mirror of
https://github.com/Karma-X-Inc/protections-artifacts
synced 2026-06-08 11:28:09 +00:00
protectionsmachine
116 lines
6.0 KiB
TOML
116 lines
6.0 KiB
TOML
[rule]
|
|
description = """
|
|
Identifies the execution of the Windows Command Shell process (cmd.exe) with suspicious argument values. This behavior
|
|
is often observed during malware installation.
|
|
"""
|
|
id = "8dd7588d-fc28-40c0-adfb-14789c763984"
|
|
license = "Elastic License v2"
|
|
name = "Suspicious Windows Command Shell Execution"
|
|
os_list = ["windows"]
|
|
version = "1.0.32"
|
|
|
|
query = '''
|
|
process where event.action == "start" and
|
|
(process.name : "cmd.exe" or process.pe.original_file_name == "Cmd.Exe") and not user.id : "S-1-5-18" and
|
|
(
|
|
|
|
process.command_line : ("*).Run(*", "*GetObject*", "* curl*regsvr32*", "*echo*wscript*", "*echo*ZONE.identifier*",
|
|
"*ActiveXObject*", "*dir /s /b *echo*", "*unescape(*", "*findstr*TVNDRgAAAA*", "*findstr*passw*", "*start*\\\\*\\DavWWWRoot\\*",
|
|
"* explorer*%CD%*", "*%cd%\\*.js*", "*attrib*%CD%*", "*/?cMD<*", "*/AutoIt3ExecuteScript*..*", "*&cls&cls&cls&cls&cls&*",
|
|
"*&#*;&#*;&#*;&#*;*", "* &&s^eT*", "*& ChrW(*", "*&explorer /root*", "*start __ & __\\*", "*findstr /V /L *forfiles*",
|
|
"*=wscri& set *") or
|
|
|
|
(process.args_count == 3 and process.args : "%*%" and process.args:"/c") or
|
|
|
|
(process.args : "echo" and process.parent.name : ("wscript.exe", "mshta.exe")) or
|
|
|
|
process.args : ("1>?:\\*.vbs", "1>?:\\*.js") or
|
|
|
|
(process.args : "explorer.exe" and process.args : "type" and process.args : ">" and process.args : "start")
|
|
|
|
) and
|
|
|
|
/* false positives */
|
|
not (process.args : "%TEMP%\\Spiceworks\\*" and process.parent.name : "wmiprvse.exe") and
|
|
not process.parent.executable :
|
|
("?:\\Perl64\\bin\\perl.exe",
|
|
"?:\\Program Files\\nodejs\\node.exe",
|
|
"E:\\eGov\\eGovXtract.exe",
|
|
"?:\\Program Files\\HP\\RS\\pgsql\\bin\\pg_dumpall.exe",
|
|
"?:\\Program Files (x86)\\PRTG Network Monitor\\64 bit\\PRTG Server.exe",
|
|
"?:\\Program Files (x86)\\Spiceworks\\bin\\spiceworks-finder.exe",
|
|
"?:\\Program Files (x86)\\Zuercher Suite\\production\\leds\\leds.exe",
|
|
"?:\\Program Files\\Tripwire\\Agent\\Plugins\\twexec\\twexec.exe",
|
|
"D:\\Agents\\?\\_work\\_tasks\\*\\SonarScanner.MSBuild.exe",
|
|
"?:\\reps\\inventory\\.nodejs\\node\\node.exe",
|
|
"?:\\Program Files\\Microsoft VS Code\\Code.exe",
|
|
"?:\\Users\\*\\node.exe",
|
|
"?:\\nodejs\\node.exe",
|
|
"?:\\*\\.nodejs\\node\\node.exe",
|
|
"?:\\programmiweb\\NetBeans-*\\netbeans\\bin\\netbeans64.exe",
|
|
"?:\\Users\\*\\AppData\\Local\\Zuercher Suite\\production\\leds\\leds.exe",
|
|
"?:\\Program Files (x86)\\Public Safety Suite Professional\\production\\leds\\leds.exe",
|
|
"?:\\Program Files (x86)\\Tier2Tickets\\button_gui.exe",
|
|
"?:\\Program Files\\NetBeans-*\\netbeans\\bin\\netbeans*.exe",
|
|
"?:\\Program Files (x86)\\Public Safety Suite Professional\\production\\leds\\leds.exe",
|
|
"?:\\Program Files (x86)\\Tier2Tickets\\button_gui.exe",
|
|
"?:\\Program Files (x86)\\Helpdesk Button\\button_gui.exe",
|
|
"?:\\VTSPortable\\VTS\\jre\\bin\\javaw.exe",
|
|
"?:\\Program Files\\Bot Framework Composer\\Bot Framework Composer.exe",
|
|
"?:\\Users\\*\\AppData\\Local\\Programs\\*electron\\AXIS Device Manager Extend.exe",
|
|
"?:\\Users\\*\\AppData\\Local\\Programs\\Arduino IDE\\Arduino IDE.exe",
|
|
"?:\\Program Files\\KMSYS Worldwide\\eQuate\\*\\SessionMgr.exe",
|
|
"?:\\Program Files (x86)\\Craneware\\Pricing Analyzer\\Craneware.Pricing.Shell.exe",
|
|
"?:\\sonarqube\\MSBuild\\SonarScanner.MSBuild.exe",
|
|
"?:\\Program Files (x86)\\jumpcloud-agent-app\\jumpcloud-agent-app.exe",
|
|
"?:\\Program Files\\PostgreSQL\\*\\bin\\pg_dumpall.exe",
|
|
"?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
|
|
"?:\\Program Files (x86)\\Vim\\vim*\\vimrun.exe") and
|
|
not (process.args : "console|findstr" and process.parent.name : "cmd.exe") and
|
|
not process.working_directory : "?:\\Program Files (x86)\\Spiceworks\\" and
|
|
not (process.parent.name : "wscript.exe" and
|
|
process.parent.args : ("D:\\intersystems\\hsfoundation\\databases\\data\\ELSAInfoServer.vbs", "\\\\*\\NETLOGON\\*")) and
|
|
not (process.parent.name : ("pwsh.exe", "powershell.exe") and process.args : "start" and
|
|
process.args : "https://login.microsoftonline.com/*") and
|
|
not (process.args : "?:\\Program Files\\Citrix\\Secure Access Client\\nsauto.exe" and process.parent.name : "userinit.exe") and
|
|
not process.args :
|
|
("?:\\Program Files (x86)\\PCMatic\\PCPitstopScheduleService.exe",
|
|
"?:\\Program Files (x86)\\AllesTechnologyAgent\\*",
|
|
"https://auth.axis.com/oauth2/oauth-authorize*",
|
|
"D:\\GitHub\\lilitech-cloud-app\\node_modules\\.bin\\*",
|
|
"*--flat-playlist^*--no-cache-dir^*") and
|
|
not process.command_line : "?:\\Windows\\system32\\cmd.exe /q /d /s /c \"npm.cmd ^\"install^\" ^\"--no-bin-links^\" ^\"--production^\"\"" and
|
|
not (process.name : "cmd.exe" and process.args : "%TEMP%\\Spiceworks\\*" and process.args : "http*/dataloader/persist_netstat_data") and
|
|
not process.parent.command_line : "cmd /q /k prompt MAM:Remote$G" and
|
|
not process.parent.args : "C:\\WINDOWS\\Runtime\\utility\\wrapper.vbs" and
|
|
not (process.parent.name : "wscript.exe" and process.parent.args : "C:\\IBM\\ITM\\TMAITM6_x64\\K06_uninstall.vbs")
|
|
'''
|
|
|
|
min_endpoint_version = "7.15.0"
|
|
optional_actions = []
|
|
[[actions]]
|
|
action = "kill_process"
|
|
field = "process.entity_id"
|
|
state = 0
|
|
|
|
[[threat]]
|
|
framework = "MITRE ATT&CK"
|
|
[[threat.technique]]
|
|
id = "T1059"
|
|
name = "Command and Scripting Interpreter"
|
|
reference = "https://attack.mitre.org/techniques/T1059/"
|
|
[[threat.technique.subtechnique]]
|
|
id = "T1059.003"
|
|
name = "Windows Command Shell"
|
|
reference = "https://attack.mitre.org/techniques/T1059/003/"
|
|
|
|
|
|
|
|
[threat.tactic]
|
|
id = "TA0002"
|
|
name = "Execution"
|
|
reference = "https://attack.mitre.org/tactics/TA0002/"
|
|
|
|
[internal]
|
|
min_endpoint_version = "7.15.0"
|