Binary Masquerading via Untrusted Path

[rule]
description = """
Identifies binaries that have been identically named to Windows built-in programs and being run from untrusted or
commonly abused paths. Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate
or benign.
"""
id = "35dedf0c-8db6-4d70-b2dc-a133b808211f"
license = "Elastic License v2"
name = "Binary Masquerading via Untrusted Path"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine",
    "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
]
version = "1.0.55"

query = '''
process where event.action == "start" and
  (
   process.name : (
    "at.exe",
    "atbroker.exe",
    "bcdedit.exe",
    "cmstp.exe",
    "conhost.exe",
    "control.exe",
    "cscript.exe",
    "csrss.exe",
    "dsget.exe",
    "dfsvc.exe",
    "dllhost.exe",
    "eventvwr.exe",
    "ieexec.exe",
    "ipconfig.exe",
    "lsass.exe",
    "Microsoft.Workflow.Compiler.exe",
    "mmc.exe",
    "msdt.exe",
    "mshta.exe",
    "msiexec.exe",
    "net1.exe",
    "netsh.exe",
    "netstat.exe",
    "odbcconf.exe",
    "ping.exe",
    "powershell.exe",
    "qprocess.exe",
    "quser.exe",
    "qwinsta.exe",
    "regsvcs.exe",
    "rundll32.exe",
    "schtasks.exe",
    "sdclt.exe",
    "services.exe",
    "spoolsv.exe",
    "svchost.exe",
    "taskhost.exe",
    "taskhostw.exe",
    "userinit.exe",
    "vaultcmd.exe",
    "vssadmin.exe",
    "wininit.exe",
    "winlogon.exe",
    "wmic.exe",
    "wevtutil.exe",
    "wscript.exe",
    "gprslt.exe",
    "nbtstat.exe",
    "systeminfo.exe",
    "VsJITDebugger.exe",
    "extexport.exe",
    "extexport.exe", 
    "fltmc.exe", 
    "stordiag.exe", 
    "manage-bde.exe") or
    (process.pe.original_file_name == "bsdtar" and process.name : "tar.exe" and process.code_signature.subject_name == "Microsoft Windows") or
    (process.pe.original_file_name : "WerFaultSecure.exe" or process.name : "WerFaultSecure.exe") or
    (process.pe.original_file_name : "WerFault.exe" or process.name : "WerFault.exe") or
    (process.pe.original_file_name : "wermgr.exe" or process.name : "wermgr.exe") or
    (process.pe.original_file_name : "IE4UINIT.EXE" or process.name : "ie4uinit.exe") or
    (process.pe.original_file_name == "curl.exe" and process.code_signature.subject_name : "Microsoft *" and process.executable : "C:\\Users\\*")
    )
    and
    
  not process.executable : (
    "?:\\Windows\\System32\\*.exe",
    "?:\\Windows\\SysWOW64\\*.exe",
    "?:\\Windows\\Microsoft.NET\\*.exe",
    "?:\\Program Files (x86)\\*.exe",
    "?:\\Program Files\\*.exe",
    "?:\\Windows\\WinSxS\\*.exe",
    "C:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\wow64_microsoft-windows-*\\mmc.exe",
    "C:\\Windows\\SoftwareDistribution\\Download\\*.exe",

    /* Issue # 295 */
    "?:\\Users\\*\\AppData\\Local\\Programs\\Git\\usr\\bin\\hostname.exe",
    "?:\\*\\usr\\bin\\hostname.exe",
    "?:\\ProgramData\\West Wind Technologies\\Uninstall\\*\\regsvr32.exe",
    "?:\\ProgramData\\chocolatey\\*.exe",
    "?:\\cygwin*\\bin\\*.exe",

    /* PR #685 */
    "\\Device\\HarddiskVolume*\\Windows\\System32\\*.exe",
    "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\*.exe",
    "\\Device\\HarddiskVolume*\\Windows\\Microsoft.NET\\*.exe",
    "\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
    "\\Device\\HarddiskVolume*\\Program Files\\*.exe",

    /* VHD */
    "\\Device\\VhdHardDisk*\\Windows\\System32\\*.exe",
    "\\Device\\VhdHardDisk*\\Windows\\SysWOW64\\*.exe",
    "\\Device\\VhdHardDisk*\\Windows\\Microsoft.NET\\*.exe",
    "\\Device\\VhdHardDisk*\\Program Files (x86)\\*.exe",
    "\\Device\\VhdHardDisk*\\Program Files\\*.exe",
    
    "\\\\?\\Volume{*}\\Windows\\System32\\*.exe", 
    "\\\\?\\Volume{*}\\Windows\\SysWOW64\\*.exe", 
    "\\\\?\\Volume{*}\\Windows\\Microsoft.NET\\*.exe",
    "\\\\?\\Volume{*}\\Program Files (x86)\\*.exe",
    "\\\\?\\Volume{*}\\Program Files\\*.exe", 
    "\\\\?\\Volume{*}\\Windows\\WinSxS\\*.exe"
    ) and

  not (process.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\*.exe" and process.code_signature.subject_name : "Lenovo") and
  not (process.pe.original_file_name == "RegAsm.exe" and
       process.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\*\\RegAsm.exe") and
  not (process.name : "regsvr32.exe" and process.parent.executable : ("?:\\ERPU\\Browser\\AutoUpgrade.exe", "?:\\ERPU\\Browser\\NeoWeb.exe")) and
  not (process.executable : "?:\\Campus\\System\\DLL\\CADability\\RegAsm.exe" and process.parent.executable : "?:\\Campus\\System\\DLL\\CADability\\RegCADability.exe") and
  not (process.name : "services.exe" and process.args : "-i*" and process.parent.name : "monitor.exe") and
  not (process.name : "RegAsm.exe" and process.args : ("directdeposit.vb.tlb", "?:\\Program Files (x86)\\*.dll", "?:\\Program Files\\*.dll")) and
  not process.executable : "D:\\Reform V*\\Reform_PDC_Server_v*\\Plugins\\Monitoring\\CScript.exe" and
  not (process.name : "rundll32.exe" and process.code_signature.subject_name : ("Teramind Inc.", "STAKHANOVETS LIMITED LIABILITY COMPANY") and process.code_signature.trusted == true) and
  not (process.name : "regsvr32.exe" and
       process.args : ("?:\\Sage\\Sage300 Programs\\GL69A\\FRCOM690.DLL",
                       "?:\\Program Files (x86)\\*.dll",
                       "?:\\Program Files\\*.dll",
                       "?:\\WINDOWS\\system32\\*.dll")) and
  not process.executable : ("?:\\Microsoft Visual Studio\\*\\Msbuild.exe", "?:\\adv\\app\\RegAsm.exe", "?:\\Windows\\WinSxS\\wow64_microsoft-windows*management-console_*\\mmc.exe") and
  not (process.executable : "?:\\Engeman\\RegAsm.exe" and process.parent.executable : "?:\\Engeman\\Engeman.exe") and
  not (process.name : "regsvr32.exe" and process.code_signature.subject_name == "Tarma Software Research Ltd" and process.code_signature.trusted == true) and
  not (process.parent.executable : "?:\\Gb\\GBsoftware.exe" and process.executable : "?:\\Gb\\Lib\\regsvr32.exe") and
  not (process.executable : "?:\\OfficeMate\\REGSVR32.EXE" and process.parent.args : "?:\\OfficeMate\\~Reg*DLLs.bat" and process.parent.name : "cmd.exe") and
  not (process.name : "powershell.exe" and process.executable : "?:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-exe_*\\powershell.exe") and
  not process.executable : "?:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoBatteryGaugePackage\\x64\\RegAsm.exe" and
  not (process.name : "regasm.exe" and process.parent.executable : "?:\\Program Files (x86)\\Common Files\\InstallShield\\Driver\\*\\IDriver.exe") and
  not process.executable : "?:\\Windows\\WinSxS\\amd64_microsoft-windows-powershell-exe_*\\powershell.exe" and
  not (process.executable : ("?:\\Gb\\Lib\\regsvr32.exe", "?:\\E20-II\\ENVIRO\\regasm.exe") and
       process.parent.executable : ("?:\\Gb\\GBsoftware.exe", "?:\\E20-II\\PCN33\\CODE\\SilentPCBEngTools128.exe")) and
  not (process.parent.executable : "?:\\apps\\sage300\\Programs\\runtime\\a4wcontainerXP.exe" and process.name : "regsvr32.exe") and
  not process.executable : "\\Device\\Mup\\*" and
  not process.executable : ("?:\\*Visual*Studio\\*\\MSBuild.exe",
                            "?:\\CAMS\\Enterprise\\CAMSServices\\ServiceBroker\\RegAsm.exe",
                            "?:\\Witron\\wms\\rt\\axl\\runtime\\bin\\system\\tools\\RegAsm.exe",
                            "?:\\SpearTrayApplication\\Tray\\regsvr32.exe",
                            "?:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\*\\RegAsm.exe",
                            "*\\Visual Studio\\*\\Bin\\MSBuild.exe",
                            "C:\\Sage\\Sage300\\Online\\Worker\\InstallUtil.exe",
                            "C:\\AssessPro\\Programs\\RegAsm.exe", 
                            "C:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\*\\RegAsm.exe") and
  not (process.name : "regsvr32.exe" and process.parent.name : "rundll32.exe" and
       process.parent.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*") and
  not (process.executable : "C:\\ProgramData\\baramundi\\bma\\Downloads\\Temp\\netsh.exe" and
       process.args : "exec" and process.args : "\\\\*.txt") and
  not (process.name : "bcdedit.exe" and process.args : "/enum") and
  not (process.executable : "?:\\Windows\\LFSAgent\\services.exe" and
       process.code_signature.trusted == true and
       process.code_signature.subject_name : "LEPIDE SOFTWARE PRIVATE LIMITED") and
  not (process.name : "ping.exe" and process.executable : "?:\\Windows\\Temp\\pdk-SYSTEM-*\\ping.exe") and
  not (process.code_signature.subject_name : ("JetBrains s.r.o.", "LG Electronics Inc.", "Timothy Hugh Perry", "Code Systems Corporation", "Douyin Vision Co., Ltd.", "Hangzhou Hikvision Digital Tech.Co.,Ltd") and process.code_signature.trusted == true) and
  not process.hash.sha256 :
                  ("7c621ec91b71d14494beddaae8edb67ed26baa257d750546772aa90653ad6016",
                   "195bebdefeb704158633b7f3d943e1d792fcb9b81f36530fad5b04a1622a0c58",
                   "dc84f15625f115faa757dee79b285a5af65298074827c917f0dfcacc5b308855",
                   "3f73452d3a5c39c8abc9e2b37c5e5f6ef210a4edb17ac180f425b05f320e5720",
                   "10fe2a16356afcb0f0d3ae77dc1320acdc7244a4115e3eabff6220fdd8d1347f",
                   "77e67a63a69c545a193998e3c17f6e4b15538f40aaaec3a1d4713b05ab3a4ede",
                   "87a4a3a8fb5df2e79e512f8a5043725dde70811afb39110cd8b4904dd15046f2",
                   "637c3c0e4441998130d0166e95d0449e22d82107be8daeb234126ca6392b25b7",
                   "2425e9a2b5f19483e234eb220bd4db97cecc5dbef5fd1a19940f823c7997fc26",
                   "facb69c35c1d63aeca9d9e55525660b728445acd0df1b6a23e52acf329baf94c",
                   "879f58323b0ee3313a0e43d507373a6ac9bc5b3cfbd6eac6411c252af261b60e",
                   "c7b895a4a21b597a5a7dc3c1a2d4c5e9823649688da9b57dd0c1bcea28c739ba",
                   "186546f3a23be3069550c185363034e686e87a3eccc9f5c7f3a5a92f15a0b1cb") and
  not (process.parent.code_signature.subject_name == "Data Spotlite Inc." and process.parent.code_signature.trusted == true and
       process.executable : "C:\\CYRISMA_Agent\\App\\powershell.exe")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"
[[threat.technique.subtechnique]]
id = "T1036.004"
name = "Masquerade Task or Service"
reference = "https://attack.mitre.org/techniques/T1036/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"