Connection to a Suspicious URL

[rule]
description = """
Identifies when a Windows scripting utility or a program running from a world writable directory attempts to connect to
a suspicious URL. This behavior may indicate the presence of a malware command and control activity.
"""
id = "a6befb1f-b1d8-4e64-80fb-fca43cdcee98"
license = "Elastic License v2"
name = "Connection to a Suspicious URL"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1071/"]
version = "1.0.4"

query = '''
api where process.Ext.api.name in ("InternetOpenURL", "WinHttpOpenRequest") and
 (
  process.name : ("wscript.exe", "mshta.exe", "powershell.exe") or
  (process.executable : ("?:\\ProgramData\\*", "?:\\Users\\*\\AppData\\*", "?:\\Users\\Public\\*", "?:\\Users\\Downloads\\*") and
   process.code_signature.trusted != true)
 ) and
 url.full : ("http*.php", "http*.php/*", "http*.php\\*", "http*/wp-content/*", "http*\\wp-content\\*") and
 not url.full : ("https://zeek.org/wp-content/*", "https://*.wp.com/*", "http://stat.eliang.com/cstat.php", "http*.foxitservice.com/*")
'''

min_endpoint_version = "9.2.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "9.2.0"