Detection rules › Splunk
Conhost.exe Kernel call (Windows Event Log)
conhost. exe ForceV1 asks for information directly from the kernel space, conhost connects to the console application. Usecase Identifies potentially suspicious Conhost execution paired with additional processes
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059 Command and Scripting Interpreter |
| Stealth | T1202 Indirect Command Execution, T1211 Exploitation for Stealth |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '5541.5782'
title: Conhost.exe Kernel call
description: 'conhost. exe ForceV1 asks for information directly from the kernel space,
conhost connects to the console application. Usecase Identifies potentially suspicious
Conhost execution paired with additional processes. - Software Association: Trojan.Killdisk/HermeticWiper,
Snatch'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) NOT (TERM(usoclient.exe) OR TERM(devicecensus.exe)
OR TERM(ProgramData) OR "Program Files" OR "wmiprvse.exe") | regex process="^\S+\s"
| table _time, host, user, process, process_*, parent_*, signature_id | bin span=1s
| stats values(*) as * by _time, host | regex process="conhost.exe 0xffffffff -ForceV1"|
where mvcount(process)>1 '
techniques:
- defense-evasion:indirect command execution
- execution:command and scripting interpreter
- defense-evasion:exploitation for defense evasion
technique_id:
- T1202
- T1059
- T1211
data_category:
- Windows event logs
references:
- https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) NOT (TERM(usoclient.exe) OR TERM(devicecensus.exe) OR TERM(ProgramData) OR "Program Files" OR "wmiprvse.exe")
Stage 2: regex
| regex process="^\S+\s"
Stage 3: table
| table _time, host, user, process, process_*, parent_*, signature_id
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Stage 6: regex
| regex process="conhost.exe 0xffffffff -ForceV1"
Stage 7: where
| where mvcount(process)>1
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | TERM |
| 1 | usoclient.exe |
| 1 | TERM |
| 1 | devicecensus.exe |
| 1 | TERM |
| 1 | ProgramData |
| 1 | "Program Files" |
| 1 | "wmiprvse.exe" |