 "Domain: Endpoint",
25 "OS: Windows",
26 "Use Case: Threat Detection",
27 "Tactic: Initial Access",
28 "Tactic: Defense Evasion",
29 "Tactic: Execution",
30 "Data Source: Elastic Endgame",
31 "Data Source: Elastic Defend",
32 "Data Source: Sysmon",
33 "Data Source: Microsoft Defender for Endpoint",
34 "Data Source: SentinelOne",
35]
36timestamp_override = "event.ingested"
37type = "eql"
38
39query = '''
40process where host.os.type == "windows" and event.type == "start" and
41 (
42 process.name : ("cscript.exe", "wscript.exe", "powershell.exe", "rundll32.exe", "cmd.exe", "mshta.exe", "regsvr32.exe") or
43 ?process.pe.original_file_name in ("cscript.exe", "wscript.exe", "PowerShell.EXE", "RUNDLL32.EXE", "Cmd.Exe", "MSHTA.EXE", "REGSVR32.EXE")
44 ) and
45 /* Explorer started via DCOM */
46 process.parent.name : "explorer.exe" and process.parent.args : "-Embedding" and
47 not process.parent.args:
48 (
49 /* Noisy CLSID_SeparateSingleProcessExplorerHost Explorer COM Class IDs */
50 "/factory,{5BD95610-9434-43C2-886C-57852CC8A120}",
51 "/factory,{ceff45ee-c862-41de-aee2-a022c81eda92}"
52 )
53'''
54
55
56[[rule.threat]]
57framework = "MITRE ATT&CK"
58[[rule.threat.technique]]
59id = "T1566"
60name = "Phishing"
61reference = "https://attack.mitre.org/techniques/T1566/"
62[[rule.threat.technique.subtechnique]]
63id = "T1566.001"
64name = "Spearphishing Attachment"
65reference = "https://attack.mitre.org/techniques/T1566/001/"
66
67[[rule.threat.technique.subtechnique]]
68id = "T1566.002"
69name = "Spearphishing Link"
70reference = "https://attack.mitre.org/techniques/T1566/002/"
71
72
73
74[rule.threat.tactic]
75id = "TA0001"
76name = "Initial Access"
77reference = "https://attack.mitre.org/tactics/TA0001/"
78[[rule.threat]]
79framework = "MITRE ATT&CK"
80[[rule.threat.technique]]
81id = "T1059"
82name = "Command and Scripting Interpreter"
83reference = "https://attack.mitre.org/techniques/T1059/"
84[[rule.threat.technique.subtechnique]]
85id = "T1059.001"
86name = "PowerShell"
87reference = "https://attack.mitre.org/techniques/T1059/001/"
88
89[[rule.threat.technique.subtechnique]]
90id = "T1059.003"
91name = "Windows Command Shell"
92reference = "https://attack.mitre.org/techniques/T1059/003/"
93
94[[rule.threat.technique.subtechnique]]
95id = "T1059.005"
96name = "Visual Basic"
97reference = "https://attack.mitre.org/techniques/T1059/005/"
98
99
100
101[rule.threat.tactic]
102id = "TA0002"
103name = "Execution"
104reference = "https://attack.mitre.org/tactics/TA0002/"
105[[rule.threat]]
106framework = "MITRE ATT&CK"
107[[rule.threat.technique]]
108id = "T1218"
109name = "System Binary Proxy Execution"
110reference = "https://attack.mitre.org/techniques/T1218/"
111
112
113[rule.threat.tactic]
114id = "TA0005"
115name = "Defense Evasion"
116reference = "https://attack.mitre.org/tactics/TA0005/"
Related rules
- Command Shell Activity Started via RunDLL32
- Conhost Spawned By Suspicious Parent Process
- Execution from Unusual Directory - Command Line
- Microsoft Exchange Worker Spawning Suspicious Processes
- Scheduled Tasks AT Command Enabled