Suspicious Process with a Spoofed Parent

[rule]
description = """
Detects attempts to start a process with a fake parent process identity to blend in with normal parent child process
tree.
"""
id = "667a1895-5920-4fb2-820f-16c356f79341"
license = "Elastic License v2"
name = "Suspicious Process with a Spoofed Parent"
os_list = ["windows"]
version = "1.0.16"

query = '''
sequence with maxspan=1m
 [process where event.action == "start" and process.parent.Ext.real.pid > 0 and 
  not (process.name : "powershell.exe" and process.args : "Invoke-InProcessStub" and 
       process.args : "$execWrapper" and process.args : "\"ANSIBLE_BOOTSTRAP_ERROR:") and
  not (process.name : "WerFault.exe" and
       process.parent.thread.Ext.call_stack_summary : "ntdll.dll|kernelbase.dll|faultrep.dll|wersvc.dll|*")] by process.parent.Ext.real.entity_id
 [api where 
  process.executable : "?:\\*" and 
  process.Ext.api.name == "WriteProcessMemory" and process.parent.executable != null and 
  
  not (process.executable : ("?:\\windows\\system32\\svchost.exe", "?:\\Windows\\System32\\sppsvc.exe") and
       process.parent.executable : "?:\\Windows\\System32\\services.exe") and

  not process.executable : ("?:\\Windows\\System32\\RuntimeBroker.exe", 
                            "?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe", 
                            "?:\\Windows\\SoftwareDistribution\\*.exe",
                            "?:\\Windows\\System32\\WerFaultSecure.exe",
                            "?:\\WINDOWS\\SysWOW64\\WerFaultSecure.exe",
                            "?:\\Program Files\\Macrium\\Common\\MacriumService.exe") and
							 
  not (process.executable : ("*\\Program Files (x86)\\*.exe", "*\\Program Files\\*.exe") and process.code_signature.trusted == true) and 


  not (process.code_signature.subject_name : ("BeyondTrust Software, Inc", "Michael Maltsev", "BeyondTrust Software Inc", "Malwarebytes Inc.", "Malwarebytes Inc", "Proton AG") and
       process.code_signature.trusted == true) and

  not (process.name : ("devenv.exe", "PowerToys.exe", "notification_helper.exe", "cpptools.exe") and process.code_signature.trusted == true and 
       process.code_signature.subject_name : "Microsoft*") and 

  not (process.executable : 
                ("?:\\Windows\\System32\\backgroundTaskHost.exe", 
                 "?:\\Windows\\System32\\SystemSettingsBroker.exe", 
                 "?:\\Windows\\SystemApps\\Microsoft*.exe", 
                 "?:\\WINDOWS\\system32\\OpenWith.exe", 
                 "?:\\WINDOWS\\syswow64\\OpenWith.exe", 
                 "?:\\Windows\\System32\\PickerHost.Exe",
                 "?:\\WINDOWS\\Microsoft.NET\\Framework\\*\\RegAsm.exe") and 
        process.parent.executable : "?:\\Windows\\system32\\svchost.exe") and

  not (process.name : "tailscale-ipn.exe" and
        process.code_signature.subject_name == "Tailscale Inc." and
        (process.code_signature.trusted == true or process.code_signature.status == "errorChaining")) and
	
  not (process.code_signature.subject_name == "Roblox Corporation" and
        (process.code_signature.trusted == true or process.code_signature.status == "errorTimeStamp")) and
  not process.thread.Ext.call_stack_final_user_module.path : ("c:\\program files\\sentinelone\\*.dll") and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 :
                                        ("07e82c4bc4f48e94a634480ff5140b94b2026a7716473867806355957dc4d291",
                                         "b1179b4476d19f8861c5f331b0805fc47fe86101875abf87ca7805d9d0523db5",
                                         "9ab9db0eb58feb23271a6ecce89bc3de36df95a6304a7f91c02260067d9b88c4",
                                         "74eaa6197dc723f93cdb509a2ce59ffd4b302e9117585d32d56b8c4255253f50",
                                         "97b930b2d7af917d9fba37c03709da1c929cb97ea6c43cda823702ad3f96786e",
                                         "913f3371d4aa9f77d0e7cc480918558aac95f148d77e4f5475c0db4f73194863") and
  not process.thread.Ext.call_stack_final_user_module.path :
                                      ("c:\\program files\\avecto\\privilege guard client\\pghook.dll",
                                       "c:\\program files (x86)\\webroot\\wrsa.exe") and
  not (process.executable : "?:\\Windows\\System32\\wermgr.exe" and
       process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and
       process.thread.Ext.call_stack_final_user_module.path : "c:\\windows\\system32\\windows.storage.dll") and

  not process.executable : "C:\\Program Files (x86)\\IBM\\Client Access\\Emulator\\pcssnd.exe" and

  not (process.executable : "C:\\Windows\\System32\\ShellHost.exe" and process.parent.executable : "C:\\Windows\\System32\\sihost.exe") and
  not (process.name : "FileCoAuth.exe" and process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\windows.storage.dll" and
       process.Ext.api.summary == "WriteProcessMemory( Self, Data, 0x1 )")
  ] by process.entity_id
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.004"
name = "Parent PID Spoofing"
reference = "https://attack.mitre.org/techniques/T1134/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"