Execution of a File Dropped from SMB via Services

[rule]
description = """
Identifies the execution of a file that was created by the virtual system process and subsequently executed as a child
of services.exe. This may indicate lateral movement via remote services.
"""
id = "713501c8-d1fa-49be-bf91-0ae916a088f6"
license = "Elastic License v2"
name = "Execution of a File Dropped from SMB via Services"
os_list = ["windows"]
version = "1.0.20"

query = '''
sequence with maxspan=3m
  [file where event.action != "deletion" and
   /* library dropped via SMB */
   process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-*") and
   (file.extension : "exe" or file.Ext.header_bytes : "4d5a*")] by file.path

  [process where event.action == "start" and

    process.parent.name : "services.exe" and

    (
     process.executable : ("?:\\ProgramData\\*", "?:\\Users\\*", "?:\\Windows\\Tasks\\*") or
     (process.executable regex~ """[A-Za-z]:\\Windows\\[a-zA-Z0-9\-\_\.]+""" and process.code_signature.exists == false)
    ) and

    /* Signed False Positives */

	 not (process.code_signature.subject_name :
	                  ("RAPIDFIRE TOOLS INC.",
					   "Arcserve (USA) LLC",
					   "PDQ.COM CORPORATION",
					   "Veeam Software Group GmbH",
					   "Veeam Software AG",
					   "LANDesk Software, Inc.",
					   "Cynet Security LTD",
					   "CyberArk Software Ltd.",
					   "Barracuda Networks, Inc.",
					   "AVG Technologies Canada, Inc.",
					   "ConnectWise, Inc.",
					   "Ivanti, Inc.",
					   "FUJITSU LIMITED",
					   "Shavlik Technologies",
					   "Kaspersky Lab JSC",
					   "Netalytics Security Inc",
					   "Elasticsearch, Inc.",
					   "Netwrix Corporation",
					   "Power Admin LLC",
					   "Notepad++",
					   "The Apache Software Foundation",
					   "HashInclude Computech Pvt. Ltd.",
					   "DIGITAL DEFENSE, INC",
					   "Snow Software AB",
					   "GOVERLAN, LLC",
					   "Veritas Technologies LLC",
					   "Bitdefender SRL",
					   "Kaseya Corporation",
					   "Insecure.Com LLC",
					   "ZOHO Corporation Private Limited",
					   "VMware, Inc.",
					   "Medical Information Technology, Inc.",
					   "baramundi software AG",
					   "ServiceNow, Inc.",
					   "Panda Security, S.L.",
					   "CoSoSys SRL",
					   "N-ABLE TECHNOLOGIES LTD",
					   "CISCO SYSTEMS, INC.",
					   "TeamViewer Germany GmbH",
					   "SysAid Technologies LTD",
					   "Sophos Ltd",
					   "Ericsson",
					   "Tenable Network Security Inc.",
					   "NETSUPPORT LTD.",
					   "Lansweeper",
					   "Helge Klein GmbH",
					   "Netwrix Corporation",
					   "highsystem ag",
					   "Beyondtrust Software Inc",
					   "Oracle America, Inc.",
					   "KnowBe4 Inc.",
					   "GoTo Technologies USA, LLC",
					   "Icona S.R.L.",
					   "LogMeIn, Inc.",
					   "Dell Inc.") and process.code_signature.trusted == true) and

	  not (process.code_signature.subject_name in ("Medical Information Technology, Inc.", "CyberArk Software Ltd.", "VMware, Inc.") and
	       process.code_signature.status in ("errorTimeStamp", "errorChaining")) and

    /* unsigned FP - PowerAdmin LLC 8a203d0dd4821b42ca399140e093919348b60ac43140e92f88d047263e2c57b4 */
    not (process.pe.original_file_name == "PAExec.exe" and
         process.executable : "?:\\Windows\\PAExec-*.exe" and process.parent.name : "services.exe") and

    not (process.pe.original_file_name : "psexesvc.exe" and
	     process.code_signature.subject_name in ("Sysinternals", "Microsoft Corporation") and
         process.code_signature.trusted == true and process.name : "PSEXESVC.EXE") and

    not (process.pe.original_file_name == "psloglist.exe" and
	     process.code_signature.subject_name in ("Sysinternals", "Microsoft Corporation") and
         process.code_signature.trusted == true and not process.args : "-c") and

    not (process.code_signature.subject_name == "Microsoft Corporation" and
	       process.code_signature.trusted == true and
	       process.pe.original_file_name : ("MOMAgentInstaller.exe", "dotnet-hosting-*-win.exe", "dpmac.exe",
	                                         "migrate.exe", "Ms.Dsp.Do.Inc.Installer.exe", "OpenHandleCollector.exe")) and


    /* unsigned FPs */

    /* Alignia Remote Command Execution Manager  */
    not (process.pe.original_file_name == "T4RCEM.exe" and process.args : "10000" and
	     process.parent.name : "services.exe" and process.args_count >= 4) and

    /* unsigned McAfee Remote Installer */
    not (process.pe.original_file_name == "wstub32.exe" and
	     process.args : "/InstDir=<PROGRAM_FILES_DIR>\\McAfee\\Agent" and
         process.args : "/Install=Agent" and process.parent.name : "services.exe") and

    /* FortiClientSetup - unsigned */
    not (process.pe.original_file_name == "FortiClientSetup.exe" and
	     process.args : "/schid" and process.args : "/deviceid" and process.parent.name : "services.exe") and

    /* fart-it.sourceforge.net, IseExecSvc, OCS Inventory Agent,Tenable MW Scanner and HPCmdSvc */
    not process.hash.sha256 in
	         ("c9ef35bed70ffa0981bafd0071185b56fdad8f9c97f3582a4dae9b420959fb97",
	          "18dc098895ccc8246d417445a36d933c5f8487419b848ebe651fd0e11cb22afa",
	          "ea98309a35f92443b9c50736ce208656ec72af114ec8aceeb02dfa041ec2d6bc",
	          "bcf07679ea026f1dfba6f9ab63251e4834dc007bd2c5b9039deb9d900fe1c5e6",
	          "1c6af94b26f369e2c10819eefb869f873e5540e2c1b7bf4c7c632fc03d67368a",
	          "6dfc3a0733f427779b250913811baa429002042cb8e7732ea7d334bf725b8bd0",
	          "ae0fb4bf4a6faa4b808794b6e6ccbdf9f10c1ce01a86ccece002ac63cf09ff29",
	          "cd5ff596b7bacb117f90893f94fd8c542b659cc58f90ed1fbd0471fe85148bff",
	          "5e7785fede192d69e408c8c41ba14aead2f4b297c9faecc991e061b093b91f70",
	          "08d019e46a8755c33ad9ff9b96b5409a9005d87ba4e3cc58bdd8cf10eb0cd987",
	          "81e6e6feaac8b3267608af98667d3ccf78a15e540e6a5d18858d9147aacd1e16",
	          "a07b0b72bb00d9e9debd38c2b4bd770beb7d6cf6148d2f7fba50d7a7078deb04",
	          "bc10fdc46d17765c619db70ef19cd3755a3270692481d8417bfff3fceb4eba10",
	          "bb53243baeb4e4cc204e5b9981cc0c671e0855f56293df5106b9b3beac30cc15",
	          "c5593f5d965994a50985b529e77b97c348c7af084dbbaba270d83b1b06302d2c",
	          "7f8e465edd27cdcd1d28292c35440d745b8bd528e21d6f56eb683b65d922eaed",
	          "ef7dbfe3a3910ddb93989f0d5d8f1fb4d39e0df7e53f55d042f4ccd80699c81f",
	          "bb53243baeb4e4cc204e5b9981cc0c671e0855f56293df5106b9b3beac30cc15",
	          "bc10fdc46d17765c619db70ef19cd3755a3270692481d8417bfff3fceb4eba10",
	          "ef7dbfe3a3910ddb93989f0d5d8f1fb4d39e0df7e53f55d042f4ccd80699c81f",
	          "39b3ae96186b7e62b9176e6d2ae27db3e164a7c8c52c094c811dd19d651577f2",
	          "5e7785fede192d69e408c8c41ba14aead2f4b297c9faecc991e061b093b91f70",
	          "b9fc7dea50ce1e0637a3628abc89f96d8cfaad1b7c6ad33dd8bb17028ed3eaee",
	          "5e81eaedc6bba9c9b475f990cdc31ee3c48962fffb63d65afc1447ea6b95f910",
	          "ec7d2582c06d28191b2efaf6780cdfa5c1319f3081bd001d4572cbeea0068b48",
	          "4208e349ff97a2dc6100ee9e5e61e23ab650b316e62dd4a25d1119a08a59f298",
	          "c4c6b0db707020364cd398d2a7a3eb2516cfeb0a011557dce3393e25eaa90be4",
	          "4feacc0b469215c816865909aedcb52834acab86d9677a74ec559529290373e9",
	          "141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b69944",
	          "ae43b51f5c5795eba6fffbcf901ced7215b86342451aa4ef39b4f2d8f649fa81",
	          "11a4758eaaf7bd88ff826860441658905ee2d5198efbdc61259136a3f968c8f5",
	          "47dbc1fda7e540f996a6ef035b476cd50987c5bf163c04334752a051c05ae37d",
	          "c71ddd9aeaed18b6a3e6c80119504ececdfa329328e4a814913be6113c8efb1d",
	          "dbc16e5afe0c0922df779952350d7fb5103a54ae7767b97d192e2d90a76ed88a",
	          "5e1e2c6a88711a716805695996d2e9906de713ec3abd9eb5376b087438f33a40",
	          "79db4d8a9a8e87214d20eef964bc9bfc3a7f5abf162d98fa7eae2dd7e96ef272",
	          "7f8e465edd27cdcd1d28292c35440d745b8bd528e21d6f56eb683b65d922eaed",
	          "3b47eeb28734ced42682be0806786ae4ac460bf7545934bae5fc367df23fa6e9",
	          "2b25e0331289460dbaed2d851b92f43e6999f694bf17964a8786f3a4cce602a6",
	          "67201716f8126a0445cda79f55336140066071acb4d72d9a489e19125d3aa8f6",
	          "87952d419caf8fe11dad35f63ac1d09ba58fb9347567557750e24d1ff271fbb7",
	          "9c2ffb59617d1e0710f04aa0b3541a089c2b5e0e81072511a16b78922fe204a9") and

    not (process.pe.original_file_name == "PortalService.exe" and
	     process.executable : "E:\\EZ\\EZAccess\\Service\\*\\PortalService.exe" and process.parent.name : "services.exe") and

	not (process.code_signature.subject_name == "CyberArk Software Ltd." and
	     process.executable : "?:\\Windows\\CAInvokerService.exe" and process.pe.original_file_name == "PSMWinAgentInvoker.exe")
  ] by process.executable
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.002"
name = "SMB/Windows Admin Shares"
reference = "https://attack.mitre.org/techniques/T1021/002/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "7.15.0"