Execution of Persistent Suspicious Program

  1[metadata]
  2creation_date = "2020/11/19"
  3integration = ["endpoint", "windows"]
  4maturity = "production"
  5updated_date = "2025/01/15"
  6min_stack_version = "8.14.0"
  7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and
 13command line usage.
 14"""
 15from = "now-9m"
 16index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "Execution of Persistent Suspicious Program"
 20risk_score = 47
 21rule_id = "e7125cea-9fe1-42a5-9a05-b0792cf86f5a"
 22severity = "medium"
 23tags = [
 24    "Domain: Endpoint",
 25    "OS: Windows",
 26    "Use Case: Threat Detection",
 27    "Tactic: Persistence",
 28    "Data Source: Elastic Endgame",
 29    "Data Source: Elastic Defend",
 30    "Data Source: Sysmon",
 31    "Resources: Investigation Guide",
 32]
 33type = "eql"
 34
 35query = '''
 36/* userinit followed by explorer followed by early child process of explorer (unlikely to be launched interactively) within 1m */
 37sequence by host.id, user.name with maxspan=1m
 38  [process where host.os.type == "windows" and event.type == "start" and process.name : "userinit.exe" and process.parent.name : "winlogon.exe"]
 39  [process where host.os.type == "windows" and event.type == "start" and process.name : "explorer.exe"]
 40  [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "explorer.exe" and
 41   /* add suspicious programs here */
 42   process.pe.original_file_name in ("cscript.exe",
 43                                     "wscript.exe",
 44                                     "PowerShell.EXE",
 45                                     "MSHTA.EXE",
 46                                     "RUNDLL32.EXE",
 47                                     "REGSVR32.EXE",
 48                                     "RegAsm.exe",
 49                                     "MSBuild.exe",
 50                                     "InstallUtil.exe") and
 51    /* add potential suspicious paths here */
 52    process.args : ("C:\\Users\\*", "C:\\ProgramData\\*", "C:\\Windows\\Temp\\*", "C:\\Windows\\Tasks\\*", "C:\\PerfLogs\\*", "C:\\Intel\\*")
 53   ]
 54'''
 55note = """## Triage and analysis
 56
 57> **Disclaimer**:
 58> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 59
 60### Investigating Execution of Persistent Suspicious Program
 61
 62Persistent programs, like scripts or rundll32, are often used by adversaries to maintain access to a system. These programs can be executed at startup, leveraging process lineage and command line arguments to evade detection. The detection rule identifies suspicious executions by monitoring the sequence of processes initiated after user logon, focusing on known malicious executables and unusual file paths, thus highlighting potential abuse of persistence mechanisms.
 63
 64### Possible investigation steps
 65
 66- Review the process lineage to confirm the sequence of userinit.exe, explorer.exe, and the suspicious child process. Verify if the child process was indeed launched shortly after user logon.
 67- Examine the command line arguments of the suspicious process to identify any unusual or malicious patterns, especially those involving known suspicious paths like C:\\Users\\*, C:\\ProgramData\\*, or C:\\Windows\\Temp\\*.
 68- Check the original file name of the suspicious process against known malicious executables such as cscript.exe, wscript.exe, or PowerShell.EXE to determine if it matches any of these.
 69- Investigate the parent process explorer.exe to ensure it was not compromised or manipulated to launch the suspicious child process.
 70- Analyze the user account associated with the suspicious process to determine if it has been involved in any other suspicious activities or if it has elevated privileges that could be exploited.
 71- Review recent system changes or installations that might have introduced the suspicious executable or altered startup configurations.
 72
 73### False positive analysis
 74
 75- Legitimate administrative scripts or tools may trigger alerts if they are executed from common directories like C:\\Users or C:\\ProgramData. To manage this, create exceptions for known administrative scripts that are regularly used in your environment.
 76- Software updates or installations might use processes like PowerShell or RUNDLL32, leading to false positives. Identify and exclude these processes when they are part of a verified update or installation routine.
 77- Custom scripts or automation tasks that run at startup could be flagged. Document these tasks and exclude them from the rule if they are part of normal operations.
 78- Security or monitoring tools that use similar execution patterns may be mistakenly identified. Verify these tools and add them to an exclusion list to prevent unnecessary alerts.
 79- User-initiated actions that mimic suspicious behavior, such as running scripts from the command line, can cause false positives. Educate users on safe practices and adjust the rule to exclude known benign user actions.
 80
 81### Response and remediation
 82
 83- Isolate the affected host from the network to prevent further spread or communication with potential command and control servers.
 84- Terminate any suspicious processes identified in the alert, such as those executed by cscript.exe, wscript.exe, PowerShell.EXE, MSHTA.EXE, RUNDLL32.EXE, REGSVR32.EXE, RegAsm.exe, MSBuild.exe, or InstallUtil.exe.
 85- Remove any unauthorized or suspicious startup entries or scheduled tasks that may have been created to ensure persistence.
 86- Conduct a thorough scan of the system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malicious files or remnants.
 87- Review and restore any modified system configurations or registry settings to their default or secure state.
 88- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems are affected.
 89- Implement enhanced monitoring and logging for the affected host and similar systems to detect any recurrence or related suspicious activities."""
 90
 91
 92[[rule.threat]]
 93framework = "MITRE ATT&CK"
 94[[rule.threat.technique]]
 95id = "T1547"
 96name = "Boot or Logon Autostart Execution"
 97reference = "https://attack.mitre.org/techniques/T1547/"
 98[[rule.threat.technique.subtechnique]]
 99id = "T1547.001"
100name = "Registry Run Keys / Startup Folder"
101reference = "https://attack.mitre.org/techniques/T1547/001/"
102
103
104
105[rule.threat.tactic]
106id = "TA0003"
107name = "Persistence"
108reference = "https://attack.mitre.org/tactics/TA0003/"