Executable File Creation by an Unusual Microsoft Binary

from logs-endpoint.events.file-*
| where  @timestamp > NOW() - 7 day
| where host.os.family == "windows" and event.category == "file" and event.action == "creation" and
  starts_with(file.Ext.header_bytes, "4d5a") and process.code_signature.status == "trusted" and
  starts_with(process.code_signature.subject_name, "Microsoft") and process.executable rlike """[c-fC-F]:\\Windows\\(System32
| SysWOW64)\\[a-zA-Z0-9_]+.exe"""
| keep process.executable, host.id
| stats occurrences = count(*), agents = count_distinct(host.id) by process.executable
| where agents == 1 and occurrences <= 10


from logs-windows.sysmon_operational-*
| where  @timestamp > NOW() - 7 day
| where host.os.family == "windows" and event.category == "file" and event.action == "FileCreate" and
 file.extension in ("exe", "dll") and process.executable rlike """[c-fC-F]:\\Windows\\(System32
| SysWOW64)\\[a-zA-Z0-9_]+.exe"""
| keep process.executable, host.id
| stats occurrences = count(*), agents = count_distinct(host.id) by process.executable
| where agents == 1 and occurrences <= 10

False Positives

• ⚠ This hunt includes two optional queries, one for Elastic Defend data and another for Sysmon data.
• ⚠ Sysmon file events don't populate file header and process code signature information thus we use `file.extension`.
• ⚠ Some exploits may result in the creation of an executable file by the exploited process.
• ⚠ Further investigation can be done by pivoting on `process.executable` and filtering for executable file creation.