Process Injection Initiated By MMC

Author: FalconForce
Source: github.com/FalconForceTeam/FalconFriday

This query searches for suspicious behavior initiated by MMC. This is done by looking at a number of actions that are commonly associated with process injection.

Known false positives

Some legitimate MMC snap-ins may perform actions that are similar to process injection. These will require additional filtering.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1055` Process Injection `T1218.014` System Binary Proxy Execution: MMC

References

https://www.elastic.co/security-labs/grimresource

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceEvents` action `CreateRemoteThreadApiCall`: CreateRemoteThread API call
Microsoft Defender for Endpoint	`DeviceEvents` action `MemoryRemoteProtect`: Remote virtual memory protection change
Microsoft Defender for Endpoint	`DeviceEvents` action `NtAllocateVirtualMemoryRemoteApiCall`: Remote virtual memory allocation (NtAllocateVirtualMemory)
Microsoft Defender for Endpoint	`DeviceEvents` action `NtMapViewOfSectionRemoteApiCall`: Remote section map (NtMapViewOfSection)
Microsoft Defender for Endpoint	`DeviceEvents` action `QueueUserApcRemoteApiCall`: Remote APC queued (QueueUserApc)
Microsoft Defender for Endpoint	`DeviceEvents` action `ReadProcessMemoryApiCall`: ReadProcessMemory API call
Microsoft Defender for Endpoint	`DeviceEvents` action `SetThreadContextRemoteApiCall`: Remote thread context change (SetThreadContext)

Rule body

let timeframe = 2*1h;
DeviceEvents
| where ingestion_time() >= ago(timeframe)
| where InitiatingProcessFileName =~ "mmc.exe"
// Look for actions associated with process injection.
| where ActionType in~ ("CreateRemoteThreadApiCall", "MemoryRemoteProtect", "NtAllocateVirtualMemoryRemoteApiCall", "NtMapViewOfSectionRemoteApiCall","ReadProcessMemoryApiCall", "SetThreadContextRemoteApiCall", "QueueUserApcRemoteApiCall")
| extend ParsedCommandLine=parse_command_line(InitiatingProcessCommandLine, "windows")
// When a .msc file is opened in MMC, the file path is passed as an argument to MMC.
// Based on testing this is the first argument in the command line. In some cases a command-line switch /32 is passed as the first argument
// and the file path is the second argument. This is handled by the iif statement below.
| extend MscFile=ParsedCommandLine[1]
| extend MscFile=iif(MscFile startswith "/", ParsedCommandLine[2], MscFile)
// Begin environment-specific filter.
// End environment-specific filter.

Stages and Predicates

Parameters

let timeframe = 2*1h;

Stage 1: `source`

DeviceEvents

Stage 2: `where`

| where ingestion_time() >= ago(timeframe)

Stage 3: `where`

| where InitiatingProcessFileName =~ "mmc.exe"

Stage 4: `where`

| where ActionType in~ ("CreateRemoteThreadApiCall", "MemoryRemoteProtect", "NtAllocateVirtualMemoryRemoteApiCall", "NtMapViewOfSectionRemoteApiCall","ReadProcessMemoryApiCall", "SetThreadContextRemoteApiCall", "QueueUserApcRemoteApiCall")

Stage 5: `extend` (3 consecutive steps)

| extend ParsedCommandLine=parse_command_line(InitiatingProcessCommandLine, "windows")
| extend MscFile=ParsedCommandLine[1]
| extend MscFile=iif(MscFile startswith "/", ParsedCommandLine[2], MscFile)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	in	`CreateRemoteThreadApiCall` `MemoryRemoteProtect` `NtAllocateVirtualMemoryRemoteApiCall` `NtMapViewOfSectionRemoteApiCall` `QueueUserApcRemoteApiCall` `ReadProcessMemoryApiCall` `SetThreadContextRemoteApiCall`	`field:"ActionType" kind:in`
`InitiatingProcessFileName`	eq	`mmc.exe`	`field:"parent_process_name" kind:eq value:"mmc.exe"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ParsedCommandLine`	`extend`
`MscFile`	`extend`