Suspicious Explorer Child Process

  1[metadata]
  2creation_date = "2020/10/29"
  3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2024/10/15"
  6min_stack_version = "8.14.0"
  7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or
 13executables from a trusted parent process.
 14"""
 15from = "now-9m"
 16index = ["logs-endpoint.events.process-*", "winlogbeat-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-m365_defender.event-*", "logs-sentinel_one_cloud_funnel.*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "Suspicious Explorer Child Process"
 20risk_score = 47
 21rule_id = "9a5b4e31-6cde-4295-9ff7-6be1b8567e1b"
 22severity = "medium"
 23tags = [
 24    "Domain: Endpoint",
 25    "OS: Windows",
 26    "Use Case: Threat Detection",
 27    "Tactic: Initial Access",
 28    "Tactic: Defense Evasion",
 29    "Tactic: Execution",
 30    "Data Source: Elastic Endgame",
 31    "Data Source: Elastic Defend",
 32    "Data Source: Sysmon",
 33    "Data Source: Microsoft Defender for Endpoint",
 34    "Data Source: SentinelOne",
 35]
 36timestamp_override = "event.ingested"
 37type = "eql"
 38
 39query = '''
 40process where host.os.type == "windows" and event.type == "start" and
 41  (
 42   process.name : ("cscript.exe", "wscript.exe", "powershell.exe", "rundll32.exe", "cmd.exe", "mshta.exe", "regsvr32.exe") or
 43   ?process.pe.original_file_name in ("cscript.exe", "wscript.exe", "PowerShell.EXE", "RUNDLL32.EXE", "Cmd.Exe", "MSHTA.EXE", "REGSVR32.EXE")
 44  ) and
 45  /* Explorer started via DCOM */
 46  process.parent.name : "explorer.exe" and process.parent.args : "-Embedding" and
 47  not process.parent.args:
 48          (
 49            /* Noisy CLSID_SeparateSingleProcessExplorerHost Explorer COM Class IDs   */
 50            "/factory,{5BD95610-9434-43C2-886C-57852CC8A120}",
 51            "/factory,{ceff45ee-c862-41de-aee2-a022c81eda92}"
 52          )
 53'''
 54
 55
 56[[rule.threat]]
 57framework = "MITRE ATT&CK"
 58[[rule.threat.technique]]
 59id = "T1566"
 60name = "Phishing"
 61reference = "https://attack.mitre.org/techniques/T1566/"
 62[[rule.threat.technique.subtechnique]]
 63id = "T1566.001"
 64name = "Spearphishing Attachment"
 65reference = "https://attack.mitre.org/techniques/T1566/001/"
 66
 67[[rule.threat.technique.subtechnique]]
 68id = "T1566.002"
 69name = "Spearphishing Link"
 70reference = "https://attack.mitre.org/techniques/T1566/002/"
 71
 72
 73
 74[rule.threat.tactic]
 75id = "TA0001"
 76name = "Initial Access"
 77reference = "https://attack.mitre.org/tactics/TA0001/"
 78[[rule.threat]]
 79framework = "MITRE ATT&CK"
 80[[rule.threat.technique]]
 81id = "T1059"
 82name = "Command and Scripting Interpreter"
 83reference = "https://attack.mitre.org/techniques/T1059/"
 84[[rule.threat.technique.subtechnique]]
 85id = "T1059.001"
 86name = "PowerShell"
 87reference = "https://attack.mitre.org/techniques/T1059/001/"
 88
 89[[rule.threat.technique.subtechnique]]
 90id = "T1059.003"
 91name = "Windows Command Shell"
 92reference = "https://attack.mitre.org/techniques/T1059/003/"
 93
 94[[rule.threat.technique.subtechnique]]
 95id = "T1059.005"
 96name = "Visual Basic"
 97reference = "https://attack.mitre.org/techniques/T1059/005/"
 98
 99
100
101[rule.threat.tactic]
102id = "TA0002"
103name = "Execution"
104reference = "https://attack.mitre.org/tactics/TA0002/"
105[[rule.threat]]
106framework = "MITRE ATT&CK"
107[[rule.threat.technique]]
108id = "T1218"
109name = "System Binary Proxy Execution"
110reference = "https://attack.mitre.org/techniques/T1218/"
111
112
113[rule.threat.tactic]
114id = "TA0005"
115name = "Defense Evasion"
116reference = "https://attack.mitre.org/tactics/TA0005/"