Suspicious Executable File Creation

[rule]
description = """
Identifies the creation of an executable file by a signed Microsoft binary proxy utility such as MSHTA.exe, CertReq.exe,
CertUtil.exe or Common Microsoft Documents processes like WinWord and Excel.
"""
id = "37c54ca7-e96d-4fd5-92d3-08cab38516b7"
license = "Elastic License v2"
name = "Suspicious Executable File Creation"
os_list = ["windows"]
version = "1.0.26"

query = '''
file where event.action != "deletion" and not user.id : "S-1-5-18" and

 (file.extension : ("exe", "pif", "scr", "iso", "rar", "zip", "7z", "img", "vhd", "js", "vbs", "wsh", "hta",
                    "cpl", "jse", "vbe", "cmd", "dll") or

  file.Ext.header_bytes : ("4d5a*", "TVqQ*", "406563686F*", "3c736372697074206c616e6775616765", "76617220*")) and

 (
   process.name : ("CertUtil.exe", "CertReq.exe") or

   (process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and
   file.path :
       ("?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*",
        "?:\\Users\\Public\\*",
        "?:\\ProgramData\\*",
        "?:\\Users\\Public\\*",
        "?:\\Users\\*\\Documents\\*",
        "?:\\Users\\*\\Pictures\\*",
        "?:\\Users\\*\\Music\\*",
        "?:\\Users\\*\\Pictures\\*",
        "?:\\Windows\\Tasks\\*",
        "?:\\Windows\\System32\\tasks\\*"))
  ) and

  /* MS Office often downloads js file types in the INETCache folder */
  not (file.extension : "js" and process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and
       file.path : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" and

       /* avoid bypass via fake js file extension */
       not file.Ext.header_bytes : ("4d5a*", "TVqQ*", "406563686F*")) and

  not (file.extension : ("zip", "rar", "7z") and process.executable : "?:\\Program Files*\\Microsoft Office\\*.exe" and
       not file.Ext.header_bytes : ("4d5a*", "TVqQ*", "406563686F*")) and
  not (process.name : ("winword.exe", "POWERPNT.EXE") and file.path : "C:\\ProgramData\\CanonIJFAX\\*\\CNCARGU.DLL") and
  not (process.name : "POWERPNT.EXE" and file.extension :("dll", "tmp") and
       file.path : ("C:\\ProgramData\\UpSlide\\UnpackBinaries\\*", "c:\\programdata\\seagull\\drivers\\temp\\*.tmp")) and
  not (process.name : "certutil.exe" and
       file.path : ("?:\\Windows\\Installer\\*",
                    "?:\\Program Files\\Sales Pro Suite*.exe",
                    "?:\\Users\\*\\AppData\\Local\\Packages\\microsoft.windows.search_*\\AC\\AppCache\\*.js")) and
  not (process.name : ("excel.exe", "winword.exe") and
       file.path : ("?:\\ProgramData\\Seagull\\Drivers\\Temp\\ss#*.tmp",
                    "C:\\ProgramData\\SafeNet Sentinel\\Sentinel RMS Development Kit\\System\\*.dll",
                    "?:\\ProgramData\\TeamMate\\Integration\\*",
                    "?:\\ProgramData\\FactSet\\OnlineComponents\\*",
                    "?:\\ProgramData\\UpSlide\\UnpackBinaries\\*.dll",
                    "C:\\ProgramData\\Agilent\\Temp\\tmp*.tmp",
                    "?:\\ProgramData\\TeamMate\\*",
                    "?:\\ProgramData\\Sophos\\AutoUpdate\\*",
                    "C:\\Users\\Public\\Tegus Toolkit Addin\\Downloads\\Installation\\Application Files\\CanalystToolkitAddin_*"))
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.16.0"