Potential Parent Process PID Spoofing via MalSecLogon

[rule]
description = """
Identifies potential parent process spoofing via abusing the seclogon service. Adversaries may spoof the parent process
identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.
"""
id = "3bd31cbf-b581-41b7-b021-020cc64cfd9d"
license = "Elastic License v2"
name = "Potential Parent Process PID Spoofing via MalSecLogon"
os_list = ["windows"]
reference = ["https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html"]
version = "1.0.36"

query = '''
process where event.action == "start" and

   process.Ext.session_info.logon_type : "NewCredentials" and

   process.parent.Ext.real.pid > 0 and not process.Ext.token.integrity_level_name == "system" and

   /* dirs hosting interesting processes to spoof as parent process like Explorer.exe */
   process.parent.executable regex~ """(c:\\windows\\system32\\[a-z0-9\-\_\.]+\.exe|c:\\windows\\syswow64\\[a-z0-9\-\_\.]+\.exe|c:\\windows\\[a-z0-9\-\_\.]+\.exe)""" and

    /* common secLogon Clients running from trusted directories */
    not (process.parent.executable : "?:\\WINDOWS\\Explorer.EXE" and process.name : "rundll32.exe" and process.command_line : "*SHELL32.dll,RunAsNewUser_RunDLL*") and

    not (process.parent.executable : ("?:\\Windows\\System32\\runas.exe", "?:\\WINDOWS\\system32\\ShellRunas.exe", "?:\\Windows\\SysWOW64\\runas.exe") and
        process.parent.args_count >= 2) and

    not (process.parent.executable : "?:\\WINDOWS\\System32\\svchost.exe" and process.parent.args : "WdiServiceHost" and
         process.name : "rundll32.exe" and process.command_line : "*winethc.dll*ForceProxyDetectionOnNextRun*") and

    not (process.parent.executable : "?:\\Windows\\Sys*\\OneDriveSetup.exe" and process.parent.args : ("/thfirstsetup", "/uninstall") and
         process.pe.original_file_name in ("OneDrive.exe", "OneDriveSetup.exe") and
         process.code_signature.subject_name : "Microsoft *" and process.code_signature.trusted == true) and

    not (process.parent.executable : "?:\\Windows\\Sys*\\MsiExec.exe" and process.parent.args : "-Embedding") and

    not (process.parent.executable : "?:\\Windows\\System32\\consent.exe" and process.executable : "?:\\WINDOWS\\system32\\UserAccountControlSettings.exe") and

    /* RunAs execution via windows scripts */
    not process.parent.name : ("cscript.exe", "powershell.exe", "wscript.exe") and

    not process.parent.executable : ("?:\\windows\\system32\\ServerManager.exe", "?:\\Windows\\System32\\LogonUI.exe", "?:\\Windows\\System32\\dgagent\\dsagent.exe") and

    not (process.parent.executable : "?:\\Windows\\System32\\mmc.exe" and process.executable : "?:\\Windows\\system32\\gpupdate.exe") and

    not (process.pe.original_file_name == "OffCATcmd.exe" and process.code_signature.subject_name == "Microsoft Corporation" and
         process.code_signature.trusted == true and process.parent.executable : "?:\\Windows\\System32\\sdiagnhost.exe") and 
	 
    not (process.parent.name : "rundll32.exe" and process.parent.args : "?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc") and

    not (process.code_signature.subject_name in ("Articulate Global, Inc.", "Samsung Electronics CO., LTD.", "SCHNEIDER ELECTRIC USA, INC.") and
         process.code_signature.trusted == true) and
    not process.executable : ("?:\\Windows\\System32\\SpecopsClient\\SecuredBrowserNet\\*.exe", "?:\\Windows\\System32\\DriverStore\\FileRepository\\*\\SamsungSystemSupportOSD.exe") and
    not (process.executable : "?:\\Windows\\SysWOW64\\OneDriveSetup.exe" and process.parent.executable : "?:\\Windows\\SysWOW64\\OneDriveSetup.exe") and

    not process.executable : "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe" and

    not (process.code_signature.subject_name : ("TeamViewer*", "Schneider Electric") and process.code_signature.trusted == true) and

    not (process.pe.original_file_name : "VCPkgSrv.exe" and process.code_signature.trusted == true) and

    not process.executable : "?:\\Program Files (x86)\\Varian\\OCS\\*\\VMS.Varis.Vishnu.exe" and
    not (process.parent.executable : "C:\\Windows\\System32\\mmc.exe" and process.executable : "C:\\Windows\\System32\\mmc.exe" and process.args : "/server:*")
'''

min_endpoint_version = "8.6.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.004"
name = "Parent PID Spoofing"
reference = "https://attack.mitre.org/techniques/T1134/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.6.0"