Ingress Tool Transfer via INET Cache

[rule]
description = """
Identifies the use of a signed utility that takes a remote URL as a process argument or no arguments at all followed by
the creation of an executable file in the INetCache Folder. Adversaries may use trusted utilities to download extra
payloads to avoid ingress tool transfer restrictions.
"""
id = "bd4d88c1-466e-4591-9c81-f2d257dbc9db"
license = "Elastic License v2"
name = "Ingress Tool Transfer via INET Cache"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1105/",
    "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
]
version = "1.0.7"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and 
  process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft*" and 
  (process.command_line : "*http*" or (process.executable : "?:\\Windows\\*" and process.args_count <= 1)) and 
  not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
  not (process.name : "rundll32.exe" and process.args : "C:\\Windows\\System32\\rundll32.exe  C:\\Windows\\System32\\LogiLDA.dll,LogiFetch")]
 [file where event.action!= "deletion" and file.path : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*" and 
  (file.Ext.header_bytes : "4d5a*" or 
   file.extension : ("exe", "pif", "scr", "dll", "cpl", "bat", "cmd", "hta"))]
'''

min_endpoint_version = "8.0.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.0.0"