Detection rules › Splunk
Unexpected Network Connection from System Process (Windows Event Log)
Threat actors may abuse legitimate system processes that typically lack network functionality to perform malicious network activity, helping evade detection and blend in with normal system behavior. This technique is often associated with process injection or masquerading, where code is executed within trusted processes to establish command-and-control (C2) channels or exfiltrate data. This use case detects instances where non-networking system processes (e.g., conhost.exe, lsass.exe, wininit.exe) are observed initiating network connections, which may indicate process injection, covert C2 activity, or execution of malicious payloads under trusted process names.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1055 Process Injection |
| Stealth | T1036 Masquerading, T1055 Process Injection |
| Command & Control | T1071 Application Layer Protocol |
References
- https://attack.mitre.org/techniques/T1071/
- https://attack.mitre.org/techniques/T1055/
- https://attack.mitre.org/techniques/T1057/
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072
- https://github.com/S1ckB0y1337/Cobalt-Strike-CheatSheet
- https://boschko.ca/cobalt-strike-process-injection/
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 5156 | The Windows Filtering Platform has permitted a connection. |
Rule body yaml
id: '35956.74705'
title: Unexpected Network Connection from System Process
description: Threat actors may abuse legitimate system processes that typically lack
network functionality to perform malicious network activity, helping evade detection
and blend in with normal system behavior. This technique is often associated with
process injection or masquerading, where code is executed within trusted processes
to establish command-and-control (C2) channels or exfiltrate data. This use case
detects instances where non-networking system processes (e.g., conhost.exe, lsass.exe,
wininit.exe) are observed initiating network connections, which may indicate process
injection, covert C2 activity, or execution of malicious payloads under trusted
process names.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5156) OR
"<EventID>5156<") ("conhost.exe" OR "explorer.exe" OR "services.exe" OR "wininit.exe"
OR "lsass.exe" OR "dwm.exe" OR "spoolsv.exe" OR "taskhost.exe") | table _time, host,
user, process, process_*, parent_* | bin span=1s | stats values(*) as * by _time,
host '
techniques:
- command-and-control:application layer protocol
- defense-evasion:masquerading
- privilege-escalation:process injection
technique_id:
- T1071
- T1036
- T1055
data_category:
- Windows event logs
- Process use of network
references:
- https://attack.mitre.org/techniques/T1071/
- https://attack.mitre.org/techniques/T1055/
- https://attack.mitre.org/techniques/T1057/
- https://kostas-ts.medium.com/ursnif-vs-italy-il-pdf-del-destino-5c83d6281072
- https://github.com/S1ckB0y1337/Cobalt-Strike-CheatSheet
- https://boschko.ca/cobalt-strike-process-injection/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5156) OR "<EventID>5156<") ("conhost.exe" OR "explorer.exe" OR "services.exe" OR "wininit.exe" OR "lsass.exe" OR "dwm.exe" OR "spoolsv.exe" OR "taskhost.exe")
Stage 2: table
| table _time, host, user, process, process_*, parent_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>5156<" |
| 1 | "conhost.exe" |
| 1 | "explorer.exe" |
| 1 | "services.exe" |
| 1 | "wininit.exe" |
| 1 | "lsass.exe" |
| 1 | "dwm.exe" |
| 1 | "spoolsv.exe" |
| 1 | "taskhost.exe" |