phantinuss
64 lines
2.3 KiB
YAML
64 lines
2.3 KiB
YAML
title: Microsoft Outlook Product Spawning Windows Shell
|
|
id: 208748f7-881d-47ac-a29c-07ea84bf691d
|
|
status: test
|
|
related:
|
|
- id: 438025f9-5856-4663-83f7-52f878a70a50
|
|
type: derived
|
|
description: Detects a Windows command and scripting interpreter executable started from Microsoft Outlook
|
|
author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team
|
|
references:
|
|
- https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100
|
|
- https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
|
|
date: 2022/02/28
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
detection:
|
|
selection:
|
|
ParentImage|endswith: '\OUTLOOK.EXE'
|
|
Image|endswith:
|
|
- '\cmd.exe'
|
|
- '\powershell.exe'
|
|
- '\wscript.exe'
|
|
- '\cscript.exe'
|
|
- '\sh.exe'
|
|
- '\bash.exe'
|
|
- '\scrcons.exe'
|
|
- '\schtasks.exe'
|
|
- '\regsvr32.exe'
|
|
- '\hh.exe'
|
|
- '\wmic.exe' # https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/
|
|
- '\mshta.exe'
|
|
# - '\rundll32.exe' # see comment below
|
|
- '\msiexec.exe'
|
|
- '\forfiles.exe'
|
|
- '\scriptrunner.exe'
|
|
- '\mftrace.exe'
|
|
- '\AppVLP.exe'
|
|
- '\svchost.exe' # https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html
|
|
- '\msbuild.exe' # https://github.com/elastic/detection-rules/blob/main/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml
|
|
|
|
# Several FPs with rundll32.exe - we started excluding specific use cases and
|
|
# ended commenting out all rundll32.exe sub processes
|
|
|
|
#filter_outlook_photoviewer: # https://twitter.com/Luke_Hamp/status/1495919717760237568
|
|
# ParentImage|endswith: '\OUTLOOK.EXE'
|
|
# Image|endswith: '\rundll32.exe'
|
|
# CommandLine|contains: '\PhotoViewer.dll'
|
|
#filter_outlook_printattachments: # https://twitter.com/KickaKamil/status/1496238278659485696
|
|
# ParentImage|endswith: '\OUTLOOK.EXE'
|
|
# Image|endswith: '\rundll32.exe'
|
|
# CommandLine|contains|all:
|
|
# - 'shell32.dll,Control_RunDLL'
|
|
# - '\SYSTEM32\SPOOL\DRIVERS\'
|
|
condition: selection # and not 1 of filter*
|
|
fields:
|
|
- CommandLine
|
|
- ParentCommandLine
|
|
falsepositives:
|
|
- Unknown
|
|
level: high
|
|
tags:
|
|
- attack.execution
|
|
- attack.t1204.002
|