Detection rules › Splunk
Executable Process from Suspicious Folder (Windows Event Log)
Detects the execution of executable process spawned by powershell or similar processes from suspicious file locations like temp, appdata, and downloads
MITRE ATT&CK coverage
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
id: '5746.6024'
title: Executable Process from Suspicious Folder
description: 'Detects the execution of executable process spawned by powershell or
similar processes from suspicious file locations like temp, appdata, and downloads.
- Threat Actor Association: Andariel, APT10/menuPass, APT28 (aka.Fancy Bear, Fighting
Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM), APT34/OilRig, Blind Eagle/APT-C-36,
Carbanak, Evilnum, FIN7, FIN8, GoldenJackal, Gorgon Group, Kimsuky, Lazarus, Magic
Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm), Mustang Panda
(aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta), Redfly, TA505,
TA551, UNC2465, Volt Typhoon, WinterVivern/UAC-0114 -- Software Association: Babuk,
BadHatch, Bazar, Blackbyte, Clop, IcedID, Lockbit, MagicRAT, PowerShortShell, PYSA/Mespinoza,
SmokedHAM, SolidBit, RATDispenser, Remcos, TA413, TargetCompany, Trickbot, Trigona,
Yellow Cockatoo/Jupiter Infostealer, Vidar Stealer, WhisperGate - #TrendingThreat
#Russia #Ukraine - Atomics T1574.001 Test#1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"EventID>4688<") ("powershell.exe" OR "cmd.exe" OR "services.exe" OR "dllhost.exe"
OR "rundll32.exe" OR "cscript.exe" OR "wscript.exe" OR "NTDLL.dll") AND ("Temporary
Internet Files" OR "TEMP" OR "Downloads" OR "Appdata") | regex parent_process_name="((?i)(powershell\.exe)|(cmd\.exe)|(services\.exe)|(dllhost\.exe)|(rundll32\.exe)|(cscript\.exe)|(wscript\.exe)|(NTDLL\.dll))"|
regex process_path!="(?i)WindowsUpdateLog"| regex process_path="(?i)Temp|Downloads|Appdata"
| table _time, host, user event_id, parent_*, process_*, process, signature_id |
bin span=1s | stats values(*) as * by _time, host, process_path '
techniques:
- execution:command and scripting interpreter
- execution:user execution
- execution:command and scripting interpreter:visual basic
- defense-evasion:system binary proxy execution:rundll32
- execution:command and scripting interpreter:javascript
technique_id:
- T1059
- T1204
- T1059.007
- T1218.011
- T1059.005
data_category:
- Windows event logs
references:
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "EventID>4688<") ("powershell.exe" OR "cmd.exe" OR "services.exe" OR "dllhost.exe" OR "rundll32.exe" OR "cscript.exe" OR "wscript.exe" OR "NTDLL.dll") AND ("Temporary Internet Files" OR "TEMP" OR "Downloads" OR "Appdata")
Stage 2: regex
| regex parent_process_name="((?i)(powershell\.exe)|(cmd\.exe)|(services\.exe)|(dllhost\.exe)|(rundll32\.exe)|(cscript\.exe)|(wscript\.exe)|(NTDLL\.dll))"
Stage 3: regex
| regex process_path!="(?i)WindowsUpdateLog"
Stage 4: regex
| regex process_path="(?i)Temp|Downloads|Appdata"
Stage 5: table
| table _time, host, user event_id, parent_*, process_*, process, signature_id
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host, process_path
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
process_path | regex_match | "(?i)WindowsUpdateLog" | excludes:process_path |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4688" |
parent_process_name | regex_match |
| field:"parent_process_name" kind:regex_match |
process_path | regex_match |
| field:"process_name" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "EventID>4688<" |
| 1 | "powershell.exe" |
| 1 | "cmd.exe" |
| 1 | "services.exe" |
| 1 | "dllhost.exe" |
| 1 | "rundll32.exe" |
| 1 | "cscript.exe" |
| 1 | "wscript.exe" |
| 1 | "NTDLL.dll" |
| 1 | "Temporary Internet Files" |
| 1 | "TEMP" |
| 1 | "Downloads" |
| 1 | "Appdata" |