JAVA Application with Unusual File Extension

[rule]
description = """
Identifies the execution of a Java JAR application with an unusual file extension. Malicious files may masquerade as non
executable file extensions to evade defenses.
"""
id = "13615fd4-b220-4033-ab4f-8b16b9beae57"
license = "Elastic License v2"
name = "JAVA Application with Unusual File Extension"
os_list = ["windows"]
version = "1.0.7"

query = '''
sequence by process.entity_id with maxspan=5s
[process where event.action == "start" and
 (process.name : "javaw.exe" or process.pe.original_file_name == "javaw.exe") and not process.command_line : "*.jar*" and 
  (
   (process.args_count == 3 and process.args : "-jar") or 
   (process.args_count == 4 and process.args : ("-cp", "-classpath") and process.command_line : " *.* ")
   ) and
  not process.executable : ("?:\\Program Files\\7edit.com\\7Edit *\\bin\\javaw.exe",
                            "?:\\Program Files\\Angry IP Scanner\\jre\\bin\\javaw.exe",
                            "?:\\Program Files\\Eclipse Adoptium\\jdk-*-hotspot\\bin\\javaw.exe",
                            "C:\\Program Files\\Java\\jdk-11\\bin\\javaw.exe",
                            "C:\\Program Files\\Zulu\\zulu-8\\bin\\javaw.exe",
                            "C:\\Program Files\\AdoptOpenJDK\\jre*-hotspot\\bin\\javaw.exe") and
  not process.parent.executable :
                     ("?:\\Program Files (x86)\\AssoSoftware\\AssoInvoice\\AssoInvoice.exe",
                      "C:\\Program Files (x86)\\ImprimeTickets\\ImprimeTickets.exe") and
  not (process.code_signature.subject_name : ("BELLSOFT", "Eclipse.org Foundation, Inc.", "Insurity LLC") and process.code_signature.trusted == true) and
  not process.command_line : "\"C:\\Program Files\\Java\\jre1.8.0_51\\bin\\javaw.exe\" -jar \"C:\\Users\\*\\AppData\\Roaming\\.minecraft\\TLauncher.exe\""
  ]
[network where event.action in ("connection_accepted", "connection_attempted") and
 not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
       "FE80::/10", "FF00::/8")]
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.16.0"