Suspicious Windows Script Interpreter Child Process

[rule]
description = """
Identifies unusual windows script interpreter child process which could indicate code injection or other form of
malicious code execution via Windows scripts.
"""
id = "83da4fac-563a-4af8-8f32-5a3797a9068e"
license = "Elastic License v2"
name = "Suspicious Windows Script Interpreter Child Process"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"]
version = "1.0.41"

query = '''
process where event.type == "start" and
  process.parent.name : ("wscript.exe", "mshta.exe") and
  process.parent.args_count >= 2 and
  not process.Ext.token.integrity_level_name == "system" and
   (
    process.name : ("rundll32.exe", "odbcconf.exe") or

   (process.name : ("cmd.exe", "powershell.exe", "curl.exe") and process.parent.name : "mshta.exe") or

    /* suspicious or unusual paths */
    process.executable : ("?:\\Windows\\Microsoft.NET\\*",
                          "?:\\Users\\Public\\*",
                          "?:\\Windows\\Tasks\\*",
                          "?:\\Windows\\System32\\Tasks\\*") or

     /* potential hollowed trusted system process with no arguments */
    (process.args_count == 1 and
     process.executable : ("?:\\Windows\\System32\\*.exe", "?:\\Windows\\SysWOW64\\*.exe") and
     process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft *" and
     not process.name : ("conhost.exe", "gpupdate.exe", "logoff.exe", "HOSTNAME.EXE"))
     ) and
     not (process.parent.name : "mshta.exe" and process.parent.args : "?:\\Program Files\\HP\\*\\HPSolutionsPortal.hta") and
     not (process.name : "regsvr32.exe" and process.parent.name : "wscript.exe" and process.parent.command_line : ("*LiteTouch.wsf*", "*LTICleanup.wsf*")) and
     not (process.pe.original_file_name == "acslaunch" and process.executable : "?:\\Users\\Public\\IBM\\*.exe") and
     not (process.name : ("rundll32.exe", "regsvr32.exe") and
          process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile", "?:\\Windows\\sysWOW64\\*.ocx")) and
     not process.executable : ("?:\\WINDOWS\\Microsoft.NET\\Framework\\*\\caspol.exe", "?:\\Windows\\System32\\Vmw.exe") and
     not (process.name : "rundll32.exe" and process.args : "UpdatePerUserSystemParameters" and process.args : "user32.dll,") and
     not (process.executable : "?:\\Windows\\System32\\Vmw.exe" and process.parent.args : "kms_host.vbs") and
     not (process.name : "regsvr32.exe" and process.args : "C:\\nondefault\\System\\*.exe" and process.args : "/u") and 
     not (process.name : ("rundll32.exe", "regsvr32.exe", "regasm.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
     not process.executable : ("?:\\WINDOWS\\Microsoft.NET\\Framework\\*\\caspol.exe", "?:\\Windows\\System32\\Vmw.exe") and
     not (process.name : "rundll32.exe" and
          process.args : ("printui.dll,PrintUIEntry", "user32.dll,UpdatePerUserSystemParameters", "dfshim.dll,ShArpMaintain")) and
     not (process.name : "regsvr32.exe" and process.args : ("?:\\Windows\\sysWOW64\\*.ocx", "?:\\EQ\\System\\QXLAddInDialogs.exe")) and
     not (process.code_signature.subject_name : "Dassault Systemes SolidWorks Corp." and process.code_signature.trusted == true) and
     not (process.parent.name : "cscript.exe" and
          process.parent.args : "?:\\Windows\\Options\\SWD\\MapHomeDrive_*.vbs" and process.name : "mshta.exe") and
     not (process.name : "rundll32.exe" and process.parent.args : "?:\\Program Files (x86)\\PCMatic\\PC Matic\\registerActiveX.wsf") and
     not process.command_line : "mshta.exe" and
     not (process.name : "wscript.exe" and process.args : "\\\\*\\netlogon\\*.vbe") and
     not (process.name : "rundll32.exe" and process.args: "C:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper32.dll,#1") and
     not (process.name: ("cmd.exe", "regsvr32.exe") and process.parent.executable : "C:\\Windows\\SysWOW64\\mshta.exe") and
     not (process.executable : "?:\\Windows\\System32\\odbcconf.exe" and process.args : "configdsn") and
     not process.hash.sha256 in ("13eacb4b57ac207f7f5c118915359a6e66a7f52f7154f8bb577f54b48b0d5e68", "6e0cb7d79cfc0b51468904701ff5227270180b9c8ff79d181000049ce991fc5a") and
     not (process.parent.name : "mshta.exe" and
          process.executable : ("C:\\Windows\\SysWOW64\\cmd.exe", "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe") and
          process.working_directory : ("C:\\Users\\*\\AppData\\Roaming\\DriverPack Notifier\\bin\\", "\\\\*")) and
     not (process.parent.executable : "C:\\Windows\\SysWOW64\\mshta.exe" and process.name : "rundll32.exe" and process.args == "dsquery.dll,OpenQueryWindow") and
     not (process.name : "cmd.exe" and process.command_line : "\"C:\\Windows\\System32\\cmd.exe   /C mklink /D *")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"