Command and Scripting Interpreter from Suspicious Parent

[rule]
description = "Identifies when a script interpreter is executed with a long command line and from an unsigned parent executable."
id = "61b8b978-847b-4b1f-9771-b646cde53a9a"
license = "Elastic License v2"
name = "Command and Scripting Interpreter from Suspicious Parent"
os_list = ["windows"]
version = "1.0.6"

query = '''
sequence with maxspan=1m
 [process where event.action == "start" and not user.id : "S-1-5-18" and 
  (
   (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB *") and
    not process.executable : "C:\\*") or

   ((process.Ext.relative_file_creation_time <= 900 or process.Ext.relative_file_name_modify_time <= 900) and
     not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
     not process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*")) or

   (process.executable :
	        ("?:\\Users\\*\\AppData\\*",
	         "?:\\Users\\*\\Downloads\\*",
	         "?:\\Users\\*\\Desktop\\*",
	         "?:\\Users\\Public\\*") and not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*"))
   ) and
  not process.parent.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\VsDebugConsole.exe"
  ] by process.entity_id
 [process where event.action == "start" and process.name : ("cmd.exe", "powershell.exe") and
  length(process.command_line) >= 200 and not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and 
  not (process.args : "-InputFormat" and process.args : "-command") and 
  not process.args : "UwB0AGEAcgB0ACAAIgBoAHQAdABw*" and 
  process.command_line : ("*New-ScheduledTaskAction*", "*New-ItemProperty*", "*WScript.Shell*", "*schtasks* /create*", 
                          "*\\Start Menu\\Programs\\*", "*CurrentVersion\\Run*", "*.Invoke(*", "*MpPreference*", 
			  "*-EncodedCommand*", "*Get-Content*", "*Windows Defender*", "*powershell* -e *", "*setZeroData*", 
                          "*Get-Clipboard*", "*http* -xf *", "*dns-query?name=*")
 ] by process.parent.entity_id
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.4.0"