Suspicious Windows Explorer Execution

[rule]
description = """
Identifies instances of the Windows Explorer process with an unusual parent process or unusual process arguments.This
may be indicative of a masquerading or injection into trusted processes in an attempt to evade suspicion.
"""
id = "f8ec5b76-53cf-4989-b451-7d16abec7298"
license = "Elastic License v2"
name = "Suspicious Windows Explorer Execution"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware"]
version = "1.0.32"

query = '''
process where event.action == "start" and
   process.executable : "?:\\Windows\\SysWOW64\\explorer.exe" and
 (
   /* miners injecting into Explorer */
    process.args : ("etc", "easyminer*", "ton", "Rg", "eth", "Toncoin", "mmrig", "--cinit-*", "pool.*", "--coin=*", "--cpu-*") or

    /* excute a malicious DLL by clsid */
    (process.args : "shell:::{*" and not process.args : "shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}") or

    /* Explorer with unusual process arg length */
    (length(process.command_line) >= 200 and process.args_count == 3 and not process.args : "/select*") or

   /* commonly abused lolbin as parent */
   (process.parent.name : ("rundll32.exe", "regsvr32.exe", "powershell.exe", "mshta.exe") and process.parent.args_count >= 2 and
    process.args_count == 1 and
    not (process.parent.name : "rundll32.exe" and
         process.parent.args : ("?:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL", "AppXDeploymentExtensions.OneCore.dll,ShellRefresh"))) or

    /* unusual parent process by path */
    (process.parent.executable : ("?:\\Users\\*\\AppData\\*", "?:\\Users\\Public\\*", "?:\\ProgramData\\*", "?:\\Windows\\Microsoft.NET\\*.exe") and
     process.args_count == 1 and not process.parent.args : ("-runfromtemp", "/IS_temp", "-removeonly", "/update_silent", "-media_path*") and
     not process.parent.executable : ("?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
                                      "?:\\Users\\*\\AppData\\Local\\Adobe\\Acrobat\\Kaizen\\DC\\Reader\\Acrobat_DC_Set-Up.exe") and
     not (process.executable : "?:\\Windows\\SysWOW64\\explorer.exe" and process.args : "?:\\Windows\\system32\\explorer.exe") and
     not (process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\chocolatey\\*" and process.parent.args_count >= 2) and
     not (process.parent.args :  "NGen Worker Process" and process.parent.name : "mscorsvw.exe") and
     not (process.command_line : "explorer.exe" and process.parent.name : "cmd.exe") and
     not (process.executable : "?:\\WINDOWS\\Explorer.EXE" and process.parent.executable : "?:\\Users\\*\\AppData\\*"))  or

    (process.executable : "?:\\Windows\\SysWOW64\\explorer.exe" and process.parent.executable : "?:\\Windows\\explorer.exe" and process.args_count == 1) or

     /* Indirect Command Execution via Explorer */
    (process.name : "explorer.exe" and process.command_line : "*.exe *.exe*" and not process.args : "*/select*" and not process.command_line : "*:\\Program Files*") and

    not process.parent.executable :
              ("?:\\Program Files (x86)\\BleachBit\\bleachbit.exe",
               "?:\\*\\PortableApps\\BleachBit-Portable\\bleachbit.exe",
               "?:\\Users\\*\\AppData\\Local\\BleachBit\\bleachbit_console.exe",
               "?:\\Program Files (x86)\\Realtek\\Realtek PCIE Card Reader\\RIconBoy.exe") and

    not process.command_line :
             ("*shell:::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}*",
              "*shell:::{679F85CB-0220-4080-B29B-5540CC05AAB6}*",
              "*shell:::{A8A91A66-3A7D-4424-8D24-04E180695C7A}*",
              "*shell:::{3080F90D-D7AD-11D9-BD98-0000947B0257}*",
              "*shell:::{26EE0668-A00A-44D7-9371-BEB064C98683*",
              "*Shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}*",
              "*shell:::{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}*") and

    not (process.executable : "?:\\Windows\\SysWOW64\\explorer.exe" and process.parent.command_line : "*-IS_temp*ORIGINALSETUPEXENAME*") and

    not process.parent.executable :
               ("?:\\Program Files (x86)\\Realtek\\Realtek PCIE Card Reader\\RIconBoy.exe",
                "?:\\Program Files (x86)\\Lenovo\\ThinkPad Compact Keyboard with TrackPoint driver\\osd.exe",
                "?:\\Windows\\System32\\sihost.exe",
                "?:\\ProgramData\\cfernan zht\\pwg xq.exe") and

    not process.parent.command_line : "*-IS_temp*ORIGINALSETUPEXEDIR*"
    )
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"