detection.wiki

Detection rules › Sigma

Unusual Parent Process For Cmd.EXE

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
Tim Rauch, Elastic (idea)
Source
github.com/SigmaHQ/sigma

Detects suspicious parent process for cmd.exe

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059 Command and Scripting Interpreter

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Unusual Parent Process For Cmd.EXE
id: 4b991083-3d0e-44ce-8fc4-b254025d8d4b
status: test
description: Detects suspicious parent process for cmd.exe
references:
    - https://www.elastic.co/guide/en/security/current/unusual-parent-process-for-cmd.exe.html
author: Tim Rauch, Elastic (idea)
date: 2022-09-21
modified: 2023-12-05
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\cmd.exe'
        ParentImage|endswith:
            - '\csrss.exe'
            - '\ctfmon.exe'
            - '\dllhost.exe'
            - '\epad.exe'
            - '\FlashPlayerUpdateService.exe'
            - '\GoogleUpdate.exe'
            - '\jucheck.exe'
            - '\jusched.exe'
            - '\LogonUI.exe'
            - '\lsass.exe'
            - '\regsvr32.exe'
            - '\SearchIndexer.exe'
            - '\SearchProtocolHost.exe'
            - '\SIHClient.exe'
            - '\sihost.exe'
            - '\slui.exe'
            - '\spoolsv.exe'
            - '\sppsvc.exe'
            - '\taskhostw.exe'
            - '\unsecapp.exe'
            - '\WerFault.exe'
            - '\wermgr.exe'
            - '\wlanext.exe'
            - '\WUDFHost.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    Image|endswith: '\cmd.exe'
    ParentImage|endswith:
        - '\csrss.exe'
        - '\ctfmon.exe'
        - '\dllhost.exe'
        - '\epad.exe'
        - '\FlashPlayerUpdateService.exe'
        - '\GoogleUpdate.exe'
        - '\jucheck.exe'
        - '\jusched.exe'
        - '\LogonUI.exe'
        - '\lsass.exe'
        - '\regsvr32.exe'
        - '\SearchIndexer.exe'
        - '\SearchProtocolHost.exe'
        - '\SIHClient.exe'
        - '\sihost.exe'
        - '\slui.exe'
        - '\spoolsv.exe'
        - '\sppsvc.exe'
        - '\taskhostw.exe'
        - '\unsecapp.exe'
        - '\WerFault.exe'
        - '\wermgr.exe'
        - '\wlanext.exe'
        - '\WUDFHost.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
ParentImageends_with
  • \FlashPlayerUpdateService.exe
  • \GoogleUpdate.exe corpus 3 (sigma 3)
  • \LogonUI.exe
  • \SIHClient.exe
  • \SearchIndexer.exe corpus 3 (sigma 3)
  • \SearchProtocolHost.exe corpus 2 (sigma 2)
  • \WUDFHost.exe
  • \WerFault.exe
  • \csrss.exe corpus 3 (sigma 3)
  • \ctfmon.exe
  • \dllhost.exe corpus 7 (sigma 7)
  • \epad.exe
  • \jucheck.exe
  • \jusched.exe
  • \lsass.exe corpus 3 (sigma 3)
  • \regsvr32.exe corpus 11 (sigma 11)
  • \sihost.exe
  • \slui.exe corpus 2 (sigma 2)
  • \spoolsv.exe corpus 5 (sigma 5)
  • \sppsvc.exe
  • \taskhostw.exe
  • \unsecapp.exe
  • \wermgr.exe corpus 2 (sigma 2)
  • \wlanext.exe