Suspicious Microsoft IIS Worker Descendant

[rule]
description = """
Identifies suspicious child processes of Microsoft IIS Worker process which may suggest a vulnerability and remote
webshell access.
"""
id = "89c9c5a0-a136-41e9-8cc8-f21ef5ad894b"
license = "Elastic License v2"
name = "Suspicious Microsoft IIS Worker Descendant"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
]
version = "1.0.36"

query = '''
process where event.action == "start" and
(
  (
    process.parent.name : "w3wp.exe" and
    (
      (process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE") and
        (process.command_line : ("*/c powershell*", "*&cd&echo*", "*certutil*", "*bitsadmin*", "*/c cd /d *",
                                "*http*", "*.replace*", "*Reflection.Assembly*", "*$*$*$*$*$*", "*^*^*^*^*^*^*",
                                "*set *set *set *", "* wget*") or
        process.args : ("?:\\Users\\Public\\*", "?:\\Windows\\Tasks\\*", "?:\\Windows\\Temp\\*", "?:\\windows\\help\\*"))) or

      (process.pe.original_file_name == "PowerShell.EXE" and length(process.parent.command_line) >= 150 and
        process.parent.command_line : ("* -enc*", "* -e *", "* bypass*")) or

      (process.parent.args : ("MSExchange*", "SharePoint*") and
        process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE", "CertUtil.exe", "CertReq.exe", "curl.exe", "RUNDLL32.EXE", "REGSVR32.EXE")) or

      (process.pe.original_file_name == "Cmd.Exe" and process.args_count ==1)
    )
  ) or

  (descendant of [process where process.name : "w3wp.exe"] and
  (
    (process.name : ("net.exe", "net1.exe") and process.command_line : ("*administrators*", "*remote desktop*", "*use \\* /user*")) or
    (process.pe.original_file_name in ("CertUtil.exe", "CertReq.exe", "curl.exe", "bitsadmin.exe"))
   )
  ) or

  (descendant of [process where process.parent.name : "w3wp.exe" and
    process.pe.original_file_name == "Cmd.Exe" and process.command_line : ("*/c powershell*", "*&cd&echo*")]
  )
)
/* False Positives */
and not (process.name : "cmd.exe" and process.parent.args : "Icims" and process.command_line : "*vault.azure.net*" and process.parent.name : "w3wp.exe") and
not (process.name : "powershell.exe" and process.command_line : "\"powershell.exe\" netsh http show servicestate | ?{$_.Tostring().Contains(*") and
process.hash.sha256 != "fe1d2ad2781879dc05039d87bd12259f3bcf411c66c925d31827d6a757d33ec4" and
not (process.name : "cmd.exe" and process.parent.name:"w3wp.exe" and
     process.args:"'HttpsPortDesktopAgent'),"  and process.args : "echo" and process.parent.args : "DefaultAppPool") and
not (process.name == "conhost.exe" and process.parent.name == "cmd.exe") and
not (process.name : "curl.exe" and process.args : "https*.lansweeper.com" and process.parent.name : "w3wp.exe" and process.parent.args : "Lansweeper AppPool")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"