XBAP Execution From Uncommon Locations Via PresentationHost.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL

Known false positives

Legitimate ".xbap" being executed via "PresentationHost"

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: XBAP Execution From Uncommon Locations Via PresentationHost.EXE
id: d22e2925-cfd8-463f-96f6-89cec9d9bc5f
status: test
description: |
    Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Presentationhost/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-01
modified: 2023-11-09
tags:
    - attack.execution
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\presentationhost.exe'
        - OriginalFileName: 'PresentationHost.exe'
    selection_cli:
        CommandLine|contains: '.xbap'
    filter_main_generic:
        CommandLine|contains: # Filter out legitimate locations if you find them
            - ' C:\Windows\'
            - ' C:\Program Files'
    condition: all of selection* and not 1 of filter_main_*
falsepositives:
    - Legitimate ".xbap" being executed via "PresentationHost"
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection* and not 1 of filter_main_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\presentationhost.exe'
    - OriginalFileName: 'PresentationHost.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: '.xbap'

Stage 3: `not filter_main_generic`

filter_main_generic:
    CommandLine|contains:
        - ' C:\Windows\'
        - ' C:\Program Files'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`C:\Program Files`	`excludes:CommandLine` `field:"CommandLine" value:" C:\Program Files"`
`CommandLine`	match	`C:\Windows\`	`excludes:CommandLine` `field:"CommandLine" value:" C:\Windows\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`.xbap`	`field:"CommandLine" kind:match value:".xbap"`
`Image`	ends_with	`\presentationhost.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"\presentationhost.exe"`
`OriginalFileName`	eq	`PresentationHost.exe` corpus 2 (sigma 2)	`field:"OriginalFileName" kind:eq value:"PresentationHost.exe"`