Suspicious Execution via Windows Services
Description
Identifies the execution of commonly abused Windows programs and suspicious execution paths via a Windows service. This may indicate an attempt to elevate privileges via Windows services.
Query · eql
process where event.action == "start" and
process.parent.executable : "?:\\Windows\\System32\\services.exe" and
(
/* Lolbas */
process.name : ("mshta.exe", "msbuild.exe", "installutil.exe", "rundll32.exe", "regsvr32.exe", "regasm.exe",
"wuauclt.exe", "wmic.exe") or
/* Suspicious Paths */
(process.executable : ("?:\\Users\\Public\\*", "?:\\ProgramData\\*", "?:\\Users\\*\\AppData\\*",
"?:\\Users\\*\\Pictures\\*", "?:\\Users\\*\\Music\\*", "?:\\Windows\\Tasks\\*",
"?:\\Windows\\System32\\tasks\\*", "?:\\Windows\\Temp\\*") and
/* noisy - excluding subdirs of ProgramData */
not process.executable : "?:\\ProgramData\\*\\*") or
/* Shell Command Interpreters */
(
process.name : ("cmd.exe", "powershell.exe") and
process.command_line : ("*http*://*", "* -enc *", "* -e *", "*/c *powershell*", "*/c *rundll32*", "*lsass*",
"*/c *Microsoft.NET*", "*-exec bypass*", "*Windows\\INF\\*", "*\\Users\\Public\\*")
) or
/* programfiles unquoted Service path hijack */
process.executable : ("?:\\Program", "?:\\Program.exe", "?:\\Program.scr", "?:\\Program.com", "?:\\Program:*") or
/* Exec from Alternate DataStream */
process.name : "*:*" or
/* known malware patterns */
/* ZenPack */
(process.executable : "?:\\Windows\\SysWOW64\\*.exe" and process.command_line : "*.exe /d\"?:\\*") or
/* DirtyMoe */
(process.executable : "?:\\Windows\\*.exe" and process.args : ("-a", "-auto") and
process.args_count == 2 and process.code_signature.exists == false) or
/* execution from windir currentdir and unsigned*/
(process.executable : "?:\\Windows\\*" and not process.executable : "?:\\Windows\\*\\*" and
process.code_signature.exists == false and
not process.pe.original_file_name in ("VPDAgent_x64.exe", "PAExec.exe") and
not process.executable : "?:\\Windows\\tenable_mw_scan_*.exe") or
/* execution from systemdir currentdir and untrusted codesign */
(process.executable : ("?:\\Windows\\System32\\*", "?:\\Windows\\SysWOW64\\*") and
not process.executable :("?:\\Windows\\System32\\*\\*", "?:\\Windows\\SysWOW64\\*\\*") and
process.code_signature.trusted == false) or
/* rogue Ammyy Admin */
(process.args : "-service" and process.args : "-lunch" and process.code_signature.exists == false and
not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe"))
)
and
not process.hash.sha256 in
("c9ef35bed70ffa0981bafd0071185b56fdad8f9c97f3582a4dae9b420959fb97",
"18dc098895ccc8246d417445a36d933c5f8487419b848ebe651fd0e11cb22afa",
"ea98309a35f92443b9c50736ce208656ec72af114ec8aceeb02dfa041ec2d6bc",
"bcf07679ea026f1dfba6f9ab63251e4834dc007bd2c5b9039deb9d900fe1c5e6",
"1c6af94b26f369e2c10819eefb869f873e5540e2c1b7bf4c7c632fc03d67368a",
"7f8e465edd27cdcd1d28292c35440d745b8bd528e21d6f56eb683b65d922eaed",
"ff361a79111795eabf24b7a8789347f1d043dac814cd6ff6531d47f268b72651",
"0c85d3e19ca3303a36187fba963235a03c36af61336a5a95d8b55ef05817b9d3",
"ae0fb4bf4a6faa4b808794b6e6ccbdf9f10c1ce01a86ccece002ac63cf09ff29",
"5859b114d96800a2b98ef9d19eaa573a786a422dad324547ef25be181389df01",
"f2949996bcd03858627fb196fc6751c0a88f1a2fa1a082c885a3be4b94e7f5b1",
"eabf1a97222db3a85269ef36c82f2ff44c91b18e6459b9e411e198b51fd9cef2",
"cd5ff596b7bacb117f90893f94fd8c542b659cc58f90ed1fbd0471fe85148bff",
"d99ae6b2da11fb89672906ccdb3ef2dde4534ca1406219285784c275af5e7014",
"e2bfdefbafe2445693f85af28c825c2aacba769c18393fd640386abde587498f",
"08d019e46a8755c33ad9ff9b96b5409a9005d87ba4e3cc58bdd8cf10eb0cd987",
"693c6c0f54bf5a2c14dc6e4e0cef3562c735b584c01204ff56d70e5d90502382",
"8a203d0dd4821b42ca399140e093919348b60ac43140e92f88d047263e2c57b4",
"e68743f3a0c299024e1540add1bcd9d3658ebbdbf172d74e1bf8fcd8c8c0406b",
"685a30cfd98e7636f145e1bfd7616d63a8a99e0d5c9bdb3a1171665bfc53491d",
"769603162b93de2d11888c1a820f0eef385b3a2c113f1bb24f939c79edc1ce62",
"422aa4268713b6c99581365985d403a62f6ccd9f0b5a23f9d963d1947dc77aee",
"c71ddd9aeaed18b6a3e6c80119504ececdfa329328e4a814913be6113c8efb1d",
"c4c6b0db707020364cd398d2a7a3eb2516cfeb0a011557dce3393e25eaa90be4",
"4208e349ff97a2dc6100ee9e5e61e23ab650b316e62dd4a25d1119a08a59f298",
"8850f6c649bd4d69d7ddb1f817865d67ee1de340e8c397f587a67fbcbba35cdd",
"2b25e0331289460dbaed2d851b92f43e6999f694bf17964a8786f3a4cce602a6",
"99b3e6d71329624cb75a88bb66e3249510f6008a38de5535ca5ccb8f580519e0",
"9dbd07d864d31d13b96f1bd61bf83dcd04b43f5266019c99592671cd819968e6",
"70da895606ecde4b0ceaee6d19ddcc42be35ec32fa3667f3efbe2f79457de9c4",
"a74dd36806499b164906b0b9a7b7118fb19a02562a7229c544d77dd946449881",
"9860f515da98b85f61d2ee816271717b77245a1163ba498d5253974d9f7c78b3",
"5205617f86113f84df0c6d750f06e8284a58d4c781ba3993175a5f68b00600de",
"d68553c0525323e804344a4cb77b8bf0b35ce5f2349a2340ba482380d785e19b",
"dac28f4a11429f99705bfbf0e49f586c3c3a43a5535c387f6ab01cfea3386dff",
"8db84b45c31f64f03ffef9728a39eae8e32c9b3fd21cc4fa914aab22c0104de1",
"d699dc58c91ce4c886a858addf54b2501bf55f4d4be91deac4e57a5be31b1a94",
"f689ee9af94b00e9e3f0bb072b34caaf207f32dcb4f5782fc9ca351df9a06c97",
"c0cfeb9b627dddd81f403d8848e70e54e4fe5c67da07e3ed1b16c1bb665b5e42",
"84c073bfc86cf51aa8c33fa91b43ef2091a6e41482fa9c257204547955dcb4ca",
"f94d16f63262ea3999997d35a5fa84a1863f889f1d2a429ce0d4faf7bb79825c",
"afd293b75c5adfbff1183b08033d36fc0845c554e5ba41f0c1c647eb78a5952e",
"f52c72a3c8c4592cbb6552c076a225f5956e287b096ae8b000da333ad8773b13",
"c34f400023783127e5181d5e65083adc1f3abf28127eb560e4d03c547fa5a2c2",
"7365cd76ce2b2cd2aeb998ff53c5faff144e8a06b698a3d156b686f2ff640691",
"121ed90aec5135af04b1e5f8b26a4e25278232a93c45ef09ae226629ad1de64f",
"03978563fcd327059ef3df101ca1defa60b0f3c86b5fa72b01d31f802ad81856",
"7e0ff000ce7cacd201a76a017ee669f34e71f557fa468280cf27b0d2370dd8ad",
"42aa6483ad8f0d091141e0fd05631e79600f5d37a25bf260b493a8cfa99adf1b",
"9d2e4a42cbcdd9315b6c86a36af632c86293940287dc26930e1c7932eb7c6cb2",
"cd1dd8cff168b57aebbd59a62e48e592be8571082e1e5416613cd6ad27edc2ce",
"5fc1af2ed768d259612242c76dee2a29fd84379a7eb1a30da13cbc036f16385e",
"41292975a38a69c0afc8b22b8622209e40ffb8cb6017fa16f15be8d94639fb93",
"cdcdcd2866eb4156875cb8a2304d2dce9d9ba764f67e5a79c98556c9efa2aeaa",
"4aa716bf7c4c1e164d6f58cef08a69118dbf22cca00def1c604b6e090a302520",
"fd2c88a7d7e9a6bab6c0c9a725e12e1d1fcc9f2f6dd88eaf6c204952a570001e",
"022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7",
"9c89e90a6a649cbe41aaae468aab6bdb1400620bee498b151b282c411fc11357",
"c0908b08a80f031c49a50f873a8d4a9426c0100fb4fa7a46f7b34540191684ce",
"ca3056bbec01c0610b7f7f169ee1081c72cc210df169c9cc36e9bcfc38f94ceb",
"acd55c44b8b0d66d66defed85ca18082c092f048d3621da827fce593305c11fd",
"bb3830b14df80838fb201c611abf0c1f3714c6b8b103ed084eafc170036631be",
"488df57af2d0a29d555b3ad233e5ac17058582ef040b3a89471d4c519b9b4db7",
"92512032cefa1fd63490ab00eb974b15ae557578d901faf4aa6c3ff4c214a239",
"7e46a30ec382d6973695520a3c88337bed3f33d5d30b64cac689fb83ebd29d8f",
"1186244a77bd08d3a5aad8f24f9cf59ae228782adde32467e0622c5236586190",
"ae16d853600d647688f414e023ce8644ceacf1d6ada050792ee665c4465c939b",
"cf41501fa77ffece7a67b9cd996b6a3fceafefb44bf192c9078a2f0e30e01f97",
"88f1612d7e774e0bbd6708ca946bcdb3c671a18048b2a4f5ad33c6a7c2db02de",
"73a91d7dbdff150632a9501c94b4f328e61fc8a8e52d27b2646921ddee8acae2",
"e72f59681ef6dd09608772cde8bb0dcbb42e97118ad58ad8fe2d3501d73bcd2e",
"b75268bc78de915eff442611f9c7503b4f872b22d7c54547694923cce6427b4e",
"854ed6e135b1405329003f0595c3ca462faf5381ac5d6f93bccfece61d6a2d88",
"be132253fb111600acedb58fa96fd18af69a8a8395880b0d8d89ff13ba30455b",
"4eb8a5b3ba5b30b7c4e4e1db60af75f7cac808aa3bc0cd326bf4863535659def",
"46122ee39283dbca52dde436ef04d47fd962271424726b491ad8584389461177",
"3c16784f9b827aa6583d529f8585c431cd39e7e3a96e31c7b9882d5b48c00087",
"d71fce8dc14cfb082041c2ddd6184baa6e1bc535582e36174bc0a80be9f7a879",
"73f834726b1091494d8151ff053eeb4dc6f79dd49525f23a5583c2bdeb176eb8",
"7e1c9498c44a60315c3f5e41c9a8247d605c66328653cef4560277592de79e93",
"e501b3cc3f0a32e14ba475038712e24c312c9468780eaf36f47aa73a16bf5f1f",
"64a080388fcd44c14246de991b9a90f0541f9878d2164469d7bf7499c568ca32") and
not (process.pe.original_file_name :
("OneDriveStandaloneUpdater.exe",
"Microsoft.SharePoint.Migration.ClientService.exe",
"process.pe.original_file_name") and
process.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation") and process.code_signature.trusted == true) and
not (process.code_signature.subject_name : ("Practical Dental Solutions LLC", "ISL Online Ltd.", "Nanosystems S.r.l.",
"Opera Software AS", "Kaspersky Lab JSC", "AO Kaspersky Lab", "LogMeIn, Inc.", "Bright Data Ltd", "Malwarebytes Inc",
"SEIKO EPSON CORPORATION", "KOINO Co., Ltd.", "Panda Security S.L.", "Endgame, Inc.",
"Acrosync LLC", "Midassoft Corporation Limted", "ForensiT Limited", "ConnectWise, LLC", "ScreenConnect Software",
"Beijing Duyou Science and Technology Co.,Ltd.", "N-ABLE TECHNOLOGIES LTD", "Icona S.R.L.", "Dropbox, Inc", "ISL Online",
"CodeLathe, LLC", "Google LLC", "Connectwise, LLC", "Mozilla Corporation", "Huawei Technologies Co., Ltd.", "Icona srl",
"Plarium Global LTD", "Trend Micro, Inc.", "HeroSpeed Digital Technology Co.,Ltd", "IDrive, Inc.", "Secure By Design Inc.",
"SecureLink, Inc.", "Google Inc", "Wondershare Technology Group Co.,Ltd", "Malwarebytes Inc.", "Suse LLC", "FLEXTECH INC.",
"DameWare Development, LLC.", "Acronis International GmbH", "Broadcom Inc", "Symantec Corporation", "Ivanti, Inc.",
"Rsupport Co., Ltd.", "SAP", "VMware, Inc.", "Private trade unitary enterprise LST",
"Solarwinds Worldwide, LLC", "Techinline Limited", "ZOHO CORPORATION PRIVATE LIMITED", "Canon Inc.",
"Sikka Software Corporation", "TeamViewer Germany GmbH", "Brother Industries, Ltd.", "Pro Softnet Corporation", "Raman Karpuk",
"ATEMPO SAS", "TeamViewer", "WireGuard LLC", "MetaQuotes Ltd", "NinjaOne LLC",
"ForensiT Software Limited", "Opera Norway AS", "Veeam Software Group GmbH", "Copermatica SL", "SimplyCore LLC", "SimplyCore, LLC",
"") and
process.code_signature.trusted == true) and
not (process.name : "RUNDLL32.EXE" and
process.args : ("aepdu.dll,AePduRunUpdate",
"Windows.Storage.ApplicationData.dll,CleanupTemporaryState",
"srrstr.dll,ExecuteScheduledSPPCreation",
"WSClient.dll,WSpTLR",
"WSClient.dll,RefreshBannedAppsList",
"acproxy.dll,PerformAutochkOperations",
"invagent.dll,RunUpdate",
"Startupscan.dll,SusRunTask",
"dfdts.dll,DfdGetDefaultPolicyAndSMART",
"appraiser.dll,DoScheduledTelemetryRun",
"?:\\Windows\\system32\\pla.dll,PlaHost",
"?:\\Windows\\system32\\invagent.dll,RunUpdate",
"tsworkspace,TaskUpdateWorkspaces2",
"tsworkspace,WorkspaceStatusNotify2",
"sysmain.dll,PfSvWsSwapAssessmentTask",
"ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem")) and
not (process.name : ("wscript.exe", "cscript.exe") and
process.args : ("?:\\Program Files\\Intel\\*.vbs", "?:\\Windows\\system32\\calluxxprovider.vbs")) and
not (process.executable : "?:\\Windows\\*.exe" and process.code_signature.status : ("errorExpired", "errorCode_endpoint*", "errorChaining")) and
not (process.name : ("wscript.exe", "cscript.exe") and process.working_directory : "\\\\*") and
not (process.executable : "?:\\Windows\\Temp\\*" and process.code_signature.trusted == true) and
not process.executable : ("?:\\Windows\\System32\\sppsvc.exe", "?:\\Windows\\ise-exec-svc.exe") and
not (process.name == "cmd.exe" and process.command_line like "*pzaS5TZXJ2aWNlTmFtZSA9ICJPMjRBVVRIIjs*")