Execution via Renamed Signed Binary Proxy

[rule]
description = """
Identifies built-in Windows programs that have been renamed and can be used for execution, downloads, and/or evasion.
Attackers may abuse this tactic to evade filename based detection of built-in tools.
"""
id = "b0207677-5041-470b-981d-13ab956cf5b4"
license = "Elastic License v2"
name = "Execution via Renamed Signed Binary Proxy"
os_list = ["windows"]
reference = [
    "https://lolbas-project.github.io",
    "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
]
version = "1.0.40"

query = '''
process where event.action == "start" and
 process.name != null and
     (
       (process.pe.original_file_name == "cscript.exe" and not process.name : "cscript.exe") or
       (process.pe.original_file_name == "wscript.exe" and not process.name : "wscript.exe") or
       (process.pe.original_file_name == "PowerShell.EXE" and not process.name : "PowerShell.EXE") or
       (process.pe.original_file_name == "Cmd.Exe" and not process.name : ("Cmd.Exe", "command.com")) or
       (process.pe.original_file_name == "MSHTA.EXE" and not process.name : "MSHTA.EXE") or
       (process.pe.original_file_name == "RUNDLL32.EXE" and not process.name : "RUNDLL32.EXE") or
       (process.pe.original_file_name == "REGSVR32.EXE" and not process.name : "REGSVR32.EXE") or
       (process.pe.original_file_name == "MSBuild.exe" and not process.name : "MSBuild.exe") or
       (process.pe.original_file_name == "InstallUtil.exe" and not process.name : "InstallUtil.exe") or
       (process.pe.original_file_name == "RegAsm.exe" and not process.name : "RegAsm.exe") or
       (process.pe.original_file_name == "RegSvcs.exe" and not process.name : "RegSvcs.exe") or
       (process.pe.original_file_name == "msxsl.exe" and not process.name : "msxsl.exe") or
       (process.pe.original_file_name == "Microsoft.Workflow.Compiler.exe" and
        not process.name : "Microsoft.Workflow.Compiler.exe") or
       (process.pe.original_file_name == "msiexec.exe" and not process.name : "msiexec.exe" and
        not process.executable : "?:\\Windows\\Installer\\MSI*.tmp") or
       (process.pe.original_file_name == "CMSTP.EXE" and not process.name : "CMSTP.EXE") or
       (process.pe.original_file_name == "bitsadmin.exe" and not process.name : "bitsadmin.exe") or
       (process.pe.original_file_name == "CertUtil.exe" and not process.name : "CertUtil.exe") or
       (process.pe.original_file_name == "wmic.exe" and not process.name : "wmic.exe") or
       (process.pe.original_file_name == "schtasks.exe" and not process.name : "schtasks.exe") or
       (process.pe.original_file_name == "wuauclt.exe" and not process.name : "wuauclt.exe") or
       (process.pe.original_file_name == "Bginfo.exe" and not process.name : "Bginfo*.exe") or
       (process.pe.original_file_name == "VsJITDebugger.exe" and not process.name : "VsJITDebugger.exe") or
       (process.pe.original_file_name == "xwizard.exe" and not process.name : "xwizard.exe") or
       (process.pe.original_file_name == "extexport.exe" and not process.name : "extexport.exe") or
       (process.pe.original_file_name == "CertReq.exe" and not process.name : "CertReq.exe") or
       (process.pe.original_file_name == "bsdtar" and not process.name : "tar.exe" and
        process.code_signature.subject_name == "Microsoft Windows") or 
       (process.pe.original_file_name : "GfxDownloadWrapper.exe" and not process.name : "GfxDownloadWrapper.exe") or
       (process.pe.original_file_name : "devinit.dll" and
        process.code_signature.subject_name : "Microsoft *" and not process.name : "devinit.exe") or
       (process.pe.original_file_name == "DumpMinitool.exe" and
        process.code_signature.subject_name : "Microsoft *" and not process.name : "DumpMinitool.exe") or
       (process.pe.original_file_name == "curl.exe" and
        process.code_signature.subject_name : "Microsoft *" and not process.name : "curl.exe")
     ) and
 /* some third party programs tend to include renamed binaries, still often run from trusted paths */
 not process.executable :
        (
          "?:\\Windows\\System32\\*.exe",
          "?:\\Windows\\SysWOW64\\*.exe",
          "?:\\Program Files (x86)\\*.exe",
          "?:\\Program Files\\*.exe",
          "\\Device\\HarddiskVolume*\\Windows\\System32\\*.exe",
          "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\*.exe",
          "\\Device\\HarddiskVolume*\\Windows\\Microsoft.NET\\*.exe",
          "\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
          "\\Device\\HarddiskVolume*\\Program Files\\*.exe"
        ) and
  not (process.executable : "?:\\Windows\\Installer\\MSI*.tmp" and process.parent.name : "msiexec.exe") and
  not (process.hash.sha256 == "505d886fff0542f600f8534d9691de02200b719f1b80487a84fa799e1b178696" and
       process.executable == "C:\\spmwin\\regasm32.exe") and
  not (process.parent.executable : "C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe" and
       process.pe.original_file_name == "RUNDLL32.EXE" and process.args : "360ExtremeBrowserURL") and
  not (process.name : "regasm.x64.exe" and process.parent.executable : "C:\\Program Files (x86)\\Common Files\\Inlite\\InliteControlCenter.exe") and
  not (process.pe.original_file_name == "cscript.exe" and process.parent.executable : "C:\\Program Files (x86)\\Net Protector *\\NPDBKWTT.EXE") and
  not (
       process.executable : (
         "?:\\ProgramData\\Package Cache\\VSTACleanupOldRegistryBundlex64\\cmd_x64.exe",
         "?:\\ProgramData\\Package Cache\\VSTACleanupOldRegistryBundlex86\\cmd_x86.exe",
         "?:\\ProgramData\\Package Cache\\CleanupOldRegistryBundlex86\\cmd_x86.exe",
         "?:\\ProgramData\\Package Cache\\CleanupOldRegistryBundlex64\\cmd_x64.exe"
       ) and
       process.parent.name : ("vsta_setup.exe", "vsta_sdk.exe")
     ) and
  not process.parent.executable : ("C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHSafeTray.exe",
                                   "C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"