CyberArkEPM - Uncommon Windows process started from System folder

Severity: medium
Time window: 14d
Source: github.com/Azure/Azure-Sentinel

'Detects when uncommon windows proccess is started from System folder.'

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204` User Execution
Stealth	`T1036` Masquerading

Rule body

id: 16b940d2-aaf8-4eaa-a5e1-05df5f5c3d43
name: CyberArkEPM - Uncommon Windows process started from System folder
description: |
  'Detects when uncommon windows proccess is started from System folder.'
severity: Medium
requiredDataConnectors:
  - connectorId: CyberArkEPM
    dataTypes:
      - CyberArkEPM
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - DefenseEvasion
relevantTechniques:
  - T1204
  - T1036
query: | 
  let lb_period = 14d;
  let q_time = 1h;
  let sys_proc = CyberArkEPM
  | where TimeGenerated between (ago(lb_period) .. ago(q_time))
  | where EventSubType != 'AttackAttempt'
  | where ActingProcessName has @'\'
  | where ActingProcessName has_any ('System32', 'SysWOW64')
  | summarize makeset(ActingProcessFileInternalName);
  CyberArkEPM
  | where TimeGenerated > ago(q_time)
  | where EventSubType != 'AttackAttempt'
  | where ActingProcessName has @'\'
  | where ActingProcessName has_any ('System32', 'SysWOW64')
  | where ActingProcessFileInternalName !in (sys_proc)
  | extend AccountCustomEntity = ActorUsername
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountCustomEntity
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let lb_period = 14d;
let q_time = 1h;

Let binding: `sys_proc` used in Stage 6

let sys_proc = CyberArkEPM
| where TimeGenerated between (ago(lb_period) .. ago(q_time))
| where EventSubType != 'AttackAttempt'
| where ActingProcessName has @'\'
| where ActingProcessName has_any ('System32', 'SysWOW64')
| summarize makeset(ActingProcessFileInternalName);

Stage 1: `source`

CyberArkEPM

Stage 2: `where`

| where TimeGenerated > ago(q_time)

Stage 3: `where`

| where EventSubType != 'AttackAttempt'

Stage 4: `where`

| where ActingProcessName has @'\'

Stage 5: `where`

| where ActingProcessName has_any ('System32', 'SysWOW64')

Stage 6: `where`

| where ActingProcessFileInternalName !in (sys_proc)

Stage 7: `extend`

| extend AccountCustomEntity = ActorUsername

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ActingProcessFileInternalName`	eq	`sys_proc`	`excludes:ActingProcessFileInternalName` `field:"ActingProcessFileInternalName" value:"sys_proc"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActingProcessName`	match	`SysWOW64` transforms: `term` `System32` transforms: `term` `\` transforms: `term`	`field:"ParentImage" kind:match`
`EventSubType`	ne	`AttackAttempt`	`field:"EventSubType" kind:ne value:"AttackAttempt"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountCustomEntity`	`extend`

CyberArkEPM - Uncommon Windows process started from System folder

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: sys_proc used in Stage 6

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: where

Stage 6: where

Stage 7: extend