unusual_searchprotocolhost_child_process_via_cmdline

rule unusual_searchprotocolhost_child_process_via_cmdline {
 meta:
    author = "SOC Prime Team, Fireeye"
    description = "This alert looks for suspicious child processes of searchprotocolhost.exe, a known process used by malicious actors for process injection.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/elK9kAkFRSKy"
    version = "0.01"
    created = "2021-03-09"
    category = "process_creation"
    product = "windows"
    mitre = "defense_evasion, t1055"

  events:
(re.regex($selection.principal.process.file.full_path, `.*SearchProtocolHost\.exe`) and (re.regex($selection.target.process.file.full_path, `.*wscript\.exe`) or re.regex($selection.target.process.file.full_path, `.*cscript\.exe`) or re.regex($selection.target.process.file.full_path, `.*powershell\.exe`) or re.regex($selection.target.process.file.full_path, `.*cmd\.exe`) or re.regex($selection.target.process.file.full_path, `.*wmic\.exe`) or re.regex($selection.target.process.file.full_path, `.*java\.exe`) or re.regex($selection.target.process.file.full_path, `.*py\.exe`) or re.regex($selection.target.process.file.full_path, `.*bash\.exe`) or re.regex($selection.target.process.file.full_path, `.*rundll32\.exe`) or re.regex($selection.target.process.file.full_path, `.*AppVLP\.exe`) or re.regex($selection.target.process.file.full_path, `.*Cmstp\.exe`) or re.regex($selection.target.process.file.full_path, `.*Esentutl\.exe`) or re.regex($selection.target.process.file.full_path, `.*Eventvwr\.exe`) or re.regex($selection.target.process.file.full_path, `.*InfDefaultInstall\.exe`) or re.regex($selection.target.process.file.full_path, `.*Installutil\.exe`) or re.regex($selection.target.process.file.full_path, `.*Mavinject\.exe`) or re.regex($selection.target.process.file.full_path, `.*Microsoft\.Workflow\.Compiler\.exe`) or re.regex($selection.target.process.file.full_path, `.*Msbuild\.exe`) or re.regex($selection.target.process.file.full_path, `.*Odbcconf\.exe`) or re.regex($selection.target.process.file.full_path, `.*Presentationhost\.exe`) or re.regex($selection.target.process.file.full_path, `.*SQLToolsPS\.exe`) or re.regex($selection.target.process.file.full_path, `.*Sqlps\.exe`) or re.regex($selection.target.process.file.full_path, `.*SyncAppvPublishingServer\.exe`) or re.regex($selection.target.process.file.full_path, `.*atbroker\.exe`) or re.regex($selection.target.process.file.full_path, `.*bginfo\.exe`) or re.regex($selection.target.process.file.full_path, `.*bitsadmin\.exe`) or re.regex($selection.target.process.file.full_path, `.*cdb\.exe`) or re.regex($selection.target.process.file.full_path, `.*cmstp\.exe`) or re.regex($selection.target.process.file.full_path, `.*csi\.exe`) or re.regex($selection.target.process.file.full_path, `.*devtoolslauncher\.exe`) or re.regex($selection.target.process.file.full_path, `.*dnscmd\.exe`) or re.regex($selection.target.process.file.full_path, `.*dnx\.exe`) or re.regex($selection.target.process.file.full_path, `.*dxcap\.exe`) or re.regex($selection.target.process.file.full_path, `.*extexport\.exe`) or re.regex($selection.target.process.file.full_path, `.*forfiles\.exe`) or re.regex($selection.target.process.file.full_path, `.*ftp\.exe`) or re.regex($selection.target.process.file.full_path, `.*hh\.exe`) or re.regex($selection.target.process.file.full_path, `.*ieexec\.exe`) or re.regex($selection.target.process.file.full_path, `.*installutil\.exe`) or re.regex($selection.target.process.file.full_path, `.*jjs\.exe`) or re.regex($selection.target.process.file.full_path, `.*mavinject\.exe`) or re.regex($selection.target.process.file.full_path, `.*mftrace\.exe`) or re.regex($selection.target.process.file.full_path, `.*msbuild\.exe`) or re.regex($selection.target.process.file.full_path, `.*msxsl\.exe`) or re.regex($selection.target.process.file.full_path, `.*odbcconf\.exe`) or re.regex($selection.target.process.file.full_path, `.*pcalua\.exe`) or re.regex($selection.target.process.file.full_path, `.*presentationhost\.exe`) or re.regex($selection.target.process.file.full_path, `.*rcsi\.exe`) or re.regex($selection.target.process.file.full_path, `.*regasm\.exe`) or re.regex($selection.target.process.file.full_path, `.*regsvcs\.exe`) or re.regex($selection.target.process.file.full_path, `.*runonce\.exe`) or re.regex($selection.target.process.file.full_path, `.*runscripthelper\.exe`) or re.regex($selection.target.process.file.full_path, `.*schtasks\.exe`) or re.regex($selection.target.process.file.full_path, `.*scriptrunner\.exe`) or re.regex($selection.target.process.file.full_path, `.*squirrel\.exe`) or re.regex($selection.target.process.file.full_path, `.*te\.exe`) or re.regex($selection.target.process.file.full_path, `.*tracker\.exe`) or re.regex($selection.target.process.file.full_path, `.*update\.exe`) or re.regex($selection.target.process.file.full_path, `.*verclsid\.exe`) or re.regex($selection.target.process.file.full_path, `.*vsjitdebugger\.exe`) or re.regex($selection.target.process.file.full_path, `.*wab\.exe`) or re.regex($selection.target.process.file.full_path, `.*wmic\.exe`) or re.regex($selection.target.process.file.full_path, `.*wsl\.exe`) or re.regex($selection.target.process.file.full_path, `.*xwizard\.exe`)) and ($selection.metadata.product_event_type = "4688" or $selection.metadata.product_event_type = "1"))

  condition:
    $selection
}