Suspicious Windows Sandbox Execution

[rule]
description = """
Identifies Windows sanfbox processes indicating the start of a new container with sensitive configurations like write
access to the host file system, network connection and automatic execution via logon command. Malware may abuse the
sandbox feature to evade detection.
"""
id = "201220cd-bb74-4909-aeb5-c876bcc35870"
license = "Elastic License v2"
name = "Suspicious Windows Sandbox Execution"
os_list = ["windows"]
reference = ["https://blog-en.itochuci.co.jp/entry/2025/03/12/140000"]
version = "1.0.3"

query = '''
process where event.type == "start" and
(
  ((process.name : ("wsb.exe", "WindowsSandboxClient.exe") or process.pe.original_file_name in ("wsb.exe", "WindowsSandboxClient.exe")) and
   process.command_line : ("*<Networking>Enable</Networking>*",
                          "*<HostFolder>C:\\*<ReadOnly>false*",
                          "*<LogonCommand>*",
                          "*<NetworkingEnabled>true*")) or

  ((process.name : "WindowsSandbox.exe" or process.pe.original_file_name == "WindowsSandbox.exe") and user.id == "S-1-5-18") or

  (process.name : "schtasks.exe" and process.command_line : "*create*WindowsSandbox.exe*")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[threat.technique.subtechnique]]
id = "T1564.006"
name = "Run Virtual Instance"
reference = "https://attack.mitre.org/techniques/T1564/006/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"