NewCredential Logon by a Suspicious Process

[rule]
description = """
Identifies NewCredential logon attempt with alternate credentials and by an unusual process. Adversaries may create a
new token to escalate privileges and bypass access controls.
"""
id = "2d560886-0d75-4b85-a909-a006063057d3"
license = "Elastic License v2"
name = "NewCredential Logon by a Suspicious Process"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1134/002/"]
version = "1.0.15"

query = '''
authentication where event.action == "log_on" and event.code == "4624" and
 process.Ext.session_info.logon_type == "NewCredentials" and process.executable : "C:\\*" and 
 user.id like ("S-1-5-21*", "S-1-12-*") and (user.effective.id != null and user.effective.id like ("S-1-5-21*", "S-1-12-*")) and
 not (process.code_signature.trusted == true and
      process.code_signature.subject_name in
           ("Veeam Software Group GmbH", "COGNYTE SOFTWARE LTD", "Varonis Systems, Inc.", "Ivanti, Inc.", "Becton, Dickinson and Company",
            "Royal Apps GmbH", "Acronis International GmbH", "Idera, Inc.", "Paessler AG", "Azul Systems, Inc.", "PDQ.com Corporation",
            "AO Kaspersky Lab", "Texod Technologies LLC", "Oracle America, Inc.", "Delinea Inc.", "itelio GmbH", "CyberArk Software Ltd.",
            "PDQ.COM CORPORATION", "baramundi software GmbH", "EASYVISTA SA", "Netwrix Corporation", "baramundi software AG",
            "CHENGDU YIWO Tech Development Co., Ltd.", "EASYVISTA SA", "ZOHO Corporation Private Limited", "Open Text Corporation", "Solarwinds Worldwide, LLC",
            "Texode Technologies LLC", "Genetec Inc.", "Octopus Cloud AG", "DocuWare GmbH", "Bomgar Corporation", "Netwrix Corporation",
            "Cocobolo Software, LLC", "Technosoft Solutions (Aust) Pty Ltd", "Trend Micro, Inc.", "Kaseya Holdings Inc", "ESET, spol. s r.o.")) and
 not process.executable :
            ("C:\\Windows\\System32\\runas.exe",
             "C:\\WINDOWS\\system32\\ShellRunas.exe",
             "C:\\Windows\\SysWOW64\\runas.exe",
             "C:\\Windows\\System32\\svchost.exe",
             "C:\\Windows\\System32\\wsmprovhost.exe",
             "C:\\Windows\\System32\\mmc.exe",
             "C:\\Windows\\System32\\lsass.exe",
             "C:\\Windows\\System32\\CredentialUIBroker.exe",
             "C:\\Windows\\System32\\inetsrv\\w3wp.exe",
             "C:\\Windows\\syswow64\\inetsrv\\w3wp.exe",
             "C:\\Windows\\SysWOW64\\msiexec.exe",
             "C:\\PSC\\Programs\\Projects\\Docket\\DKT.exe",
             "C:\\ManageEngine\\ADSelfService Plus\\bin\\Remcom.exe",
             "C:\\ManageEngine\\*\\bin\\WeakPasswordUsers.exe",
             "C:\\LogOS\\runnt\\custdlls\\pslist.exe",
             "C:\\CCAssistant*\\CCAStart.exe",
             "C:\\Program Files (x86)\\*.exe",
             "C:\\Program Files\\*.exe",
             "C:\\PROGRA~1\\*.exe",
             "C:\\POSTLOAD_2022\\PostLoad_21\\bin\\Debug\\PostLoad_21.exe",
             "C:\\Users\\*\\AppData\\Local\\Apps\\2.0\\*\\merg...app_*\\Client.exe", 
             "C:\\Dev\\V5\\PS\\CS\\Schedule Management\\bin\\Debug\\Schedule Management.exe") and
 not (process.name : ("powershell.exe", "powershell_ise.exe") and
      process.command_line : ("\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -File \"D:\\Scripts\\RestorePerfionVortag.ps1\"",
                              "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -File \"D:\\Scripts\\RestoreBCProd2M102.ps1\"",
                              "*Write-Output SNC_PowerShell_PID*", 
                              "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", 
                              "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy unrestricted -NoExit -Command -", 
                              "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell_ISE.exe\" ", 
                              "\"powershell.exe\" -NonInteractive -ExecutionPolicy Bypass -File C:\\Scripts\\AzureADSSO\\RolloverAzureADSSO.ps1")) and
 not (process.name : "powershell.exe" and process.parent.executable : "?:\\ServiceNow*\\agent\\jre\\bin\\java.exe") and
 not process.parent.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\CommonExtensions\\Platform\\Debugger\\VsDebugConsole.exe" and 
 not (process.parent.executable : "C:\\Windows\\system32\\rundll32.exe" and process.executable : "C:\\Users\\*\\AppData\\Local\\Apps\\2.0\\*\\sdaq.*\\SDAQ.exe")
'''

min_endpoint_version = "8.17.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.001"
name = "Token Impersonation/Theft"
reference = "https://attack.mitre.org/techniques/T1134/001/"

[[threat.technique.subtechnique]]
id = "T1134.002"
name = "Create Process with Token"
reference = "https://attack.mitre.org/techniques/T1134/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.17.0"