{"id":"3a6586ad-127a-4d3b-a677-1e6eacdf8fde","title":"Windows Shell/Scripting Processes Spawning Suspicious Programs","description":"Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.","author":"Florian Roth (Nextron Systems), Tim Shelton","status":"test","level":"high","date":"2018-04-06","modified":"2023-05-23","tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1059.001","attack.t1218"],"technique_ids":["T1059.001","T1059.005","T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Administrative scripts","Microsoft SCCM"],"references":["https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml","source_sha256":"56d23c2e232e20d8e6b3db9c6ef17f284b16c8d3a40f42a67339159768b76f58","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Shell/Scripting Processes Spawning Suspicious Programs\nid: 3a6586ad-127a-4d3b-a677-1e6eacdf8fde\nstatus: test\ndescription: Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.\nreferences:\n    - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html\nauthor: Florian Roth (Nextron Systems), Tim Shelton\ndate: 2018-04-06\nmodified: 2023-05-23\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059.005\n    - attack.t1059.001\n    - attack.t1218\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith:\n            - '\\mshta.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            # - '\\cmd.exe'  # too many false positives\n            - '\\rundll32.exe'\n            - '\\cscript.exe'\n            - '\\wscript.exe'\n            - '\\wmiprvse.exe'\n            - '\\regsvr32.exe'\n        Image|endswith:\n            - '\\schtasks.exe'\n            - '\\nslookup.exe'\n            - '\\certutil.exe'\n            - '\\bitsadmin.exe'\n            - '\\mshta.exe'\n    filter_ccmcache:\n        CurrentDirectory|contains: '\\ccmcache\\'\n    filter_amazon:\n        ParentCommandLine|contains:\n            # FP - Amazon Workspaces\n            - '\\Program Files\\Amazon\\WorkSpacesConfig\\Scripts\\setup-scheduledtask.ps1'\n            - '\\Program Files\\Amazon\\WorkSpacesConfig\\Scripts\\set-selfhealing.ps1'\n            - '\\Program Files\\Amazon\\WorkSpacesConfig\\Scripts\\check-workspacehealth.ps1'\n            - '\\nessus_' # Tenable/Nessus VA Scanner\n    filter_nessus:\n        CommandLine|contains: '\\nessus_' # Tenable/Nessus VA Scanner\n    filter_sccm_install:\n        ParentImage|endswith: '\\mshta.exe'\n        Image|endswith: '\\mshta.exe'\n        ParentCommandLine|contains|all:\n            - 'C:\\MEM_Configmgr_'\n            - '\\splash.hta'\n            - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}'\n        CommandLine|contains|all:\n            - 'C:\\MEM_Configmgr_'\n            - '\\SMSSETUP\\BIN\\'\n            - '\\autorun.hta'\n            - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}'\n    condition: selection and not 1 of filter_*\nfalsepositives:\n    - Administrative scripts\n    - Microsoft SCCM\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","page":"techniques/enterprise/T1059.005/"},{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/3a6586ad-127a-4d3b-a677-1e6eacdf8fde.json","kind":"sigma"}