New Capture Session Launched Via DXCap.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.

Known false positives

Legitimate execution of dxcap.exe by legitimate user

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: New Capture Session Launched Via DXCap.EXE
id: 60f16a96-db70-42eb-8f76-16763e333590
status: test
description: |
    Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.
references:
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/
    - https://twitter.com/harr0ey/status/992008180904419328
author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)
date: 2019-10-26
modified: 2022-06-09
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\DXCap.exe'
        - OriginalFileName: 'DXCap.exe'
    selection_cli:
        CommandLine|contains: ' -c ' # The ".exe" is not required to run the binary
    condition: all of selection*
falsepositives:
    - Legitimate execution of dxcap.exe by legitimate user
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\DXCap.exe'
    - OriginalFileName: 'DXCap.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: ' -c '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-c` corpus 13 (sigma 13)	`field:"CommandLine" kind:match value:" -c "`
`Image`	ends_with	`\DXCap.exe`	`field:"Image" kind:ends_with value:"\DXCap.exe"`
`OriginalFileName`	eq	`DXCap.exe`	`field:"OriginalFileName" kind:eq value:"DXCap.exe"`