Elastic Defend high stable eql

Windows Command Shell Spawned via Microsoft Office

Identifies a Microsoft Office application starting a Windows command prompt with suspicious command line arguments. This behavior is consistent with a victim opening a malicious document and executing an attacker's malicious code.

View Source

Detection Logic

process where event.action == "start" and
  process.parent.name : ("excel.exe", "powerpnt.exe", "winword.exe") and
  (process.pe.original_file_name == "Cmd.Exe" or process.name : "cmd.exe") and
  process.command_line :
              ("*^*^*^*^*^*",
              "*set *set *set *",
              "*set *for *call *",
              "*set *for *cmd *",
              "*$*$*$*$*",
              "*comspec*",
              "*powershell*",
              "*wscript*",
              "*cscript*",
              "*mshta*", 
              "*certutil*", 
              "*bitsadmin*", 
              "*/transfer*",
              "*-transfer*",
              "*urlcache*", 
              "*-decode*", 
              "*addfile*",
              "*msbuild*",
              "*msiexec*",
              "*rundll32*",
              "*regsvr32*", 
              "*ping * -n *&*",
              "*http://*",
              "*%%*%%*%%*", 
              "*copy*.exe*") and
  not process.command_line : 
             ("*:\\Program Files\\Tableau\\*--server*http://tableau*", 
              "*:\\Program Files (x86)\\Tableau\\*--server*http://tableau*", 
              "\"C:\\Windows\\System32\\cmd.exe\" /c C:\\windows\\System32\\rundll32 advpack.dll,LaunchINFSection \"C:\\Users\\*\\AppData\\Roaming\\McGowan Partners LLC UAT\\setup.inf\", DefaultInstall*") and 
  not process.args : "$bytes=[System.Text.Encoding]::UTF8.GetBytes('*');$hash=[System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes);[BitConverter]::ToString($hash).Replace('-','').ToLower()"

Field Validations

Loading…

Comments (0)

Loading comments...