Potential Process Injection Via Msra.EXE

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Alexander McDonald
Source: github.com/SigmaHQ/sigma

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

Known false positives

Legitimate use of Msra.exe

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1055` Process Injection
Stealth	`T1055` Process Injection

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Potential Process Injection Via Msra.EXE
id: 744a188b-0415-4792-896f-11ddb0588dbc
status: test
description: Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics
references:
    - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/
    - https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf
author: Alexander McDonald
date: 2022-06-24
modified: 2023-02-03
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\msra.exe'
        ParentCommandLine|endswith: 'msra.exe'
        Image|endswith:
            - '\arp.exe'
            - '\cmd.exe'
            - '\net.exe'
            - '\netstat.exe'
            - '\nslookup.exe'
            - '\route.exe'
            - '\schtasks.exe'
            - '\whoami.exe'
    condition: selection
falsepositives:
    - Legitimate use of Msra.exe
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ParentImage|endswith: '\msra.exe'
    ParentCommandLine|endswith: 'msra.exe'
    Image|endswith:
        - '\arp.exe'
        - '\cmd.exe'
        - '\net.exe'
        - '\netstat.exe'
        - '\nslookup.exe'
        - '\route.exe'
        - '\schtasks.exe'
        - '\whoami.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\arp.exe` corpus 3 (sigma 3) `\cmd.exe` corpus 130 (sigma 130) `\net.exe` corpus 49 (sigma 49) `\netstat.exe` corpus 5 (sigma 5) `\nslookup.exe` corpus 5 (sigma 5) `\route.exe` corpus 3 (sigma 3) `\schtasks.exe` corpus 55 (sigma 55) `\whoami.exe` corpus 19 (sigma 19)	`field:"Image" kind:ends_with`
`ParentCommandLine`	ends_with	`msra.exe`	`field:"ParentCommandLine" kind:ends_with value:"msra.exe"`
`ParentImage`	ends_with	`\msra.exe`	`field:"ParentImage" kind:ends_with value:"\msra.exe"`