Elastic Defend high stable eql

Unexpected SMB Connection from User-mode Process

Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
  [process where event.action == "start" and
   process.executable : "?:\\Windows\\*.exe" and
   /* Issue #338 */
   not (process.code_signature.subject_name : ("RAPIDFIRE TOOLS INC.", "KASEYA US LLC", "Kaseya Holdings Inc", "Veeam Software Group GmbH", "TYCHON, LLC") and
        process.code_signature.trusted == true) and
   not (process.executable : "C:\\Windows\\System32\\conhost.exe" and
        process.parent.executable :
                       ("C:\\Program Files (x86)\\CyberCNSAgentV2\\osqueryi.exe",
                        "C:\\Program Files (x86)\\BeAnywhere Support Express\\GetSupportService_N-Central\\TCIntegratorCommHelper.exe")) and
   not user.id : ("S-1-5-19", "S-1-5-20")]
  [network where network.direction == "egress" and
   destination.port == 445 and source.port >= 49152 and
   not process.executable :
                 ("?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
                  "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
                  "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe",
                  "?:\\Windows\\System32\\wsmprovhost.exe",
                  "?:\\Windows\\System32\\mmc.exe",
                  "?:\\Windows\\SysWOW64\\mmc.exe",
                  "?:\\Windows\\System32\\svchost.exe",
                  "?:\\Windows\\System32\\WerFault.exe",
                  "?:\\Windows\\System32\\userinit.exe",
                  "?:\\Windows\\System32\\vpc.exe",
                  "?:\\Windows\\SysWOW64\\vmnat.exe",
                  "?:\\Windows\\System32\\telnet.exe",
                  "?:\\windows\\system32\\windowspowershell\\v*\\powershell.exe",
                  "?:\\windows\\SysWOW64\\windowspowershell\\v*\\powershell.exe",
                  "?:\\windows\\system32\\windowspowershell\\v*\\powershell_ise.exe",
                  "?:\\Windows\\NetworkDetective-RDC-*\\nacmdline.exe",
                  "?:\\Windows\\ProPatches\\Installation\\InstallationSandbox*\\stdeploy.exe",
                  "?:\\Windows\\System32\\ctfmon.exe",
                  "?:\\Windows\\SysWOW64\\ctfmon.exe",
                  "?:\\Windows\\System32\\OpenSSH\\ssh.exe",
                  "?:\\Windows\\LTSvc\\packages\\RFT\\NDDC\\nddc.exe")]

Field Validations

Loading…

Comments (0)

Loading comments...