{"id":"744a188b-0415-4792-896f-11ddb0588dbc","title":"Potential Process Injection Via Msra.EXE","description":"Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics","author":"Alexander McDonald","status":"test","level":"high","date":"2022-06-24","modified":"2023-02-03","tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"technique_ids":["T1055"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate use of Msra.exe"],"references":["https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/","https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf"],"source_path":"rules/windows/process_creation/proc_creation_win_msra_process_injection.yml","source_sha256":"bf0374a75e52d4dd6b415f009afc3c914132349ec17c99403b0dddab01245c1c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msra_process_injection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Process Injection Via Msra.EXE\nid: 744a188b-0415-4792-896f-11ddb0588dbc\nstatus: test\ndescription: Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics\nreferences:\n    - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/\n    - https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf\nauthor: Alexander McDonald\ndate: 2022-06-24\nmodified: 2023-02-03\ntags:\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1055\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\msra.exe'\n        ParentCommandLine|endswith: 'msra.exe'\n        Image|endswith:\n            - '\\arp.exe'\n            - '\\cmd.exe'\n            - '\\net.exe'\n            - '\\netstat.exe'\n            - '\\nslookup.exe'\n            - '\\route.exe'\n            - '\\schtasks.exe'\n            - '\\whoami.exe'\n    condition: selection\nfalsepositives:\n    - Legitimate use of Msra.exe\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1055","id":"T1055","name":"Process Injection","page":"techniques/enterprise/T1055/"}],"data_path":"data/detection-rules/744a188b-0415-4792-896f-11ddb0588dbc.json","kind":"sigma"}