Use of OpenConsole

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting

Known false positives

Legitimate use by an administrator

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Use of OpenConsole
id: 814c95cc-8192-4378-a70a-f1aafd877af1
status: test
description: Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting
references:
    - https://twitter.com/nas_bench/status/1537563834478645252
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-16
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - OriginalFileName: 'OpenConsole.exe'
        - Image|endswith: '\OpenConsole.exe'
    filter:
        Image|startswith: 'C:\Program Files\WindowsApps\Microsoft.WindowsTerminal' # We exclude the default path for WindowsTerminal
    condition: selection and not filter
falsepositives:
    - Legitimate use by an administrator
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    - OriginalFileName: 'OpenConsole.exe'
    - Image|endswith: '\OpenConsole.exe'

Stage 2: `not filter`

filter:
    Image|startswith: 'C:\Program Files\WindowsApps\Microsoft.WindowsTerminal'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	starts_with	`C:\Program Files\WindowsApps\Microsoft.WindowsTerminal`	`excludes:Image` `field:"Image" value:"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\OpenConsole.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"\OpenConsole.exe"`
`OriginalFileName`	eq	`OpenConsole.exe`	`field:"OriginalFileName" kind:eq value:"OpenConsole.exe"`