Suspicious Image File Execution Options Modification

[rule]
description = """
The Debugger and SilentProcessExit registry keys can allow an adversary to intercept the execution of files, causing a
different process to be executed. This functionality can be abused by an adversary to establish persistence.
"""
id = "ff5fd85a-e770-4e57-8bae-0d267442eb9f"
license = "Elastic License v2"
name = "Suspicious Image File Execution Options Modification"
os_list = ["windows"]
reference = [
    "https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/",
]
version = "1.0.33"

query = '''
registry where registry.data.strings != null and process.executable != null and 
 registry.path : ("HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*.exe\\Debugger",
                  "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*\\Debugger",
                  "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess",
                  "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess") and
   /* add FPs here */
 not registry.data.strings :
          ("?:\\Program Files*\\ThinKiosk\\thinkiosk.exe",
           "*\\PSAppDeployToolkit\\*",
           "%windir%\\System32\\taskkill.exe",
           "ntsd -d",
           "%1",
           "?:\\Program Files (x86)\\Siemens\\WinCC\\bin\\CCHelpStarter.exe",
           "SppExtComObjPatcher.exe",
           "rundll32.exe SppExtComObjHook.dll,PatcherMain",
           "rundll32.exe SECOPatcher.dll,PatcherMain",
           "C:\\Windows\\System32\\systray.exe",
           "C:\\Program Files (x86)\\CryptoLocker Prevention\\ShadowGuard.exe",
           "\"C:\\Program Files\\SolarWinds\\Orion\\Licensing\\Migration.exe\" /hooked",
           "\"C:\\Program Files (x86)\\FastTrack Software\\Admin By Request\\AdminByRequest.exe\" /AutoElevate",
           "\"C:\\Program Files (x86)\\SolarWinds\\Orion\\Licensing\\Migration.exe\" /hooked") and
 not (process.executable : "?:\\Windows\\System32\\svchost.exe" and registry.data.strings : "svchost.exe") and
 not process.executable :
             ("?:\\Program Files\\*.exe",
              "?:\\Program Files (x86)\\*.exe",
              "?:\\Windows\\SysWOW64\\MonitorConsole.exe",
              "?:\\Windows\\SoftwareDistribution\\Download\\Install\\PatchMyPC-ScriptRunner.exe",
              "?:\\ProgramData\\Heimdal Security\\Heimdal Thor Agent\\bin\\Heimdal.Wizard.exe") and
 not (process.code_signature.subject_name : ("Patch My PC, LLC", "EXPRSVPN LLC", "Nasiboot_USB", "FastTrack Software Aps", "Admin By Request ApS") and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.0.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[threat.technique.subtechnique]]
id = "T1546.012"
name = "Image File Execution Options Injection"
reference = "https://attack.mitre.org/techniques/T1546/012/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.0.0"