{"id":"cea2b7ea-792b-405f-95a1-b903ea06458f","title":"Suspicious Child Process Of Manage Engine ServiceDesk","description":"Detects suspicious child processes of the \"Manage Engine ServiceDesk Plus\" Java web service","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2023-01-18","modified":"2023-08-29","tags":["attack.command-and-control","attack.t1102"],"technique_ids":["T1102"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate sub processes started by Manage Engine ServiceDesk Pro"],"references":["https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/","https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py","https://blog.viettelcybersecurity.com/saml-show-stopper/"],"source_path":"rules/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml","source_sha256":"1c1e5629d72dfd1c191d5370b869e02d0e80fc7c49b4bb65edef9bbcbd7fd418","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Child Process Of Manage Engine ServiceDesk\nid: cea2b7ea-792b-405f-95a1-b903ea06458f\nstatus: test\ndescription: Detects suspicious child processes of the \"Manage Engine ServiceDesk Plus\" Java web service\nreferences:\n    - https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/\n    - https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py\n    - https://blog.viettelcybersecurity.com/saml-show-stopper/\nauthor: Florian Roth (Nextron Systems)\ndate: 2023-01-18\nmodified: 2023-08-29\ntags:\n    - attack.command-and-control\n    - attack.t1102\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|contains|all:\n            - '\\ManageEngine\\ServiceDesk\\'\n            - '\\java.exe'\n        Image|endswith:\n            - '\\AppVLP.exe'\n            - '\\bash.exe'\n            - '\\bitsadmin.exe'\n            - '\\calc.exe'\n            - '\\certutil.exe'\n            - '\\cscript.exe'\n            - '\\curl.exe'\n            - '\\forfiles.exe'\n            - '\\mftrace.exe'\n            - '\\mshta.exe'\n            - '\\net.exe'\n            - '\\net1.exe'\n            - '\\notepad.exe'  # Often used in POCs\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\query.exe'\n            - '\\reg.exe'\n            - '\\schtasks.exe'\n            - '\\scrcons.exe'\n            - '\\sh.exe'\n            - '\\systeminfo.exe'\n            - '\\whoami.exe'  # Often used in POCs\n            - '\\wmic.exe'\n            - '\\wscript.exe'\n            # - '\\hh.exe'\n            # - '\\regsvr32.exe'\n            # - '\\rundll32.exe'\n            # - '\\scriptrunner.exe'\n    filter_main_net:\n        Image|endswith:\n            - '\\net.exe'\n            - '\\net1.exe'\n        CommandLine|contains: ' stop'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate sub processes started by Manage Engine ServiceDesk Pro\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1102","id":"T1102","name":"Web Service","page":"techniques/enterprise/T1102/"}],"data_path":"data/detection-rules/cea2b7ea-792b-405f-95a1-b903ea06458f.json","kind":"sigma"}