Elastic Defend high stable eql

Network Connection via Process with Unusual Arguments

Identifies suspicious network connections from Windows processes that typically have more than one command line argument. This may be indicative of a masquerading attempt to evade detections that monitor for suspicious parent-child process relationships.

View Source

Detection Logic

sequence by process.entity_id
  [process where event.action == "start" and process.args_count == 1 and
   process.name :
     ("AddInProcess.exe",
      "AddInProcess32.exe",
      "AddInUtil.exe",
      "AppLaunch.exe",
      "aspnet_compiler.exe",
      "aspnet_regbrowsers.exe",
      "aspnet_regiis.exe",
      "aspnet_regsql.exe",
      "aspnet_state.exe",
      "aspnet_wp.exe",
      "CasPol.exe",
      "ComSvcConfig.exe",
      "csc.exe",
      "cvtres.exe",
      "DataSvcUtil.exe",
      "EdmGen.exe",
      "ilasm.exe",
      "InstallUtil.exe",
      "jsc.exe",
      "Microsoft.Workflow.Compiler.exe",
      "MSBuild.exe",
      "mscorsvw.exe",
      "ngen.exe",
      "ngentask.exe",
      "RegAsm.exe",
      "RegSvcs.exe",
      "ServiceModelReg.exe",
      "vbc.exe",
      "WsatConfig.exe",
      "dllhost.exe",
      "regsvr32.exe",
      "GPUpdate.exe",
      "SearchProtocolHost.exe",
      /* Issue #639 - added msiexec */
      "msiexec.exe") and
   not (user.id == "S-1-5-18" and process.name : "gpupdate.exe" and process.parent.executable : "C:\\Windows\\system32\\cscript.exe") and
   not (process.executable : "?:\\Program Files\\Microsoft Visual Studio\\*\\MSBuild.exe" and process.parent.executable : "?:\\Program Files\\Microsoft Visual Studio\\*\\devenv.exe")
   ]
  [network where event.action == "connection_attempted"]
  until [process where event.action:"end"]

Field Validations

Loading…

Comments (0)

Loading comments...