SearchIndexer suspicious process activity

Status: experimental
Severity: medium
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where SearchIndexer spwaned another process with the same name, or when SearchIndexer process exists in an unexpected directory.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036` Masquerading

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: SearchIndexer suspicious process activity
description: Detects scenarios where SearchIndexer spwaned another process with the same name, or when SearchIndexer process exists in an unexpected directory.
references:
- https://securityaffairs.co/wordpress/75782/cyber-crime/hacking-hacker-botnet.html
- https://www.joesandbox.com/analysis/213580/1/html
- https://www.virustotal.com/gui/file/eb8417d0cf40160474faf587f3e1fdf94a0a2c9636ad1cf32005ff29ef3852dc
- https://www.filescan.io/uploads/62ad24c8473553ed319b5fe3/reports/104d3e08-1bdb-43ce-beb8-07c5688cef03/details
- https://any.run/report/eb8417d0cf40160474faf587f3e1fdf94a0a2c9636ad1cf32005ff29ef3852dc/c323438a-a3ec-4dcc-b304-dc47882a1eab
tags:
- attack.defense_evasion
- attack.t1036 # masquerading
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:

  selection_parent_image:
    ParentImage|endswith: '\SearchIndexer.exe' 

  selection_image:
    Image|endswith: '\SearchIndexer.exe'

  selection_image_path:
    Image: 'C:\WINDOWS\system32\SearchIndexer.exe'

  selection_commandline:
    CommandLine|contains: 'c1 c2 c3 c4 c5 c6 c7 c8'

  condition: (selection_parent_image and selection_image) or (selection_image and not selection_image_path) or (selection_image and selection_commandline)
falsepositives:
- None 
level: medium

Stages and Predicates

Stage 0: `condition`

(selection_parent_image and selection_image) or (selection_image and not selection_image_path) or (selection_image and selection_commandline)

Stage 1: `selection_parent_image`

selection_parent_image:
  ParentImage|endswith: '\SearchIndexer.exe'

Stage 2: `selection_image`

selection_image:
  Image|endswith: '\SearchIndexer.exe'

Stage 3: `selection_image`

selection_image:
  Image|endswith: '\SearchIndexer.exe'

Stage 4: `not selection_image_path`

selection_image_path:
  Image: 'C:\WINDOWS\system32\SearchIndexer.exe'

Stage 5: `selection_image`

selection_image:
  Image|endswith: '\SearchIndexer.exe'

Stage 6: `selection_commandline`

selection_commandline:
  CommandLine|contains: 'c1 c2 c3 c4 c5 c6 c7 c8'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	eq	`C:\WINDOWS\system32\SearchIndexer.exe`	`excludes:Image` `field:"Image" value:"C:\WINDOWS\system32\SearchIndexer.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`c1 c2 c3 c4 c5 c6 c7 c8`	`field:"CommandLine" kind:match value:"c1 c2 c3 c4 c5 c6 c7 c8"`
`Image`	ends_with	`\SearchIndexer.exe`	`field:"Image" kind:ends_with value:"\SearchIndexer.exe"`
`ParentImage`	ends_with	`\SearchIndexer.exe` corpus 3 (sigma 3)	`field:"ParentImage" kind:ends_with value:"\SearchIndexer.exe"`

SearchIndexer suspicious process activity

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_parent_image

Stage 2: selection_image

Stage 3: selection_image

Stage 4: not selection_image_path

Stage 5: selection_image

Stage 6: selection_commandline