Suspicious Execution from a Mounted Device

Elastic Stack Serverless Security

Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses.

Rule type: eql

Rule indices:

• winlogbeat-*
• logs-endpoint.events.*
• logs-windows.*

Severity: medium

Risk score: 47

Runs every: None

Searches indices from: now-9m (https://www.elastic.co/guide/en/elasticsearch/reference/current/common-options.html#date-math[Date Math format], see also Additional look-back time)

Maximum alerts per execution: 100

References:

• https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
• https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/

Tags:

• Elastic
• Host
• Windows
• Threat Detection
• Defense Evasion

Version: 1

Rule authors:

• Elastic

Rule license: Elastic License v2

process where event.type == "start" and process.executable : "C:\\*" and
  (process.working_directory : "?:\\" and not process.working_directory: "C:\\") and
  process.parent.name : "explorer.exe" and
  process.name : ("rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe", "cmd.exe", "regsvr32.exe",
                  "cscript.exe", "wscript.exe")

Framework: MITRE ATT&CKTM

• Tactic:

  • Name: Defense Evasion
  • ID: TA0005
  • Reference URL: https://attack.mitre.org/tactics/TA0005/

• Technique:

  • Name: Signed Binary Proxy Execution
  • ID: T1218
  • Reference URL: https://attack.mitre.org/techniques/T1218/

• Sub-technique:

  • Name: Rundll32
  • ID: T1218.011
  • Reference URL: https://attack.mitre.org/techniques/T1218/011/

• Sub-technique:

  • Name: Mshta
  • ID: T1218.005
  • Reference URL: https://attack.mitre.org/techniques/T1218/005/

• Sub-technique:

  • Name: Regsvr32
  • ID: T1218.010
  • Reference URL: https://attack.mitre.org/techniques/T1218/010/

• Tactic:

  • Name: Execution
  • ID: TA0002
  • Reference URL: https://attack.mitre.org/tactics/TA0002/

• Technique:

  • Name: Command and Scripting Interpreter
  • ID: T1059
  • Reference URL: https://attack.mitre.org/techniques/T1059/

• Sub-technique:

  • Name: PowerShell
  • ID: T1059.001
  • Reference URL: https://attack.mitre.org/techniques/T1059/001/