Potential Obfuscated Script Execution

[rule]
description = """
Detection involves spotting the generation of a file exhibiting high entropy, which is subsequently executed using
frequently abused script interpreters. Adversaries may employ script obfuscation techniques to evade static detection
methods.
"""
id = "a279fa6c-61eb-49ea-926e-704db27855e8"
license = "Elastic License v2"
name = "Potential Obfuscated Script Execution"
os_list = ["windows"]
version = "1.0.12"

query = '''
sequence with maxspan=1m
 [file where event.action == "creation" and 
  not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-90") and 
  process.pid != 4 and 
  file.path : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*") and 
  file.Ext.entropy >= 6 and not file.Ext.header_bytes : "4d5a*" and
  not (process.name : "ifa-PM.exe" and file.name : "ifa-PMS.hta") and
  not (process.name : "Code.exe" and file.name : "aws-lsp-codewhisperer.js") and
  not (process.name : ("Setup.exe", "vrpsetup.exe") and
      file.Ext.header_bytes : ("53657420776d6953657276696365203d", "2720436865636b206c6963206265666f")) and
  not (process.code_signature.subject_name : ("BizLink International Corp.", "Adobe Inc.", "Fabrice PARISOT", "Notepad++", "Argus Media Ltd", "Imprivata, Inc.")
       and process.code_signature.trusted == true) and
  not process.executable : ("?:\\Program Files (x86)\\Kovai Ltd\\BizTalk360\\Service\\BHMCollect.exe",
                            "?:\\Program Files (x86)\\BizTalkHealthMonitor\\BHMCollect.exe",
                            "?:\\Program Files\\Common Files\\Voltage Security\\VSManager2.exe",
                            "?:\\Program Files (x86)\\UPS\\CrossWare\\CrossWare.exe",
                            "?:\\Program Files\\Automation Anywhere\\Bot Agent\\jre\\bin\\javaw.exe",
                            "?:\\Program Files\\ForeScout SecureConnector\\SecureConnector.exe",
                            "?:\\Program Files (x86)\\Acronis\\BackupAndRecovery\\mms.exe",
                            "C:\\Program Files (x86)\\Delcam\\FeatureCAM\\Program\\ezfm.exe",
                            "C:\\Program Files\\IPA\\IPA.exe",
                            "?:\\Program Files\\EIZO\\ColorNavigator 7\\ColorNavigator 7.exe",
                            "?:\\Program Files (x86)\\Windev\\AD_Voyager\\AD_voyager.exe",
                            "?:\\Program Files\\BackupClient\\BackupAndRecovery\\mms.exe",
                            "?:\\Program Files\\Velneo\\vClient.exe",
                            "D:\\WINDEV\\AD_Voyager\\AD_voyager.exe",
                            "C:\\Program Files\\Java\\jre8\\bin\\java.exe",
                            "C:\\Program Files (x86)\\SofttechLLC\\FlightVector\\FlightVector.exe",
                            "?:\\Program Files\\Automation Anywhere\\Bot Agent\\jre\\bin\\BotLauncher.exe",
                            "C:\\Program Files\\Eclipse Adoptium\\jdk-*-hotspot\\bin\\java.exe",
                            "C:\\Program Files (x86)\\Imprivata\\OneSign Agent\\x64\\ISXAgent.exe",
                            "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe")] as event0
 [process where event.action == "start" and process.args_count >= 2 and 
  (
   (process.Ext.relative_file_creation_time <= 500 and process.pe.original_file_name : ("node.exe", "AutoIt*.exe")) or 
    (process.pe.original_file_name : ("wscript.exe", "mshta.exe") and
     event0.file.extension : ("js", "vbs", "wsh", "vbe", "jse", "hta"))
  ) and 
  stringcontains~(process.command_line, event0.file.name) and
  not (process.parent.args : "%TEMP%\\Spiceworks\\spiceworks_upload.vbs" and process.parent.name : "cmd.exe") and
  not (process.parent.name : "mshta.exe" and process.parent.args : "\\\\*\\netlogon\\ADSelfService_Enroll.hta") and
  not (process.parent.name : "cmd.exe" and
       process.parent.command_line : "C:\\WINDOWS\\SYSTEM32\\cmd.exe /c \"\"C:\\Program Files (x86)\\BluePoint Solutions\\BPAppLaunch\\ConsoleApp\\Command BPAppLaunch.bat\"\"") and
  not process.parent.executable : ("C:\\Engineer\\Airlock Digital - Allowlisting Auditor v4.1.exe",
                                   "C:\\Program Files (x86)\\Common Files\\Adobe\\Adobe Desktop Common\\HDBox\\Setup.exe")
  ]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"