Detect Msiexec executing DLL network connections

Group by: DeviceId, InitiatingProcessCreationTime, InitiatingProcessId, InitiatingProcessParentCreationTime, InitiatingProcessParentId
Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

Adversaries regularly use Msiexec (or other lolbins) to execute their malicious programs with. A common way to do this is more specifically using Msiexec to execute beacons encapsulated in DLL files. While this happens a lot in legitimate cases, a DLL file loaded via Msiexec starting network connections may indicate a beacon running. > [!WARNING] > You might need to add environment specific finetuning to this rule in order to reduce BP detections from legitimate processes.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218.007` System Binary Proxy Execution: Msiexec

References

https://thecollective.eu/

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `any`: Network activity
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `any`: Process activity

Rule body

DeviceNetworkEvents
| where TimeGenerated > ago(1h)
| where InitiatingProcessParentFileName =~ "msiexec.exe"
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(3d)
    | where InitiatingProcessFileName =~ "msiexec.exe"
) on DeviceId, 
    $left.InitiatingProcessParentId == $right.InitiatingProcessId,
    $left.InitiatingProcessParentCreationTime == $right.InitiatingProcessCreationTime
| where InitiatingProcessCommandLine1 has_any ("/y", "-y", "/z", "-z")

Stages and Predicates

Stage 1: `source`

DeviceNetworkEvents

Stage 2: `where`

| where TimeGenerated > ago(1h)

Stage 3: `where`

| where InitiatingProcessParentFileName =~ "msiexec.exe"

Stage 4: `join`

| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(3d)
    | where InitiatingProcessFileName =~ "msiexec.exe"
) on DeviceId, 
    $left.InitiatingProcessParentId == $right.InitiatingProcessId,
    $left.InitiatingProcessParentCreationTime == $right.InitiatingProcessCreationTime

Stage 5: `where`

| where InitiatingProcessCommandLine1 has_any ("/y", "-y", "/z", "-z")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`InitiatingProcessCommandLine1`	match	`-y` transforms: `term` `-z` transforms: `term` `/y` transforms: `term` `/z` transforms: `term`	`field:"InitiatingProcessCommandLine1" kind:match`
`InitiatingProcessFileName`	eq	`msiexec.exe`	`field:"parent_process_name" kind:eq value:"msiexec.exe"`
`InitiatingProcessParentFileName`	eq	`msiexec.exe`	`field:"ParentImage" kind:eq value:"msiexec.exe"`