Suspicious Execution from a Mounted Device

[rule]
description = """
Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may
use this technique to evade defenses.
"""
id = "42d2bbfb-a2fb-4327-b701-89ead6044ca1"
license = "Elastic License v2"
name = "Suspicious Execution from a Mounted Device"
os_list = ["windows"]
version = "1.0.32"

query = '''
sequence with maxspan=1m
  [file where event.action == "creation" and file.extension : "lnk" and
   process.name : "explorer.exe" and
     file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.vhd.lnk",
                  "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.iso.lnk")] by process.entity_id
  [process where event.action == "start" and process.executable : "C:\\*" and
   (process.working_directory : "?:\\" and not process.working_directory : "C:\\") and process.parent.name : "explorer.exe" and
    process.name : ("rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe", "cmd.exe", "regsvr32.exe", "cscript.exe",
                    "wscript.exe", "wmic.exe", "msbuild.exe", "regsvcs.exe", "installutil.exe", "cmstp.exe", "msxsl.exe",
                    "Microsoft.Workflow.Compiler.exe", "wuauclt.exe") and
    /* Issue #316 */
    process.args_count >= 2] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"

[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"

[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"