detection.wiki

Detection rules › Kusto

Detect Msiexec executing DLL network connections

Group by
InitiatingProcessCreationTime, InitiatingProcessId, InitiatingProcessParentCreationTime, InitiatingProcessParentId
Author
Robbe Van den Daele
Source
github.com/HybridBrothers/Hunting-Queries-Detection-Rules

Adversaries regularly use Msiexec (or other lolbins) to execute their malicious programs with. A common way to do this is more specifically using Msiexec to execute beacons encapsulated in DLL files. While this happens a lot in legitimate cases, a DLL file loaded via Msiexec starting network connections may indicate a beacon running. > [!WARNING] > You might need to add environment specific finetuning to this rule in order to reduce BP detections from legitimate processes.

MITRE ATT&CK coverage

TacticTechniques
StealthT1218.007 System Binary Proxy Execution: Msiexec

References

Event coverage

ProviderEvent/ActionTypeTitle
SysmonEvent ID 3Network connection
Security-AuditingEvent ID 5156The Windows Filtering Platform has permitted a connection.
Defender-DeviceNetworkEventsanyNetwork activity (any)

Rule body yaml

DeviceNetworkEvents
| where TimeGenerated > ago(1h)
| where InitiatingProcessParentFileName =~ "msiexec.exe"
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(3d)
    | where InitiatingProcessFileName =~ "msiexec.exe"
) on DeviceId, 
    $left.InitiatingProcessParentId == $right.InitiatingProcessId,
    $left.InitiatingProcessParentCreationTime == $right.InitiatingProcessCreationTime
| where InitiatingProcessCommandLine1 has_any ("/y", "-y", "/z", "-z")

Stages and Predicates

Stage 1: source

DeviceNetworkEvents

Stage 2: where

| where TimeGenerated > ago(1h)

Stage 3: where

| where InitiatingProcessParentFileName =~ "msiexec.exe"

Stage 4: join

| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(3d)
    | where InitiatingProcessFileName =~ "msiexec.exe"
) on DeviceId, 
    $left.InitiatingProcessParentId == $right.InitiatingProcessId,
    $left.InitiatingProcessParentCreationTime == $right.InitiatingProcessCreationTime

Stage 5: where

| where InitiatingProcessCommandLine1 has_any ("/y", "-y", "/z", "-z")

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
InitiatingProcessCommandLine1match
  • -y
  • -z
  • /y
  • /z
InitiatingProcessFileNameeq
  • msiexec.exe corpus 9 (elastic 4, splunk 3, kusto 2)
InitiatingProcessParentFileNameeq
  • msiexec.exe