detection.wiki

Detection rules › Sigma

Windows Shell/Scripting Processes Spawning Suspicious Programs

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Florian Roth (Nextron Systems), Tim Shelton
Source
github.com/SigmaHQ/sigma

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell, T1059.005 Command and Scripting Interpreter: Visual Basic
StealthT1218 System Binary Proxy Execution

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Windows Shell/Scripting Processes Spawning Suspicious Programs
id: 3a6586ad-127a-4d3b-a677-1e6eacdf8fde
status: test
description: Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
references:
    - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
author: Florian Roth (Nextron Systems), Tim Shelton
date: 2018-04-06
modified: 2023-05-23
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.005
    - attack.t1059.001
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            # - '\cmd.exe'  # too many false positives
            - '\rundll32.exe'
            - '\cscript.exe'
            - '\wscript.exe'
            - '\wmiprvse.exe'
            - '\regsvr32.exe'
        Image|endswith:
            - '\schtasks.exe'
            - '\nslookup.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\mshta.exe'
    filter_ccmcache:
        CurrentDirectory|contains: '\ccmcache\'
    filter_amazon:
        ParentCommandLine|contains:
            # FP - Amazon Workspaces
            - '\Program Files\Amazon\WorkSpacesConfig\Scripts\setup-scheduledtask.ps1'
            - '\Program Files\Amazon\WorkSpacesConfig\Scripts\set-selfhealing.ps1'
            - '\Program Files\Amazon\WorkSpacesConfig\Scripts\check-workspacehealth.ps1'
            - '\nessus_' # Tenable/Nessus VA Scanner
    filter_nessus:
        CommandLine|contains: '\nessus_' # Tenable/Nessus VA Scanner
    filter_sccm_install:
        ParentImage|endswith: '\mshta.exe'
        Image|endswith: '\mshta.exe'
        ParentCommandLine|contains|all:
            - 'C:\MEM_Configmgr_'
            - '\splash.hta'
            - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}'
        CommandLine|contains|all:
            - 'C:\MEM_Configmgr_'
            - '\SMSSETUP\BIN\'
            - '\autorun.hta'
            - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}'
    condition: selection and not 1 of filter_*
falsepositives:
    - Administrative scripts
    - Microsoft SCCM
level: high

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_*

Stage 1: selection

selection:
    ParentImage|endswith:
        - '\mshta.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\rundll32.exe'
        - '\cscript.exe'
        - '\wscript.exe'
        - '\wmiprvse.exe'
        - '\regsvr32.exe'
    Image|endswith:
        - '\schtasks.exe'
        - '\nslookup.exe'
        - '\certutil.exe'
        - '\bitsadmin.exe'
        - '\mshta.exe'

Stage 2: not filter_*

filter_ccmcache:
    CurrentDirectory|contains: '\ccmcache\'
filter_amazon:
    ParentCommandLine|contains:
        - '\Program Files\Amazon\WorkSpacesConfig\Scripts\setup-scheduledtask.ps1'
        - '\Program Files\Amazon\WorkSpacesConfig\Scripts\set-selfhealing.ps1'
        - '\Program Files\Amazon\WorkSpacesConfig\Scripts\check-workspacehealth.ps1'
        - '\nessus_'
filter_nessus:
    CommandLine|contains: '\nessus_'
filter_sccm_install:
    ParentImage|endswith: '\mshta.exe'
    Image|endswith: '\mshta.exe'
    ParentCommandLine|contains|all:
        - 'C:\MEM_Configmgr_'
        - '\splash.hta'
        - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}'
    CommandLine|contains|all:
        - 'C:\MEM_Configmgr_'
        - '\SMSSETUP\BIN\'
        - '\autorun.hta'
        - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
CommandLinematchC:\MEM_Configmgr_
CommandLinematch\SMSSETUP\BIN\
CommandLinematch\autorun.hta
CommandLinematch{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
Imageends_with\mshta.exe
ParentCommandLinematchC:\MEM_Configmgr_
ParentCommandLinematch\splash.hta
ParentCommandLinematch{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
ParentImageends_with\mshta.exe
CommandLinematch\nessus_
CurrentDirectorymatch\ccmcache\
ParentCommandLinematch\Program Files\Amazon\WorkSpacesConfig\Scripts\check-workspacehealth.ps1
ParentCommandLinematch\Program Files\Amazon\WorkSpacesConfig\Scripts\set-selfhealing.ps1
ParentCommandLinematch\Program Files\Amazon\WorkSpacesConfig\Scripts\setup-scheduledtask.ps1
ParentCommandLinematch\nessus_

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \bitsadmin.exe corpus 29 (sigma 29)
  • \certutil.exe corpus 43 (sigma 43)
  • \mshta.exe corpus 67 (sigma 67)
  • \nslookup.exe corpus 5 (sigma 5)
  • \schtasks.exe corpus 56 (sigma 56)
ParentImageends_with
  • \cscript.exe corpus 17 (sigma 17)
  • \mshta.exe corpus 13 (sigma 13)
  • \powershell.exe corpus 24 (sigma 24)
  • \pwsh.exe corpus 21 (sigma 21)
  • \regsvr32.exe corpus 11 (sigma 11)
  • \rundll32.exe corpus 15 (sigma 15)
  • \wmiprvse.exe corpus 8 (sigma 8)
  • \wscript.exe corpus 19 (sigma 19)