Suspicious Command Execution via Windows Run

[rule]
description = """
Identifies the execution of Windows commands via the Windows Run window. Adversaries may use phishing to instruct the
victim to copy and paste malicious commands for execution via the Windows Run menu.
"""
id = "f4f436c8-5c4a-4f61-b0cc-17b154920887"
license = "Elastic License v2"
name = "Suspicious Command Execution via Windows Run"
os_list = ["windows"]
reference = [
    "https://www.cloudsek.com/blog/unmasking-the-danger-lumma-stealer-malware-exploits-fake-captcha-pages",
]
version = "1.0.9"

query = '''
process where event.action == "start" and
 (
   process.name : ("cmd.exe", "powershell.exe", "curl.exe", "msiexec.exe", "mshta.exe", "wscript.exe", "cscript.exe") or 
   (process.name : "rundll32.exe" and process.command_line : "*\\\\*@*,*")
 ) and
 process.parent.name : "explorer.exe" and process.args_count >= 2 and
 (
  process.parent.thread.Ext.call_stack_summary like "ntdll.dll|kernelbase.dll|kernel32.dll|windows.storage.dll|shell32.dll|user32.dll|shell32.dll|explorer.exe|shcore.dll|*" or
  (process.parent.thread.Ext.call_stack_summary like "*|user32.dll|shell32.dll|explorer.exe|shcore.dll|*" and
   _arraysearch(process.parent.thread.Ext.call_stack, $entry, 
                $entry.symbol_info like ("C:\\Windows\\System32\\user32.dll!DialogBoxParamW*", 
                                         "C:\\Windows\\System32\\user32.dll!DialogBoxIndirectParamW*", 
                                         "C:\\Windows\\System32\\shell32.dll!GetFileNameFromBrowse*")))
 ) and
 not (process.name : "cmd.exe" and
      process.args : ("*.bat*", "*.cmd", "dir", "ipconfig", "C:\\WINDOWS\\system32\\sconfig.cmd ", "Code\\bin\\code.cmd ", "mkdir",
                      "C:\\Users\\*.cmd ")) and
 not (process.name : "powershell.exe" and process.args : ("Start-Process powershell -Verb RunAs", "C:\\*.ps1", "-SPLAGroup", "\\\\*\\netlogon\\*.ps1")) and
 not (process.name : "msiexec.exe" and process.args : "?:\\*.msi") and
 not process.command_line : ("\"C:\\WINDOWS\\system32\\cmd.exe\" /k net use",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" -a",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" /c start terminal",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" D:\\",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" /admin",
                             "\"C:\\Windows\\system32\\msiexec.exe\" /regserver",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" /c start WindowsTerminal",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" /c start chrome --app=D:\\Notify\\index.html",
                             "\"C:\\windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -ep bypass",
                             "\"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" ise",
                             "\"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -Command Start-Process PowerShell -Verb RunAs",
                             "C:\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\Users\\*\\AppData\\Roaming\\npm\\*z.cmd\" \"",
                             "\"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -ExecutionPolicy Bypass") and
 not (process.name : ("wscript.exe", "cscript.exe") and process.args : ("\\\\*\\MapNetworkDrives.vbs", "?:\\*.js", "?:\\*.vbs")) and
 not (process.name : "powershell.exe" and process.args : "-command" and process.args : "vnc") and
 not (process.name : ("msiexec.exe", "powershell.exe", "wscript.exe") and process.working_directory : "\\\\*") and
 not (process.name : "msiexec.exe" and process.args :  "\\\\*\\SYSVOL\\*.msi")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.0"