Detection rules › Sigma
Suspicious Process Parents
Detects suspicious parent processes that should not have any children or should only have a single possible child program
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1036 Masquerading |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
title: Suspicious Process Parents
id: cbec226f-63d9-4eca-9f52-dfb6652f24df
status: test
description: Detects suspicious parent processes that should not have any children or should only have a single possible child program
references:
- https://twitter.com/x86matthew/status/1505476263464607744?s=12
- https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b
author: Florian Roth (Nextron Systems)
date: 2022-03-21
modified: 2022-09-08
tags:
- attack.stealth
- attack.t1036
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- '\minesweeper.exe'
- '\winver.exe'
- '\bitsadmin.exe'
selection_special:
ParentImage|endswith:
- '\csrss.exe'
- '\certutil.exe'
# - '\schtasks.exe'
- '\eventvwr.exe'
- '\calc.exe'
- '\notepad.exe'
filter_special:
Image|endswith:
- '\WerFault.exe'
- '\wermgr.exe'
- '\conhost.exe' # csrss.exe, certutil.exe
- '\mmc.exe' # eventvwr.exe
- '\win32calc.exe' # calc.exe
- '\notepad.exe'
filter_null:
Image: null
condition: selection or ( selection_special and not 1 of filter_* )
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selection or ( selection_special and not 1 of filter_* )Stage 1: selection
selection:
ParentImage|endswith:
- '\minesweeper.exe'
- '\winver.exe'
- '\bitsadmin.exe'
Stage 2: selection_special
selection_special:
ParentImage|endswith:
- '\csrss.exe'
- '\certutil.exe'
- '\eventvwr.exe'
- '\calc.exe'
- '\notepad.exe'
Stage 3: not filter_*
filter_special:
Image|endswith:
- '\WerFault.exe'
- '\wermgr.exe'
- '\conhost.exe'
- '\mmc.exe'
- '\win32calc.exe'
- '\notepad.exe'
filter_null:
Image: null
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
Image | ends_with | \WerFault.exe |
Image | ends_with | \conhost.exe |
Image | ends_with | \mmc.exe |
Image | ends_with | \notepad.exe |
Image | ends_with | \wermgr.exe |
Image | ends_with | \win32calc.exe |
Image | is_null |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ParentImage | ends_with |
|