Skip to content

Latest commit

 

History

History
42 lines (31 loc) · 2.76 KB

detect_masquerading_attempts_as_native_windows_binaries.md

File metadata and controls

42 lines (31 loc) · 2.76 KB

Masquerading Attempts as Native Windows Binaries

Metadata

  • Author: Elastic
  • Description: This hunt detects processes named as legit Microsoft native binaries located in the system32 folder. Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.
  • UUID: a2006c66-d6ab-43ee-871e-d650e38f7972
  • Integration: endpoint
  • Language: [ES|QL]
  • Source File: Masquerading Attempts as Native Windows Binaries

Query

from logs-endpoint.events.process-*
| where  @timestamp > NOW() - 7 day
| where event.type == "start" and event.action == "start" and host.os.name == "Windows" and not starts_with(process.executable, "C:\\Program Files\\WindowsApps\\") and not starts_with(process.executable, "C:\\Windows\\System32\\DriverStore\\") and process.name != "setup.exe"
| keep process.name.caseless, process.executable.caseless, process.code_signature.subject_name, process.code_signature.trusted, process.code_signature.exists, host.id
 /* system_bin contain Microsoft signed and located in system32 folder process names */
 /* non_system_bin contain non Microsoft signed process names */
| eval system_bin = case(starts_with(process.executable.caseless, "c:\\windows\\system32") and starts_with(process.code_signature.subject_name, "Microsoft") and process.code_signature.trusted == true, process.name.caseless, null), non_system_bin = case(process.code_signature.exists == false or process.code_signature.trusted != true or not starts_with(process.code_signature.subject_name, "Microsoft"), process.name.caseless, null)
 /* aggregate unique process name counts  by process.name and host.id */
| stats count_system_bin = count(system_bin), count_non_system_bin = count(non_system_bin) by process.name.caseless, host.id
 /* filter where the same process.name is present in both system_bin and non_system_bin */
| where count_system_bin >= 1 and count_non_system_bin >= 1

Notes

  • Output of the query is the process.name and host.id where you can pivot by host.id and process.name (non Microsoft signed) to find the specific suspicious instances.
  • Potential false-positives include processes with missing code signature details due to enrichment bugs.
  • The queried index must capture process start events with code signature information (e.g. Windows event 4688 is not supported).

MITRE ATT&CK Techniques

License

  • Elastic License v2