Indirect Command Execution via Console Window Host

[rule]
description = """
Identifies abuse of the Console Window Host (conhost.exe) to execute an arbitrary executable. This behavior is used as a
defense evasion technique to blend-in malicious activity with legitimate Windows software.
"""
id = "4b61b37d-c569-444a-bafa-e29d221ee55c"
license = "Elastic License v2"
name = "Indirect Command Execution via Console Window Host"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Conhost/"]
version = "1.0.32"

query = '''
process where event.action == "start" and
  process.parent.name : "conhost.exe" and process.parent.args_count >= 2 and
  process.parent.command_line : ("*conhost* *.exe*", "*cmd /c *", "*powershell*", "*script*", "*mshta*", "* curl *") and
  not process.command_line :
            ("?:\\windows\\system32\\cmd.exe",
             "?:\\windows\\SysWOW64\\cmd.exe", "cmd.exe",
             "?:\\windows\\system32\\windowspowershell\\*\\powershell.exe",
             "powershell.exe -NoProfile -ExecutionPolicy Bypass -File winget-upgrade.ps1",
             "powershell.exe -NoProfile -ExecutionPolicy Bypass -File WAU-Notify.ps1") and
  not process.parent.executable : "\\Device\\Mup\\*\\IBM\\ClientSolutions\\Start_Programs\\Windows*\\acslaunch_win-*.exe" and 
  not process.hash.sha256 : "b37565fabde8680ef7d0de3c808096b7512f42c62071f2fb486da14b773ec04a" and
  not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
  not (process.code_signature.subject_name == "International Business Machines Corporation" and process.code_signature.trusted == true) and
  not (process.name : "powershell.exe" and process.args : "-ExecutionPolicy" and process.args : ("-F", "Stop-Process*")) and
  not (process.args in ("/bin/sh", "bash") and process.parent.args == "--height" and process.parent.args == "24")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1202"
name = "Indirect Command Execution"
reference = "https://attack.mitre.org/techniques/T1202/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"