Persistence via a Windows Installer

 1[metadata]
 2creation_date = "2024/09/05"
 3integration = ["endpoint"]
 4maturity = "production"
 5updated_date = "2024/09/05"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies when the Windows installer process msiexec.exe creates a new persistence entry via scheduled tasks or startup.
11"""
12false_positives = ["Legitimate scheduled tasks may be created during installation of new software."]
13from = "now-9m"
14index = [
15    "logs-endpoint.events.registry-*",
16    "logs-endpoint.events.file-*"
17]
18language = "eql"
19license = "Elastic License v2"
20name = "Persistence via a Windows Installer"
21risk_score = 47
22rule_id = "1719ee47-89b8-4407-9d55-6dff2629dd4c"
23severity = "medium"
24tags = [
25    "Domain: Endpoint",
26    "OS: Windows",
27    "Use Case: Threat Detection",
28    "Tactic: Persistence",
29    "Tactic: Defense Evasion",
30    "Data Source: Elastic Defend",
31]
32timestamp_override = "event.ingested"
33type = "eql"
34
35query = '''
36any where host.os.type == "windows" and 
37 (process.name : "msiexec.exe" or Effective_process.name : "msiexec.exe") and
38 (
39  (event.category == "file" and event.action == "creation" and
40   file.path : ("?:\\Windows\\System32\\Tasks\\*",
41                "?:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\*",
42                "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")) or
43
44  (event.category == "registry" and event.action == "modification" and
45   registry.path : ("H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
46                    "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
47                    "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
48                    "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*"))
49  )
50'''
51
52
53[[rule.threat]]
54framework = "MITRE ATT&CK"
55[[rule.threat.technique]]
56id = "T1053"
57name = "Scheduled Task/Job"
58reference = "https://attack.mitre.org/techniques/T1053/"
59[[rule.threat.technique.subtechnique]]
60id = "T1053.005"
61name = "Scheduled Task"
62reference = "https://attack.mitre.org/techniques/T1053/005/"
63
64[rule.threat.tactic]
65id = "TA0003"
66name = "Persistence"
67reference = "https://attack.mitre.org/tactics/TA0003/"
68
69
70[[rule.threat]]
71framework = "MITRE ATT&CK"
72[[rule.threat.technique]]
73id = "T1218"
74name = "System Binary Proxy Execution"
75reference = "https://attack.mitre.org/techniques/T1218/"
76[[rule.threat.technique.subtechnique]]
77id = "T1218.007"
78name = "Msiexec"
79reference = "https://attack.mitre.org/techniques/T1218/007/"
80
81[rule.threat.tactic]
82id = "TA0005"
83name = "Defense Evasion"
84reference = "https://attack.mitre.org/tactics/TA0005/"