Crowdstrike Unusual Parent Child Processes

Description

Detects unusual parent child process pairings.

Query · python

from panther_crowdstrike_fdr_helpers import crowdstrike_detection_alert_context

SUSPICIOUS_PARENT_CHILD_COMBINATIONS_WINDOWS = {
    ("winword.exe", "cmd.exe"),
    ("winword.exe", "powershell.exe"),
    ("excel.exe", "cmd.exe"),
    ("excel.exe", "powershell.exe"),
    ("outlook.exe", "cmd.exe"),
    ("outlook.exe", "powershell.exe"),
}


def rule(event):
    if event.get("fdr_event_type", "") == "ProcessRollup2":
        if event.get("event_platform", "") == "Win":
            parent_process_name = event.deep_get("event", "ParentBaseFileName", default="").lower()
            child_process_name = (
                event.deep_get("event", "ImageFileName", default="").lower().split("\\")[-1]
            )
            return (
                parent_process_name,
                child_process_name,
            ) in SUSPICIOUS_PARENT_CHILD_COMBINATIONS_WINDOWS
    return False


def title(event):
    parent_process_name = event.deep_get("event", "ParentBaseFileName", default="").lower()
    child_process_name = (
        event.deep_get("event", "ImageFileName", default="").lower().split("\\")[-1]
    )
    procs = (parent_process_name, child_process_name)
    return f"Crowdstrike: Suspicious parent/child combination [{procs}] detected"


def alert_context(event):
    return crowdstrike_detection_alert_context(event)
Raw source Crowdstrike Unusual Parent Child Processes · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Description: Detects unusual parent child process pairings.
DisplayName: "Crowdstrike Unusual Parent Child Processes"
Enabled: true
Filename: crowdstrike_unusual_parent_child_processes.py
Reference: https://medium.com/falconforce/falconfriday-e4554e9e6665
Severity: High
Tests:
  - ExpectedResult: true
    Log:
      aid: 1234567890abcdefg654321
      aip: 1.2.3.4
      cid: abcdefghijklmnop123467890
      configbuild: 1007.3.0016606.11
      configstatehash: "3799024366"
      entitlements: "15"
      event:
        AuthenticationId: "293628"
        AuthenticodeHashData: 0000000000bc97f7a55c355f06119abc90155e8a
        CommandLine: C:\Windows\System32\cmd.exe
        ConfigBuild: 1007.3.0016606.11
        ConfigStateHash: "3799024366"
        EffectiveTransmissionClass: "2"
        Entitlements: "15"
        ImageFileName: \Device\HarddiskVolume2\Windows\System32\cmd.exe
        ImageSubsystem: "3"
        IntegrityLevel: "12288"
        MD5HashData: 0000000000df0bc6120d437e0a7e1281
        ParentAuthenticationId: "293628"
        ParentBaseFileName: excel.exe
        ParentProcessId: "4370948876"
        ProcessCreateFlags: "0"
        ProcessEndTime: ""
        ProcessParameterFlags: "24577"
        ProcessStartTime: "1682106752.006"
        ProcessSxsFlags: "64"
        RawProcessId: "1468"
        SHA1HashData: "0000000000000000000000000000000000000000"
        SHA256HashData: 0000000000040627d2ab8b9f2a3b69f7054ae3bfe8fb3bbac209ef95d4fc42be
        SessionId: "2"
        SignInfoFlags: "8683538"
        SourceProcessId: "4370948876"
        SourceThreadId: "6364981533"
        Tags: 25, 27, 40, 151, 874, 924, 12094627905582, 12094627906234, 237494511599633
        TargetProcessId: "4390327988"
        TokenType: "1"
        TreeId: "4295752857"
        UserSid: S-1-5-21-239183934-720705223-383019856-500
        aid: 1234567890abcdefg654321
        aip: 1.2.3.4
        cid: abcdefghijklmnop123467890
        event_platform: Win
        event_simpleName: ProcessRollup2
        id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
        name: ProcessRollup2V19
        timestamp: "1682106752722"
      event_platform: Win
      event_simplename: ProcessRollup2
      fdr_event_type: ProcessRollup2
      id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
      name: ProcessRollup2V19
      p_any_ip_addresses:
        - 1.2.3.4
      p_any_md5_hashes:
        - 0000000000df0bc6120d437e0a7e1281
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_any_sha1_hashes:
        - "0000000000000000000000000000000000000000"
      p_any_sha256_hashes:
        - 0000000000040627d2ab8b9f2a3b69f7054ae3bfe8fb3bbac209ef95d4fc42be
      p_any_trace_ids:
        - "4295752857"
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_event_time: "2023-04-21 19:52:32.722"
      p_log_type: Crowdstrike.FDREvent
      p_parse_time: "2023-04-21 20:05:52.94"
      p_row_id: 0000000000224847bdd7fa2ef5daae32
      p_schema_version: 0
      p_source_id: 1f33f64c-124d-413c-a9e3-d51ccedd8e77
      p_source_label: Crowdstrike-FDR-Dev
      timestamp: "2023-04-21 19:52:32.722"
      treeid: "4295752857"
    Name: Suspicious Event
  - ExpectedResult: false
    Log:
      aid: 1234567890abcdefg654321
      aip: 1.2.3.4
      cid: abcdefghijklmnop123467890
      configbuild: 1007.3.0016606.11
      configstatehash: "3799024366"
      entitlements: "15"
      event:
        AuthenticationId: "293628"
        AuthenticodeHashData: 0000000000bc97f7a55c355f06119abc90155e8a
        CommandLine: '"C:\Windows\System32\at.exe" at 09:00 /interactive /every:m,t,w,th,f,s,su'
        ConfigBuild: 1007.3.0016606.11
        ConfigStateHash: "3799024366"
        EffectiveTransmissionClass: "2"
        Entitlements: "15"
        ImageFileName: \Device\HarddiskVolume2\Windows\System32\at.exe
        ImageSubsystem: "3"
        IntegrityLevel: "12288"
        MD5HashData: 0000000000df0bc6120d437e0a7e1281
        ParentAuthenticationId: "293628"
        ParentBaseFileName: pwsh.exe
        ParentProcessId: "4370948876"
        ProcessCreateFlags: "0"
        ProcessEndTime: ""
        ProcessParameterFlags: "24577"
        ProcessStartTime: "1682106752.006"
        ProcessSxsFlags: "64"
        RawProcessId: "1468"
        SHA1HashData: "0000000000000000000000000000000000000000"
        SHA256HashData: 0000000000040627d2ab8b9f2a3b69f7054ae3bfe8fb3bbac209ef95d4fc42be
        SessionId: "2"
        SignInfoFlags: "8683538"
        SourceProcessId: "4370948876"
        SourceThreadId: "6364981533"
        Tags: 25, 27, 40, 151, 874, 924, 12094627905582, 12094627906234, 237494511599633
        TargetProcessId: "4390327988"
        TokenType: "1"
        TreeId: "4295752857"
        UserSid: S-1-5-21-239183934-720705223-383019856-500
        aid: 1234567890abcdefg654321
        aip: 1.2.3.4
        cid: abcdefghijklmnop123467890
        event_platform: Win
        event_simpleName: ProcessRollup2
        id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
        name: ProcessRollup2V19
        timestamp: "1682106752722"
      event_platform: Win
      event_simplename: ProcessRollup2
      fdr_event_type: ProcessRollup2
      id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
      name: ProcessRollup2V19
      p_any_ip_addresses:
        - 1.2.3.4
      p_any_md5_hashes:
        - 0000000000df0bc6120d437e0a7e1281
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_any_sha1_hashes:
        - "0000000000000000000000000000000000000000"
      p_any_sha256_hashes:
        - 0000000000040627d2ab8b9f2a3b69f7054ae3bfe8fb3bbac209ef95d4fc42be
      p_any_trace_ids:
        - "4295752857"
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_event_time: "2023-04-21 19:52:32.722"
      p_log_type: Crowdstrike.FDREvent
      p_parse_time: "2023-04-21 20:05:52.94"
      p_row_id: 0000000000224847bdd7fa2ef5daae32
      p_schema_version: 0
      p_source_id: 1f33f64c-124d-413c-a9e3-d51ccedd8e77
      p_source_label: Crowdstrike-FDR-Dev
      timestamp: "2023-04-21 19:52:32.722"
      treeid: "4295752857"
    Name: Non Suspicious Event
DedupPeriodMinutes: 60
LogTypes:
  - Crowdstrike.FDREvent
RuleID: "Crowdstrike.Unusual.Parent.Child.Processes"
Threshold: 1

# ------ paired body: crowdstrike_unusual_parent_child_processes.py ------

from panther_crowdstrike_fdr_helpers import crowdstrike_detection_alert_context

SUSPICIOUS_PARENT_CHILD_COMBINATIONS_WINDOWS = {
    ("winword.exe", "cmd.exe"),
    ("winword.exe", "powershell.exe"),
    ("excel.exe", "cmd.exe"),
    ("excel.exe", "powershell.exe"),
    ("outlook.exe", "cmd.exe"),
    ("outlook.exe", "powershell.exe"),
}


def rule(event):
    if event.get("fdr_event_type", "") == "ProcessRollup2":
        if event.get("event_platform", "") == "Win":
            parent_process_name = event.deep_get("event", "ParentBaseFileName", default="").lower()
            child_process_name = (
                event.deep_get("event", "ImageFileName", default="").lower().split("\\")[-1]
            )
            return (
                parent_process_name,
                child_process_name,
            ) in SUSPICIOUS_PARENT_CHILD_COMBINATIONS_WINDOWS
    return False


def title(event):
    parent_process_name = event.deep_get("event", "ParentBaseFileName", default="").lower()
    child_process_name = (
        event.deep_get("event", "ImageFileName", default="").lower().split("\\")[-1]
    )
    procs = (parent_process_name, child_process_name)
    return f"Crowdstrike: Suspicious parent/child combination [{procs}] detected"


def alert_context(event):
    return crowdstrike_detection_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.