[metadata]
creation_date = "2020/09/03"
maturity = "production"
updated_date = "2020/11/03"

[rule]
author = ["Elastic"]
description = """
A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details
such as command line, network connections, file writes and associated file signature details as well.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*"]
language = "eql"
license = "Elastic License"
name = "Suspicious Zoom Child Process"
risk_score = 47
rule_id = "97aba1ef-6034-4bd3-8c1a-1e0996b27afa"
severity = "medium"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Defense Evasion"]
type = "eql"


query = '''
process where event.type in ("start", "process_started", "info") and
 process.parent.name : "Zoom.exe" and process.name : ("cmd.exe", "powershell.exe", "pwsh.exe")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[rule.threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

