Self Service Persistence by an Unsigned Process

[rule]
description = """
Identifies when a recently dropped unsigned process attempt to register itself to run as service. Adversaries may use
services to maintain persistence or run with System privileges.
"""
id = "e5ad5d97-da99-4371-9611-b6dfa8e55e30"
license = "Elastic License v2"
name = "Self Service Persistence by an Unsigned Process"
os_list = ["windows"]
version = "1.0.27"

query = '''
sequence with maxspan=5m 

[process where event.action == "start" and 

 (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and 
 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and

  not process.code_signature.status : ("errorExpired", "errorCode_endpoint*") and

  (
   process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*") or
   process.parent.executable : "?:\\Windows\\System32\\services.exe" or
   process.executable regex~ """c:\\windows\\[a-z0-9\-\_\.]+\.exe"""
   ) and
  not process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe", "?:\\windows\\BTExecService-BDA\\BTExecService.exe") and
  not process.hash.sha256 :
                   ("e68743f3a0c299024e1540add1bcd9d3658ebbdbf172d74e1bf8fcd8c8c0406b",
                    "2b5923d303fa2ec5ba263d745654873e2efbde2d341d0a94e72c5d51fab72957",
                    "451b5850e88fe552dac685c03ce6ecb4fbb4fc42f4c9669627942d807d237681",
                    "7e5490652e367d1ea0400ed95788afb4e067373e5f8bf73165b7f7fde20d1b27",
                    "97f217682ed5e6ab2a01144b33a7a5bf5f7354ef5a7180c0b3140e879d4d7cb1",
                    "7198c02935b3714c455ee94305d2a21d900d72ac67049c11a1e842572ad6c5e1",
                    "5859b114d96800a2b98ef9d19eaa573a786a422dad324547ef25be181389df01",
                    "72b21ed3aba756bf04df4daf5f8d4bd14437f118087ac51a51053cce7b1663c8",
                    "e94fb53cd47723ac3afec0f8c587bbf1841e64943f230b18ad63322f92ce4606",
                    "29a187322c91af564eb259b6b2834d0530d9c7bf0f7c7e42a1c911679cdb745e",
                    "fd7499214abaa13bf56d006ab7de78eb8d6adf17926c24ace024d067049bc81d",
                    "acd55c44b8b0d66d66defed85ca18082c092f048d3621da827fce593305c11fd",
                    "3e58f6c403a9b0831df2cc274974afe7243a00917f35dfdb13e00fae1d946d1c",
                    "eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848",
                    "8cd4c208e2ced274815494ca9f6d4eb312e8f71cc2be65a20404d64adbefbe12",
                    "ebda37f76e80c5b4448fe7d0540c72050695c70784b44453a8da81c5e50fd5ef",
                    "44303d6572956f28a0f2e4b188934fb9874f2584f5c81fa431a463cfbf28083b",
                    "7e0ff000ce7cacd201a76a017ee669f34e71f557fa468280cf27b0d2370dd8ad",
                    "aab295ce1dc964bf974dd65d6e8ba70f7b642685821b37c108684e3a98f64ff4", 
                    "1763dc3ac351161da0fc134cef0a7c1bfbbd19463c48a42d55985f17f6b45cdc", 
                    "ec1cd16be0aac4b18609ec7c0cdc5e51d10f9203d4e017a091ee8a4568f9c619", 
                    "64053277d46fb0db07611c1cd619b904d039b1e76082cca65ed5a4034a39be21", 
                    "62af6a3e37047acae9fe7ba9ed5bf9b41718b8c5fcf147f527144b03d84861b0",
                    "fd391225b55a0513c2a50a62b90a4bf87534da59411bd05959ac6a93bfdcdcf2",
                    "a26a834e377a1d5497db3f36dde869a589673328190f2e3e694eb7ccea57cd66",
                    "5fb696679dab7b4dea9852885f0ca8aff63e399e94c1d9c8dc114420d0f9b965",
                    "7d41402aac188efeeb90baad6d2a38e42ce283bf21c2cfac7ac2419ab2e2a251",
                    "130282ab234ef72675cb1ac8663e096192e341f2fdee1c2955f6aba001b7343c",
                    "42ea019508bdf7c6b15886bbac2e28353f69f3742816ba47c36e70ddedfa5d05",
                    "9d08b7019d28c1d5120f752e91bd4c235da5b0f3c7af3a30f75e23bb4315ec6a",
                    "f689ee9af94b00e9e3f0bb072b34caaf207f32dcb4f5782fc9ca351df9a06c97",
                    "1f68773f31ce29bd93899f53cc51fc1ea3e97417fc3edaf0b4253cae288cfd23",
                    "577f27c106fe326806d16df1f0d9e0e4de1c00a1d0026cbf2f79dd9ea822904e",
                    "dba13850910570f2c2b428053c95f5a6bf587b80ead0589448f43308c900d204",
                    "2fcfbf3d19594a991a633fb8132dfe36be6e38e2dbfc815761f7e532dc0908fd",
                    "b82f73ace709e65767e187911cde8d04fdb0e68c28261362bbff086691a80627",
                    "580c4bdeac06688f82c9f9f6b38cbeefa6f7c6d7b57425241ba884511147aa75",
                    "5b7f9706f59fccd0d6cd56b711f44793f62b1bbc4ea95db937c982219365553b",
                    "8dc1c71fcb569b0ec1771fe19d9e6befbacf97bf550dac219852b001f2f97356",
                    "f64d2f78f82723d9c464781fcd79524600a54a91641588b8e301c5805d869d5a",
                    "6e79a28054bfee230a45399ca37a2b4edfb8c9c21ae6d99afa39e601e13ab056")
  ] as event0
  
[registry where 

  registry.path : "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\ImagePath" and 
  
  (
   startswith~(registry.data.strings, event0.process.executable) or 
  
   /* registry.data.strings value may start with quotes */
   startswith~(registry.data.strings,  concat("\"", event0.process.executable))
   )
  ]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.4.0"