{"id":"cbec226f-63d9-4eca-9f52-dfb6652f24df","title":"Suspicious Process Parents","description":"Detects suspicious parent processes that should not have any children or should only have a single possible child program","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-21","modified":"2022-09-08","tags":["attack.stealth","attack.t1036"],"technique_ids":["T1036"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/x86matthew/status/1505476263464607744?s=12","https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_parents.yml","source_sha256":"c6dc6e62306ec63209c3eede09eba396425edcf9a0ac4ff52c15784e6fe7b7dd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_parents.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Process Parents\nid: cbec226f-63d9-4eca-9f52-dfb6652f24df\nstatus: test\ndescription: Detects suspicious parent processes that should not have any children or should only have a single possible child program\nreferences:\n    - https://twitter.com/x86matthew/status/1505476263464607744?s=12\n    - https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-03-21\nmodified: 2022-09-08\ntags:\n    - attack.stealth\n    - attack.t1036\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith:\n            - '\\minesweeper.exe'\n            - '\\winver.exe'\n            - '\\bitsadmin.exe'\n    selection_special:\n        ParentImage|endswith:\n            - '\\csrss.exe'\n            - '\\certutil.exe'\n         # - '\\schtasks.exe'\n            - '\\eventvwr.exe'\n            - '\\calc.exe'\n            - '\\notepad.exe'\n    filter_special:\n        Image|endswith:\n            - '\\WerFault.exe'\n            - '\\wermgr.exe'\n            - '\\conhost.exe' # csrss.exe, certutil.exe\n            - '\\mmc.exe'     # eventvwr.exe\n            - '\\win32calc.exe' # calc.exe\n            - '\\notepad.exe'\n    filter_null:\n        Image: null\n    condition: selection or ( selection_special and not 1 of filter_* )\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"}],"data_path":"data/detection-rules/cbec226f-63d9-4eca-9f52-dfb6652f24df.json","kind":"sigma"}