Startup Persistence via Unusual Process

[rule]
description = """
Identifies files written to or modified in the startup folder by an unusual Microsoft process. Adversaries may use this
technique to maintain persistence.
"""
id = "95d13ce1-ffb2-4be8-a56e-cc9a891e81e2"
license = "Elastic License v2"
name = "Startup Persistence via Unusual Process"
os_list = ["windows"]
version = "1.0.38"

query = '''
file where event.action != "deletion" and
  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
  process.executable : "?:\\Windows\\*" and
  /* Issue #297 */
  not file.name : "desktop.ini" and
  not process.executable : "?:\\Windows\\Application Compatibility Scripts\\acregl.exe" and
  not process.executable : "?:\\Windows\\Temp\\*.exe" and
  not user.id : "S-1-5-18" and
  not process.name :
           ("wscript.exe",
            "cscript.exe",
            "powershell.exe",
            "explorer.exe",
            "dllhost.exe",
            "notepad.exe",
            "cmd.exe",
            "Robocopy.exe",
            "xcopy.exe",
            "wuauclt.exe",
            "msiexec.exe",
            "CompPkgSrv.exe",
            "rundll32.exe",
            "svchost.exe",
            "sc.exe",
            "backgroundTaskHost.exe",
            "AppVClient.exe") and
  not file.extension : ("TMP", "INF", "INI", "DDF", "CAB", "RPT", "RDP", "ppk")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "7.15.0"