[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2020/12/17"

[rule]
author = ["Elastic"]
description = """
Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature
validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass
application allowlists and signature validation.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*"]
language = "eql"
license = "Elastic License"
name = "Network Connection via Signed Binary"
risk_score = 21
rule_id = "63e65ec3-43b1-45b0-8f2d-45b34291dc44"
severity = "low"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Defense Evasion"]
type = "eql"

query = '''
sequence by process.entity_id
  [process where (process.name : "expand.exe" or process.name : "extrac.exe" or
                 process.name : "ieexec.exe" or process.name : "makecab.exe") and
     event.type == "start"]
  [network where (process.name : "expand.exe" or process.name : "extrac.exe" or
                 process.name : "ieexec.exe" or process.name : "makecab.exe") and
     not cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1218"
name = "Signed Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

