Suspicious Impersonation as Trusted Installer

[rule]
description = """
Identifies actions performed by a process with an impersonation security token running as the Windows Trusted Installer
service. Adversaries may need to impersonate this service to modify certain system protected resources.
"""
id = "cc35ee3e-d350-4319-b7f3-ea0d991ce4d9"
license = "Elastic License v2"
name = "Suspicious Impersonation as Trusted Installer"
os_list = ["windows"]
reference = ["https://www.tiraniddo.dev/2017/08/the-art-of-becoming-trustedinstaller.html"]
version = "1.0.37"

query = '''
any where process.executable != null and 
 (
  /* file or registry events */
  (Effective_process.name : "TrustedInstaller.exe" and not event.action in ("query", "open") and  
   not (process.executable : "?:\\Windows\\system32\\svchost.exe" and 
        file.path : ("?:\\windows\\system32\\config\\systemprofile\\*",
                     "?:\\ProgramData\\Malwarebytes Endpoint Agent\\Plugins\\EDRPlugin\\Backup\\*.frb")) and
   not (process.executable : "?:\\Program Files\\ProfileUnity\\FlexApp\\ContainerService\\x64\\VirtFsService.exe" and
        process.code_signature.subject_name : "Liquidware Labs, Inc." and process.code_signature.trusted == true) and
   not (process.executable : "?:\\Windows\\System32\\services.exe" and file.path : "?:\\Windows\\INF\\*.PNF") and
   not (process.executable : "?:\\Windows\\System32\\services.exe" and
        registry.path : "HKEY_USERS\\.DEFAULT\\Software\\Classes\\Local Settings\\MuiCache\\*") and
   not (process.executable : "?:\\Windows\\system32\\svchost.exe" and 
        registry.path : 
	        ("HKLM\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\*", 
		     "HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\*"))) or

  /* process events */
  (process.Ext.effective_parent.name : "TrustedInstaller.exe" and
   process.parent.name != null and process.hash.sha256 != null and
   not (process.executable :
               ("?:\\Windows\\WinSxS\\*\\TiWorker.exe",
                "\\Device\\HarddiskVolume*\\Windows\\WinSxS\\*\\TiWorker.exe",
                "\\Device\\VhdHardDisk*\\Windows\\WinSxS\\*\\TiWorker.exe",
                "\\\\?\\Volume{*}\\Windows\\WinSxS\\*\\TiWorker.exe") and
         process.parent.executable : 
	            ("?:\\Windows\\System32\\svchost.exe",
	             "\\Device\\HarddiskVolume*\\Windows\\System32\\svchost.exe",
	             "\\Device\\VhdHardDisk*\\Windows\\System32\\svchost.exe",
	             "\\\\?\\Volume{*}\\Windows\\System32\\svchost.exe")) and

   not (process.executable :
                ("?:\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe",
                 "C:\\Windows\\SystemTemp\\ScreenConnect\\*\\Temp\\SecurityHealthSetup.exe",
                 "\\Device\\HarddiskVolume*\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe",
                 "\\Device\\VhdHardDisk*\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe",
                 "\\\\?\\Volume{*}\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe",
                 "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe") and
         process.code_signature.subject_name in ("Microsoft Windows Publisher", "Microsoft Corporation", "Microsoft Windows") and process.code_signature.trusted == true) and
		 
   not (process.executable : 
               ("?:\\Windows\\System32\\WerFault.exe", 
                "\\Device\\HarddiskVolume*\\Windows\\System32\\WerFault.exe", 
                "\\Device\\VhdHardDisk*\\Windows\\System32\\WerFault.exe", 
                "\\\\?\\Volume{*}\\Windows\\System32\\WerFault.exe") and 
        process.parent.executable : 
                ("?:\\Windows\\servicing\\TrustedInstaller.exe", 
                 "\\Device\\HarddiskVolume*\\Windows\\servicing\\TrustedInstaller.exe",  
                 "\\Device\\VhdHardDisk*\\Windows\\servicing\\TrustedInstaller.exe", 
                 "\\\\?\\Volume{*}\\Windows\\servicing\\TrustedInstaller.exe",
                 "?:\\WINDOWS\\System32\\svchost.exe")))
) and 
   not (process.executable : ("?:\\Program Files (x86)\\Panda Security\\*.exe", "?:\\Program Files\\Panda Security\\*.exe") and
        process.code_signature.trusted == true and process.code_signature.subject_name : "Panda Security S.L.") and

   not process.hash.sha256 in
                 ("1e07a7a91451303d5cdac0a1673d581f5f7198fcc08fc79e4332aba6400f55a8",
                  "f14ea2efbbf0298963f8a574d6b139616ce6bb1e8ab97848d73312c4184b3812") and

   not (process.executable : "?:\\Windows\\System32\\services.exe" and
        registry.path : "HKEY_USERS\\.DEFAULT\\Software\\Classes\\Local Settings\\MuiCache\\*") and

   not (process.parent.executable : "?:\\Program Files\\ProfileUnity\\FlexApp\\ContainerService\\x64\\VirtFsService.exe" and
        process.executable : "?:\\Program Files\\ProfileUnity\\FlexApp\\ContainerService\\x64\\Sentinel\\LwIoSentinel.exe") and

   not (process.executable : "?:\\Program Files (x86)\\Kaspersky Lab\\*.exe" and
        process.code_signature.trusted == true and process.code_signature.subject_name : "Kaspersky Lab JSC") and

   not (process.executable : "?:\\Windows\\System32\\btservice.exe" and
        process.code_signature.trusted == true and process.code_signature.subject_name : "BeyondTrust Software, Inc") and

   not (process.executable : "?:\\Program Files\\Common Files\\McAfee\\AVSolution\\mcshield.exe" and
        process.code_signature.trusted == true and process.code_signature.subject_name : "MUSARUBRA US LLC") and

   not (process.executable : ("?:\\Program Files (x86)\\xagt\\xagt.exe", "?:\\Program Files (x86)\\FireEye\\xagt\\xagt.exe") and
        process.code_signature.trusted == true and process.code_signature.subject_name in ("FireEye, Inc.", "FireEye (Musarubra US LLC)")) and

  not (process.executable : "C:\\Program Files (x86)\\Panda Security\\WAC\\PSANHost.exe" and
       process.code_signature.trusted == true and process.code_signature.subject_name == "Panda Security S.L.") and

  not (process.executable : "C:\\Windows\\SoftwareDistribution\\Download\\Install\\SecurityHealthSetup.exe" and
       process.parent.executable : "C:\\Windows\\SoftwareDistribution\\Download\\Install\\SecurityHealthSetup.exe") and

  not (process.executable : "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\TiFileFetcher.exe" and
       process.parent.executable : "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_*\\TiWorker.exe" and
       process.code_signature.subject_name == "Microsoft Windows" and process.code_signature.trusted == true) and
	   
  not (process.executable : "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\kavfswp.exe" and
      process.code_signature.subject_name == "Kaspersky Lab JSC" and process.code_signature.trusted == true) and
  not (process.name : "rundll32.exe" and process.args : "C:\\WINDOWS\\system32\\davclnt.dll,DavSetCookie" and
       process.parent.executable : "C:\\Windows\\System32\\svchost.exe") and
  not (process.pe.original_file_name == "SecurityHealthSetup.exe" and process.code_signature.trusted == true and
      process.code_signature.subject_name == "Microsoft Windows" and process.Ext.effective_parent.executable : "C:\\Windows\\servicing\\TrustedInstaller.exe") and
  not (event.action == "deletion" and process.executable : "C:\\Windows\\System32\\svchost.exe" and file.path : "C:\\Windows\\Logs\\SRP\\SRP.log")
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1134"
name = "Access Token Manipulation"
reference = "https://attack.mitre.org/techniques/T1134/"
[[threat.technique.subtechnique]]
id = "T1134.001"
name = "Token Impersonation/Theft"
reference = "https://attack.mitre.org/techniques/T1134/001/"

[[threat.technique.subtechnique]]
id = "T1134.002"
name = "Create Process with Token"
reference = "https://attack.mitre.org/techniques/T1134/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.4.0"