Startup Persistence by a Low Reputation Process

[rule]
description = """
Identifies when a process with low or unknown reputation is writing to commonly abused persistence locations (registry
run keys and startup folder). Adversaries may use this technique to maintain persistence on an endpoint.
"""
id = "45322752-e899-40ee-a0ba-b4d8d38ed151"
license = "Elastic License v2"
name = "Startup Persistence by a Low Reputation Process"
os_list = ["windows"]
reference = [
    "https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ee851671(v=msdn.10)",
    "https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four",
]
version = "1.0.13"

query = '''
sequence by process.entity_id with maxspan=5m
 [process where event.action == "start" and
 (process.Ext.relative_file_creation_time <= 1800 or process.Ext.relative_file_name_modify_time <= 1800) and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and
 not process.code_signature.status like "errorCode_endpoint*" and
 not process.pe.imphash in ("952608687d343553fa2ebbe1a801044c",
                            "2ac0df3cb49d714c81e70b5b92c304f2",
                            "367254f4e83f62f5437681fde2e55f48",
                            "0d45614ce1da2206df8b743dab46d7e4") and
 not process.hash.sha256 :
                 ("933129e6153f10ed921d772467507389fc4f5d58846b89d3d7b5799cb23eb9b6",
                  "43eceb752381fc93992a317a3df6e3921f06ed5e45de808a75ffe3fe2e0afb89",
                  "f40b81f1d192c9494f35353df39072debe72c1284e3d16859979476ba1fad96f",
                  "d348833bf2d4666c5eff291d828d018bb70769dafdaf05347b63c5afcf5e2961",
                  "339a9a4b49467f9797204a5e27d73a8d72cc6c91ff1e9132a01910b20a64a48b",
                  "6a88b5179dd5560d3e11ba0962b23a414a9f26838a7a80472453437d821c8047",
                  "a9a5e36f77e5031436d8eaf16a01bdb27dc301a632eda8b0c0613d8508dca5c2",
                  "a748e17d33fe2dd47371c3c1d9a6625eeb871a262e508d15cb81de62e1cce7ac",
                  "035dfedcac91168ae84873a5eab6fc81cc914d2b8092babc162b019a885203e9",
                  "4f2629239477b651b96a456ec867ffb8f316bc7d87bab911f137bf5f74514268",
                  "901a1857c16856a3bf8854dbcd5813e15fc5cf5b13abee1ec9468c721977f415",
                  "756c03e14eeea5ce275fa4e5efd5b2af4c18deff55b2c7622ce6c21c7f226332",
                  "22ee08ed8c02358f994b5deba0940735b161f9a73ad60e4e57d10b9e1988ec83",
                  "4626fe6b05a7582fb3c824bae7b17f7418ec7796fb3e9ef22cb88af5516e084b",
                  "d57cdf9fe51debc65441be155eddb663cebfaec1c0c91161234dd3398ca71b76",
                  "04c9afe31fa9fd8340d19b0c0dd11ad9387f5f3e38045a04e4cdb97c8ebfa90b",
                  "d57cdf9fe51debc65441be155eddb663cebfaec1c0c91161234dd3398ca71b76",
                  "7428a9ceb04e588440d4847f3896ca2e024964e5e22111f2726cdd8c9445e1f4",
                  "a356832423f7fe4f2047daeefb33f968b8e2d6e87541e6d461baa4d0fc10fe76",
                  "ca7a8dabbd526f20bc0a947e9fb1e68d47c5aaf339c677d4f8d6bc90d07c1298",
                  "f1580a81a26f3b106f8c9169552191557037a019f4b6fd61ed86efc2ef2b0cc3",
                  "ce5576f49666f06fbb6798ce23b127075b66d45bb05affa55c2ab875adad2069",
                  "fb4e88e790fa47ba403b1142183e4288437963db487b56c7e02407fa2808cbec",
                  "7810ddb62441ed631136ed2e0d5c4a0f7ebe1fdb00b7db32f6952222ecef2b36",
                  "f112a55944329900e670033dc84560703fa4e271bf5be13cc5a14da603155548",
                  "a7bf2135d423ef1a84c35780bb8208a85df23c7228dbb2e3d5b9d5aec989ad2b",
                  "4997ec399b1292a8698366c605ebfaf72cb5089682a75c408978cb87c8d3a5a3",
                  "6680172392ee701a714d14bb010a00a054e102c664152bfc244dd74d0e32694d",
                  "2e2750ca395a0104571e97a77301d6332631592bd9062d6be425a2b32a049ed5") and
 not (process.executable : "C:\\Windows\\Temp\\AgentInstall.exe" and user.id : "S-1-5-18") and
 not process.executable : ("?:\\Windows\\ccmcache\\*.exe", "C:\\Windows\\SystemTemp\\*.exe") and
 not (process.executable : "C:\\Users\\*\\AppData\\Local\\Temp\\is-*.tmp\\*.tmp" and process.args : "/SL5=$*")]
 [any where event.category : ("registry", "file") and event.action != "deletion" and
   (
    (registry.data.strings != null and
     registry.path :
         ("H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
		 "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
		 "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
		 "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
		 "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
		 "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
		 "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
		 "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
		 "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
		 "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
		 "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
		 "*\\exefile\\shell\\open\\command\\*") and
     not registry.data.strings : ("\"C:\\Program Files*", "C:\\Program Files*")
     ) or
    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")
   )]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.10.0"