Merge pull request #3161 from alexmcdonald1124/msra-injection

Msra.exe process injection rule
2022-06-29 06:30:00 +02:00
parent 2da48f5052 1b08ee7916
commit afc3625791
1 changed files with 32 additions and 0 deletions
@@ -0,0 +1,32 @@
+title: Msra.exe Process Injection
+id: 744a188b-0415-4792-896f-11ddb0588dbc
+status: experimental
+description: Detects process injection using Microsoft Remote Asssistance (Msra.exe) which has been used for discovery and persistence tactics
+author: Alexander McDonald
+date: 2022/06/24
+references:
+    - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/
+    - https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        ParentImage|endswith: '\msra.exe'
+        ParentCommandLine|endswith: 'msra.exe'
+        Image|endswith:
+            - '\arp.exe'
+            - '\cmd.exe'
+            - '\net.exe'
+            - '\netstat.exe'
+            - '\nslookup.exe'
+            - '\route.exe'
+            - '\schtasks.exe'
+            - '\whoami.exe'
+    condition: selection
+falsepositives:
+    - Legitimate use of Msra.exe
+level: high
+tags:
+    - attack.defense_evasion
+    - attack.t1055