Elastic unknown experimental kql

Execution via Remote Services by Client Address

This hunt aggregates process execution via remote network logon by source address, account name and where the parent process is related to remote services such as WMI, WinRM, DCOM and remote PowerShell. This may indicate lateral movement via remote services.

View Source

Detection Logic

from logs-endpoint.events.process-*
| where  @timestamp > now() - 7 day and host.os.family == "windows" and
  event.category == "process" and event.action == "start" and
  /* network logon type */
  process.Ext.session_info.logon_type == "Network" and
  (process.parent.name .caseless in ("wmiprvse.exe", "wsmprovhost.exe", "winrshost.exe") or (process.parent.name == "svchost.exe" and process.parent.args == "DcomLaunch"))
| stats total = count(*), hosts = count_distinct(host.id) by process.Ext.session_info.client_address, user.name, process.parent.name
 /* sort by top source.ip and account */
| sort total desc

False Positives

⚠ `process.Ext.session_info.*` is populated for Elastic Defend versions 8.6.0+.

Field Validations

Loading…

Comments (0)

Loading comments...