Suspicious Execution from INET Cache

[rule]
description = """
Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious
content via WININET during initial access.
"""
id = "7731dc20-5216-49dc-95fe-a29321a345d5"
license = "Elastic License v2"
name = "Suspicious Execution from INET Cache"
os_list = ["windows"]
version = "1.0.5"

query = '''
process where event.action == "start" and
  process.parent.name : ("explorer.exe", "winrar.exe", "7zFM.exe", "Bandizip.exe") and
  (process.command_line : "*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" or
   process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*") and
  not (process.code_signature.subject_name :
             ("Google LLC", "Google Inc","Mozilla Corporation", "Zhuhai Kingsoft Office Software Co., Ltd.",
              "VideoLAN") and
       process.code_signature.trusted == true) and
  not (process.name : "rundll32.exe" and
       process.args : ("cryptext.dll,CryptExtAddCER", "cryptext.dll,CryptExtOpenCER", "ieframe.dll,OpenUR", "C:\\Windows\\System32\\ieframe.dll,OpenURL")) and
  not process.executable :
                 ("?:\\Program Files\\*.exe",
                  "?:\\Program Files (x86)\\*.exe",
                  "?:\\Windows\\System32\\mspaint.exe",
                  "?:\\Windows\\System32\\notepad.exe",
                  "C:\\Windows\\SysWOW64\\Codecs\\mpc-hc.exe",
                  "?:\\Windows\\CCM\\*.exe",
                  "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe") and
  not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft*")
'''

min_endpoint_version = "7.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.16.0"