Msiexec Execution via a Windows Script Interpreter

[rule]
description = """
Identifies when a Windows script attempts to execute commands using the Windows Installer service via Component Object
Model.
"""
id = "1eae6aaf-7854-4fa7-8470-f19f87f9802a"
license = "Elastic License v2"
name = "Msiexec Execution via a Windows Script Interpreter"
os_list = ["windows"]
version = "1.0.5"

query = '''
sequence with maxspan=1m
 [process where event.action == "start" and not user.id : "S-1-5-18" and
  process.name : ("wscript.exe", "cscript.exe", "mshta.exe", "powershell.exe", "mshta.exe", "cmstp.exe", "msxsl.exe") and
  not (process.name : "powershell.exe" and
       process.parent.executable : ("?:\\Program Files (x86)\\Microsoft Intune Management Extension\\agentexecutor.exe",
                                    "?:\\Program Files (x86)\\ScreenConnect Client*\\ScreenConnect.WindowsBackstageShell.exe",
                                    "?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dctask64.exe",
                                    "C:\\Program Files (x86)\\FastTrack Software\\Admin By Request\\AdminByRequest.exe",
                                    "C:\\Program Files\\Oracle Cloud Agent\\plugins\\unifiedmonitoring\\unifiedmonitoring.exe"))
  ] by process.entity_id
 [process where event.action == "start" and process.parent.name : "msiexec.exe" and
  not (process.name : "regsvr32.exe" and user.id : "S-1-5-18") and
  not (process.name : "cmd.exe" and
       process.command_line : "cmd /C if exist \"%appdata%/Messenger\" rmdir \"%appdata%/Messenger\" /s /q & if exist \"%appdata%/chatgenie\" rmdir \"%appdata%/chatgenie\" /s /q") and
  not (process.executable : "?:\\Windows\\Sys*\\msiexec.exe" and
       process.args : "/Z" and process.args : ("C:\\Program Files (x86)\\*.dll", "C:\\Program Files\\*.dll"))
  ] by process.Ext.effective_parent.entity_id
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"