Malware in the recycle bin (Normalized Process Events)

Severity: medium
Time window: 1d
Author: Yuval Naor
Source: github.com/Azure/Azure-Sentinel

Identifies malware that has been hidden in the recycle bin. To use this analytics rule, make sure you have deployed the ASIM normalization parsers

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1564` Hide Artifacts

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Sysmon	Event ID 5: Process terminated
Security-Auditing	Event ID 4688: A new process has been created.
Security-Auditing	Event ID 4689: A process has exited.

Rule body

id: 61988db3-0565-49b5-b8e3-747195baac6e
name: Malware in the recycle bin (Normalized Process Events)
description: |
  'Identifies malware that has been hidden in the recycle bin.
  To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
severity: Medium
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1564
tags:
  - Id: b8266f81-2715-41a6-9062-42486cbc9c73
    version: 1.0.0
  - Schema: ASIMProcessEvent
    SchemaVersion: 0.1.0

query: |
  let procList = dynamic(["cmd.exe","ftp.exe","schtasks.exe","powershell.exe","rundll32.exe","regsvr32.exe","msiexec.exe"]);  
  imProcessCreate
  | where CommandLine has "recycler"
  | where Process has_any (procList)
  | extend FileName = tostring(split(Process, '\\')[-1])
  | where FileName in~ (procList)
  | project TimeGenerated, Dvc, User, Process, FileName, CommandLine, ActingProcessName, EventVendor, EventProduct
  | extend AccountName = tostring(split(User, @'\')[1]), AccountNTDomain = tostring(split(User, @'\')[0])
  | extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)
  | project-away DomainIndex
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: User
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountNTDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Dvc
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.2.5
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Yuval Naor
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Protection" ]

Stages and Predicates

Parameters

let procList = dynamic(["cmd.exe","ftp.exe","schtasks.exe","powershell.exe","rundll32.exe","regsvr32.exe","msiexec.exe"]);

Stage 1: `source`

imProcessCreate

Stage 2: `where`

| where CommandLine has "recycler"

Stage 3: `where`

| where Process has_any (procList)

Stage 4: `extend`

| extend FileName = tostring(split(Process, '\\')[-1])

Stage 5: `where`

| where FileName in~ (procList)

Stage 6: `project`

| project TimeGenerated, Dvc, User, Process, FileName, CommandLine, ActingProcessName, EventVendor, EventProduct

Stage 7: `extend` (3 consecutive steps)

| extend AccountName = tostring(split(User, @'\')[1]), AccountNTDomain = tostring(split(User, @'\')[0])
| extend HostName = tostring(split(Dvc, ".")[0]), DomainIndex = toint(indexof(Dvc, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Dvc, DomainIndex + 1), Dvc)

Stage 8: `project-away`

| project-away DomainIndex

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`recycler` transforms: `term`	`field:"CommandLine" kind:match value:"recycler"`
`FileName`	in	`cmd.exe` `ftp.exe` `msiexec.exe` `powershell.exe` corpus 3 (kusto 3) `regsvr32.exe` `rundll32.exe` `schtasks.exe`	`field:"file_name" kind:in`
`Process`	match	`cmd.exe` transforms: `term` `ftp.exe` transforms: `term` `msiexec.exe` transforms: `term` `powershell.exe` transforms: `term` corpus 2 (kusto 2) `regsvr32.exe` transforms: `term` `rundll32.exe` transforms: `term` `schtasks.exe` transforms: `term`	`field:"Process" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ActingProcessName`	`project`
`CommandLine`	`project`
`Dvc`	`project`
`EventProduct`	`project`
`EventVendor`	`project`
`FileName`	`project`
`Process`	`project`
`TimeGenerated`	`project`
`User`	`project`
`AccountNTDomain`	`extend`
`AccountName`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`

Malware in the recycle bin (Normalized Process Events)

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Stage 5: where

Stage 6: project

Stage 7: extend (3 consecutive steps)

Stage 8: project-away