Terminal Service Process Spawn

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Lateral Movement	`T1210` Exploitation of Remote Services

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Terminal Service Process Spawn
id: 1012f107-b8f1-4271-af30-5aed2de89b39
status: test
description: Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
references:
    - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/
author: Florian Roth (Nextron Systems)
date: 2019-05-22
modified: 2023-01-25
tags:
    - attack.initial-access
    - attack.t1190
    - attack.lateral-movement
    - attack.t1210
    - car.2013-07-002
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentCommandLine|contains|all:
            - '\svchost.exe'
            - 'termsvcs'
    filter_img:
        Image|endswith:
            - '\rdpclip.exe'
            - ':\Windows\System32\csrss.exe'
            - ':\Windows\System32\wininit.exe'
            - ':\Windows\System32\winlogon.exe'
    filter_null:
        Image: null
    condition: selection and not 1 of filter_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_*

Stage 1: `selection`

selection:
    ParentCommandLine|contains|all:
        - '\svchost.exe'
        - 'termsvcs'

Stage 2: `not filter_*`

filter_img:
    Image|endswith:
        - '\rdpclip.exe'
        - ':\Windows\System32\csrss.exe'
        - ':\Windows\System32\wininit.exe'
        - ':\Windows\System32\winlogon.exe'
filter_null:
    Image: null

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`:\Windows\System32\csrss.exe`	`excludes:Image` `field:"Image" value:":\Windows\System32\csrss.exe"`
`Image`	ends_with	`:\Windows\System32\wininit.exe`	`excludes:Image` `field:"Image" value:":\Windows\System32\wininit.exe"`
`Image`	ends_with	`:\Windows\System32\winlogon.exe`	`excludes:Image` `field:"Image" value:":\Windows\System32\winlogon.exe"`
`Image`	ends_with	`\rdpclip.exe`	`excludes:Image` `field:"Image" value:"\rdpclip.exe"`
`Image`	is_null	(no value, null check)	`excludes:Image`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ParentCommandLine`	match	`\svchost.exe` `termsvcs`	`field:"ParentCommandLine" kind:match`