Protected Process from Unusual Parent

[rule]
description = """
Identifies when an unsigned process or a proxy execution utility spawns a protected process. This may indicate an
attempt to bypass PPL protection and inject malicious code into a protected process or disable security software.
"""
id = "9dbdcb78-6f0c-48cd-bfb8-46078de392ad"
license = "Elastic License v2"
name = "Protected Process from Unusual Parent"
os_list = ["windows"]
reference = ["https://www.zerosalarium.com/2025/08/countering-edrs-with-backing-of-ppl-protection.html"]
version = "1.0.1"

query = '''
process where event.action == "start" and process.Ext.protection like "PsProtectedSigner*" and
 (
  process.parent.code_signature.exists == false or
  process.parent.code_signature.trusted == false or
  process.parent.name : ("rundll32.exe", "regsvr32.exe", "explorer.exe", "powershell.exe", "msbuild.exe")
  )
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"

[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"