[rule]
description = """
Identifies the execution of a file written or modified by a signed Microsoft binary proxy utility such as MSHTA.exe,
CertReq.exe or CertUtil.exe. Adversaries may bypass process and/or signature-based defenses by proxying execution of
malicious content with signed binaries.
"""
id = "ccbc4a79-3bae-4623-aaef-e28a96bf538b"
license = "Elastic License v2"
name = "Execution of a File Written by a Signed Binary Proxy"
os_list = ["windows"]
version = "1.0.32"
query = '''
sequence with maxspan=5m
[file where event.action != "deletion" and
(process.name : ("MSHTA.EXE", "CertUtil.exe", "CertReq.exe", "PrintBrm.exe") or
process.executable : "?:\\Windows\\sys*\\OpenSSH\\sftp.exe") and
not file.path : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe")] as event0
[process where event.action == "start" and
startswith~(process.executable, event0.file.path) and
not process.parent.executable : ("?:\\Windows\\System32\\drvinst.exe") and
not (process.code_signature.subject_name: "Bentley Systems, Incorporated" and process.code_signature.trusted == true)]
'''
min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"
[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[internal]
min_endpoint_version = "8.4.0"