Prep main for 9.1 (#4555)
* Prep for Release 9.1 * Update Patch Version * Update Patch version * Update Patch version
This commit is contained in:
shashank-elastic
@@ -2,9 +2,7 @@
|
||||
creation_date = "2023/09/19"
|
||||
integration = ["problemchild", "endpoint", "windows"]
|
||||
maturity = "production"
|
||||
updated_date = "2025/01/15"
|
||||
min_stack_version = "8.14.0"
|
||||
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
|
||||
updated_date = "2025/03/20"
|
||||
|
||||
[rule]
|
||||
anomaly_threshold = 75
|
||||
@@ -20,6 +18,40 @@ interval = "15m"
|
||||
license = "Elastic License v2"
|
||||
machine_learning_job_id = "problem_child_rare_process_by_host"
|
||||
name = "Unusual Process Spawned by a Host"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Unusual Process Spawned by a Host
|
||||
|
||||
The detection rule leverages machine learning to identify atypical processes on Windows systems, focusing on those that deviate from normal behavior. Adversaries often exploit legitimate system tools, known as LOLbins, to evade detection. This rule uses the ProblemChild ML model to flag processes that are both statistically unusual and potentially malicious, enhancing detection of stealthy attacks that bypass traditional methods.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the process details flagged by the ProblemChild ML model, including the process name, path, and command line arguments, to understand its nature and potential purpose.
|
||||
- Check the parent process of the flagged process to determine if it was spawned by a legitimate application or a known LOLbin, which might indicate a Living off the Land attack.
|
||||
- Investigate the host's historical activity to assess whether this process or similar ones have been executed previously, focusing on any patterns of unusual behavior.
|
||||
- Correlate the process activity with user logins and network connections to identify any suspicious user behavior or external communications that coincide with the process execution.
|
||||
- Examine the system's security logs for any related alerts or anomalies around the time the process was detected, which might provide additional context or evidence of malicious activity.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Routine administrative tasks may trigger false positives if they involve unusual processes or tools not commonly used on the host. Users can create exceptions for these known tasks to prevent unnecessary alerts.
|
||||
- Software updates or installations can spawn processes that are atypical but benign. Identifying and excluding these processes during known maintenance windows can reduce false positives.
|
||||
- Custom scripts or automation tools that mimic LOLbins behavior might be flagged. Users should document and whitelist these scripts if they are verified as safe and necessary for operations.
|
||||
- Legitimate third-party applications that use system binaries in uncommon ways may be misclassified. Regularly review and update the list of approved applications to ensure they are not mistakenly flagged.
|
||||
- Temporary spikes in unusual processes due to legitimate business activities, such as end-of-quarter reporting, can be managed by adjusting the detection thresholds or temporarily disabling the rule during these periods.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected host from the network to prevent further spread or communication with potential command and control servers.
|
||||
- Terminate the suspicious process identified by the ProblemChild ML model to halt any ongoing malicious activity.
|
||||
- Conduct a thorough review of the process's parent and child processes to identify any additional malicious activity or persistence mechanisms.
|
||||
- Remove any identified LOLbins or unauthorized tools used by the adversary from the system to prevent further exploitation.
|
||||
- Restore the affected system from a known good backup if any system integrity issues are detected.
|
||||
- Update endpoint protection and monitoring tools to ensure they can detect similar threats in the future, focusing on the specific techniques used in this incident.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems are affected."""
|
||||
references = [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
|
||||
"https://docs.elastic.co/en/integrations/problemchild",
|
||||
@@ -58,40 +90,6 @@ tags = [
|
||||
"Resources: Investigation Guide",
|
||||
]
|
||||
type = "machine_learning"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Unusual Process Spawned by a Host
|
||||
|
||||
The detection rule leverages machine learning to identify atypical processes on Windows systems, focusing on those that deviate from normal behavior. Adversaries often exploit legitimate system tools, known as LOLbins, to evade detection. This rule uses the ProblemChild ML model to flag processes that are both statistically unusual and potentially malicious, enhancing detection of stealthy attacks that bypass traditional methods.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the process details flagged by the ProblemChild ML model, including the process name, path, and command line arguments, to understand its nature and potential purpose.
|
||||
- Check the parent process of the flagged process to determine if it was spawned by a legitimate application or a known LOLbin, which might indicate a Living off the Land attack.
|
||||
- Investigate the host's historical activity to assess whether this process or similar ones have been executed previously, focusing on any patterns of unusual behavior.
|
||||
- Correlate the process activity with user logins and network connections to identify any suspicious user behavior or external communications that coincide with the process execution.
|
||||
- Examine the system's security logs for any related alerts or anomalies around the time the process was detected, which might provide additional context or evidence of malicious activity.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Routine administrative tasks may trigger false positives if they involve unusual processes or tools not commonly used on the host. Users can create exceptions for these known tasks to prevent unnecessary alerts.
|
||||
- Software updates or installations can spawn processes that are atypical but benign. Identifying and excluding these processes during known maintenance windows can reduce false positives.
|
||||
- Custom scripts or automation tools that mimic LOLbins behavior might be flagged. Users should document and whitelist these scripts if they are verified as safe and necessary for operations.
|
||||
- Legitimate third-party applications that use system binaries in uncommon ways may be misclassified. Regularly review and update the list of approved applications to ensure they are not mistakenly flagged.
|
||||
- Temporary spikes in unusual processes due to legitimate business activities, such as end-of-quarter reporting, can be managed by adjusting the detection thresholds or temporarily disabling the rule during these periods.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected host from the network to prevent further spread or communication with potential command and control servers.
|
||||
- Terminate the suspicious process identified by the ProblemChild ML model to halt any ongoing malicious activity.
|
||||
- Conduct a thorough review of the process's parent and child processes to identify any additional malicious activity or persistence mechanisms.
|
||||
- Remove any identified LOLbins or unauthorized tools used by the adversary from the system to prevent further exploitation.
|
||||
- Restore the affected system from a known good backup if any system integrity issues are detected.
|
||||
- Update endpoint protection and monitoring tools to ensure they can detect similar threats in the future, focusing on the specific techniques used in this incident.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems are affected."""
|
||||
[[rule.threat]]
|
||||
framework = "MITRE ATT&CK"
|
||||
[[rule.threat.technique]]
|
||||
|
||||
+37
-39
@@ -2,9 +2,7 @@
|
||||
creation_date = "2023/10/16"
|
||||
integration = ["problemchild", "endpoint", "windows"]
|
||||
maturity = "production"
|
||||
updated_date = "2025/01/15"
|
||||
min_stack_version = "8.14.0"
|
||||
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
|
||||
updated_date = "2025/03/20"
|
||||
|
||||
[rule]
|
||||
anomaly_threshold = 75
|
||||
@@ -20,6 +18,42 @@ interval = "15m"
|
||||
license = "Elastic License v2"
|
||||
machine_learning_job_id = "problem_child_rare_process_by_parent"
|
||||
name = "Unusual Process Spawned by a Parent Process"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Unusual Process Spawned by a Parent Process
|
||||
|
||||
In Windows environments, processes are often spawned by parent processes to perform legitimate tasks. However, adversaries can exploit this by using legitimate tools, known as LOLbins, to execute malicious activities stealthily. The detection rule leverages machine learning to identify anomalies in process creation patterns, flagging processes that deviate from typical behavior, thus uncovering potential threats that evade traditional detection methods.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the parent process and child process names to determine if they are known legitimate applications or if they are commonly associated with LOLbins or other malicious activities.
|
||||
- Check the process creation time and correlate it with any known user activity or scheduled tasks to identify if the process execution aligns with expected behavior.
|
||||
- Investigate the command line arguments used by the suspicious process to identify any unusual or potentially malicious commands or scripts being executed.
|
||||
- Analyze the network activity associated with the process to detect any suspicious outbound connections or data exfiltration attempts.
|
||||
- Examine the file path and hash of the executable to verify its legitimacy and check against known malware databases or threat intelligence sources.
|
||||
- Review any recent changes to the system, such as software installations or updates, that might explain the unusual process behavior.
|
||||
- Consult endpoint detection and response (EDR) logs or other security tools to gather additional context and evidence related to the process and its activities.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Legitimate administrative tools like PowerShell or command prompt may be flagged when used for routine tasks. Users can create exceptions for these tools when executed by known and trusted parent processes.
|
||||
- Software updates or installations often spawn processes that might appear unusual. Exclude these processes by identifying their typical parent-child relationships during updates.
|
||||
- Custom scripts or automation tools used within the organization might trigger alerts. Document these scripts and their expected behavior to create exceptions for them.
|
||||
- Frequent use of remote management tools can lead to false positives. Ensure these tools are whitelisted when used by authorized personnel.
|
||||
- Regularly review and update the list of exceptions to accommodate changes in legitimate process behaviors over time.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
|
||||
- Terminate the suspicious process identified by the alert to stop any ongoing malicious actions.
|
||||
- Conduct a thorough analysis of the process and its parent to understand the scope of the compromise and identify any additional malicious activities or files.
|
||||
- Remove any malicious files or artifacts associated with the process from the system to ensure complete remediation.
|
||||
- Restore the system from a known good backup if the integrity of the system is compromised beyond repair.
|
||||
- Update and patch the system to close any vulnerabilities that may have been exploited by the adversary.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""
|
||||
references = [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
|
||||
"https://docs.elastic.co/en/integrations/problemchild",
|
||||
@@ -58,42 +92,6 @@ tags = [
|
||||
"Resources: Investigation Guide",
|
||||
]
|
||||
type = "machine_learning"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Unusual Process Spawned by a Parent Process
|
||||
|
||||
In Windows environments, processes are often spawned by parent processes to perform legitimate tasks. However, adversaries can exploit this by using legitimate tools, known as LOLbins, to execute malicious activities stealthily. The detection rule leverages machine learning to identify anomalies in process creation patterns, flagging processes that deviate from typical behavior, thus uncovering potential threats that evade traditional detection methods.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the parent process and child process names to determine if they are known legitimate applications or if they are commonly associated with LOLbins or other malicious activities.
|
||||
- Check the process creation time and correlate it with any known user activity or scheduled tasks to identify if the process execution aligns with expected behavior.
|
||||
- Investigate the command line arguments used by the suspicious process to identify any unusual or potentially malicious commands or scripts being executed.
|
||||
- Analyze the network activity associated with the process to detect any suspicious outbound connections or data exfiltration attempts.
|
||||
- Examine the file path and hash of the executable to verify its legitimacy and check against known malware databases or threat intelligence sources.
|
||||
- Review any recent changes to the system, such as software installations or updates, that might explain the unusual process behavior.
|
||||
- Consult endpoint detection and response (EDR) logs or other security tools to gather additional context and evidence related to the process and its activities.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Legitimate administrative tools like PowerShell or command prompt may be flagged when used for routine tasks. Users can create exceptions for these tools when executed by known and trusted parent processes.
|
||||
- Software updates or installations often spawn processes that might appear unusual. Exclude these processes by identifying their typical parent-child relationships during updates.
|
||||
- Custom scripts or automation tools used within the organization might trigger alerts. Document these scripts and their expected behavior to create exceptions for them.
|
||||
- Frequent use of remote management tools can lead to false positives. Ensure these tools are whitelisted when used by authorized personnel.
|
||||
- Regularly review and update the list of exceptions to accommodate changes in legitimate process behaviors over time.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
|
||||
- Terminate the suspicious process identified by the alert to stop any ongoing malicious actions.
|
||||
- Conduct a thorough analysis of the process and its parent to understand the scope of the compromise and identify any additional malicious activities or files.
|
||||
- Remove any malicious files or artifacts associated with the process from the system to ensure complete remediation.
|
||||
- Restore the system from a known good backup if the integrity of the system is compromised beyond repair.
|
||||
- Update and patch the system to close any vulnerabilities that may have been exploited by the adversary.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""
|
||||
[[rule.threat]]
|
||||
framework = "MITRE ATT&CK"
|
||||
[[rule.threat.technique]]
|
||||
|
||||
@@ -2,9 +2,7 @@
|
||||
creation_date = "2023/10/16"
|
||||
integration = ["problemchild", "endpoint", "windows"]
|
||||
maturity = "production"
|
||||
updated_date = "2025/01/15"
|
||||
min_stack_version = "8.14.0"
|
||||
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
|
||||
updated_date = "2025/03/20"
|
||||
|
||||
[rule]
|
||||
anomaly_threshold = 75
|
||||
@@ -21,6 +19,41 @@ interval = "15m"
|
||||
license = "Elastic License v2"
|
||||
machine_learning_job_id = "problem_child_rare_process_by_user"
|
||||
name = "Unusual Process Spawned by a User"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Unusual Process Spawned by a User
|
||||
|
||||
The detection of unusual processes spawned by users leverages machine learning to identify anomalies in user behavior and process execution. Adversaries often exploit legitimate tools, known as LOLbins, to evade detection. This rule uses both supervised and unsupervised ML models to flag processes that deviate from typical user activity, indicating potential misuse or masquerading tactics.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the user context associated with the alert to determine if the user has a history of spawning unusual processes or if this is an isolated incident.
|
||||
- Examine the specific process flagged by the alert, including its command line arguments, parent process, and any associated network activity, to identify potential indicators of compromise.
|
||||
- Check for the presence of known LOLbins or other legitimate tools that may have been exploited, as indicated by the alert's focus on defense evasion tactics.
|
||||
- Investigate any recent changes in the user's behavior or system configuration that could explain the anomaly, such as software updates or new application installations.
|
||||
- Correlate the alert with other security events or logs from the same timeframe to identify any related suspicious activities or patterns.
|
||||
- Assess the risk score and severity level in the context of the organization's threat landscape to prioritize the response and determine if further action is needed.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Legitimate administrative tools may trigger false positives if they are used in atypical contexts. Users should review the context of the process execution and, if deemed safe, add these tools to an exception list to prevent future alerts.
|
||||
- Scheduled tasks or scripts that run infrequently might be flagged as unusual. Verify the legitimacy of these tasks and consider excluding them if they are part of regular maintenance or updates.
|
||||
- Software updates or installations can spawn processes that appear anomalous. Confirm the source and purpose of these updates, and if they are routine, create exceptions for these specific processes.
|
||||
- Developers or IT personnel using command-line tools for legitimate purposes may trigger alerts. Evaluate the necessity of these tools in their workflow and whitelist them if they are consistently used in a non-malicious manner.
|
||||
- New or infrequently used applications might be flagged due to lack of historical data. Assess the application's legitimacy and, if appropriate, add it to a list of known safe applications to reduce false positives.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected system from the network to prevent further spread or communication with potential command and control servers.
|
||||
- Terminate the suspicious process identified by the alert to halt any ongoing malicious activity.
|
||||
- Conduct a thorough review of the user's recent activity and access logs to identify any unauthorized actions or data access.
|
||||
- Reset the credentials of the affected user account to prevent further unauthorized access, ensuring that strong, unique passwords are used.
|
||||
- Scan the system for additional indicators of compromise, such as other unusual processes or modifications to system files, and remove any identified threats.
|
||||
- Restore the system from a known good backup if any critical system files or configurations have been altered.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""
|
||||
references = [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
|
||||
"https://docs.elastic.co/en/integrations/problemchild",
|
||||
@@ -59,41 +92,6 @@ tags = [
|
||||
"Resources: Investigation Guide",
|
||||
]
|
||||
type = "machine_learning"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Unusual Process Spawned by a User
|
||||
|
||||
The detection of unusual processes spawned by users leverages machine learning to identify anomalies in user behavior and process execution. Adversaries often exploit legitimate tools, known as LOLbins, to evade detection. This rule uses both supervised and unsupervised ML models to flag processes that deviate from typical user activity, indicating potential misuse or masquerading tactics.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the user context associated with the alert to determine if the user has a history of spawning unusual processes or if this is an isolated incident.
|
||||
- Examine the specific process flagged by the alert, including its command line arguments, parent process, and any associated network activity, to identify potential indicators of compromise.
|
||||
- Check for the presence of known LOLbins or other legitimate tools that may have been exploited, as indicated by the alert's focus on defense evasion tactics.
|
||||
- Investigate any recent changes in the user's behavior or system configuration that could explain the anomaly, such as software updates or new application installations.
|
||||
- Correlate the alert with other security events or logs from the same timeframe to identify any related suspicious activities or patterns.
|
||||
- Assess the risk score and severity level in the context of the organization's threat landscape to prioritize the response and determine if further action is needed.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Legitimate administrative tools may trigger false positives if they are used in atypical contexts. Users should review the context of the process execution and, if deemed safe, add these tools to an exception list to prevent future alerts.
|
||||
- Scheduled tasks or scripts that run infrequently might be flagged as unusual. Verify the legitimacy of these tasks and consider excluding them if they are part of regular maintenance or updates.
|
||||
- Software updates or installations can spawn processes that appear anomalous. Confirm the source and purpose of these updates, and if they are routine, create exceptions for these specific processes.
|
||||
- Developers or IT personnel using command-line tools for legitimate purposes may trigger alerts. Evaluate the necessity of these tools in their workflow and whitelist them if they are consistently used in a non-malicious manner.
|
||||
- New or infrequently used applications might be flagged due to lack of historical data. Assess the application's legitimacy and, if appropriate, add it to a list of known safe applications to reduce false positives.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected system from the network to prevent further spread or communication with potential command and control servers.
|
||||
- Terminate the suspicious process identified by the alert to halt any ongoing malicious activity.
|
||||
- Conduct a thorough review of the user's recent activity and access logs to identify any unauthorized actions or data access.
|
||||
- Reset the credentials of the affected user account to prevent further unauthorized access, ensuring that strong, unique passwords are used.
|
||||
- Scan the system for additional indicators of compromise, such as other unusual processes or modifications to system files, and remove any identified threats.
|
||||
- Restore the system from a known good backup if any critical system files or configurations have been altered.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""
|
||||
[[rule.threat]]
|
||||
framework = "MITRE ATT&CK"
|
||||
[[rule.threat.technique]]
|
||||
|
||||
+36
-38
@@ -2,9 +2,7 @@
|
||||
creation_date = "2023/10/16"
|
||||
integration = ["problemchild", "endpoint", "windows"]
|
||||
maturity = "production"
|
||||
updated_date = "2025/01/15"
|
||||
min_stack_version = "8.14.0"
|
||||
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
|
||||
updated_date = "2025/03/20"
|
||||
|
||||
[rule]
|
||||
author = ["Elastic"]
|
||||
@@ -18,6 +16,41 @@ index = ["endgame-*", "logs-endpoint.events.process-*", "winlogbeat-*"]
|
||||
language = "eql"
|
||||
license = "Elastic License v2"
|
||||
name = "Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score
|
||||
|
||||
The detection leverages a machine learning model, ProblemChild, to identify potentially malicious Windows processes by analyzing patterns and assigning a high probability score to suspicious activities. Adversaries may exploit legitimate processes to evade detection, often using techniques like masquerading. This rule flags high-risk events by focusing on processes with a high malicious probability score or those identified by a blocklist, excluding known benign activities.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the process details flagged by the ProblemChild model, focusing on those with a prediction probability greater than 0.98 or identified by the blocklist.
|
||||
- Examine the command-line arguments of the suspicious process to identify any unusual or unexpected patterns, excluding those matching known benign patterns like "*C:\\\\WINDOWS\\\\temp\\\\nessus_*.txt*" or "*C:\\\\WINDOWS\\\\temp\\\\nessus_*.tmp*".
|
||||
- Check the parent process of the flagged event to determine if it is a legitimate process or if it has been potentially compromised.
|
||||
- Investigate the user account associated with the process to assess if it has been involved in any other suspicious activities or if it has elevated privileges that could be exploited.
|
||||
- Correlate the event with other security alerts or logs to identify any related activities or patterns that could indicate a broader attack campaign.
|
||||
- Consult threat intelligence sources to determine if the process or its associated indicators are linked to known malicious activities or threat actors.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Nessus scan files in the Windows temp directory may trigger false positives due to their temporary nature and frequent legitimate use. Users can mitigate this by adding exceptions for file paths like C:\\WINDOWS\\temp\\nessus_*.txt and C:\\WINDOWS\\temp\\nessus_*.tmp.
|
||||
- Legitimate software updates or installations might be flagged if they mimic known malicious patterns. Users should review the process details and whitelist trusted software update processes.
|
||||
- System administration tools that perform actions similar to those used in attacks could be misidentified. Users should verify the legitimacy of these tools and exclude them from the rule if they are part of regular administrative tasks.
|
||||
- Custom scripts or automation tools that are not widely recognized might be flagged. Users should ensure these scripts are secure and add them to an allowlist if they are part of routine operations.
|
||||
- Frequent false positives from specific processes can be managed by adjusting the threshold of the machine learning model or refining the blocklist to better distinguish between benign and malicious activities.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected system from the network to prevent further spread of potential malicious activity.
|
||||
- Terminate the suspicious process identified by the ProblemChild model to halt any ongoing malicious actions.
|
||||
- Conduct a thorough scan of the affected system using updated antivirus and anti-malware tools to identify and remove any additional threats.
|
||||
- Review and analyze the process execution history and associated files to understand the scope of the compromise and identify any persistence mechanisms.
|
||||
- Restore any altered or deleted files from backups, ensuring that the backup is clean and free from malware.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
|
||||
- Implement enhanced monitoring and logging for similar processes and activities to detect and respond to future attempts at masquerading or defense evasion."""
|
||||
references = [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
|
||||
"https://docs.elastic.co/en/integrations/problemchild",
|
||||
@@ -63,41 +96,6 @@ query = '''
|
||||
process where ((problemchild.prediction == 1 and problemchild.prediction_probability > 0.98) or
|
||||
blocklist_label == 1) and not process.args : ("*C:\\WINDOWS\\temp\\nessus_*.txt*", "*C:\\WINDOWS\\temp\\nessus_*.tmp*")
|
||||
'''
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score
|
||||
|
||||
The detection leverages a machine learning model, ProblemChild, to identify potentially malicious Windows processes by analyzing patterns and assigning a high probability score to suspicious activities. Adversaries may exploit legitimate processes to evade detection, often using techniques like masquerading. This rule flags high-risk events by focusing on processes with a high malicious probability score or those identified by a blocklist, excluding known benign activities.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the process details flagged by the ProblemChild model, focusing on those with a prediction probability greater than 0.98 or identified by the blocklist.
|
||||
- Examine the command-line arguments of the suspicious process to identify any unusual or unexpected patterns, excluding those matching known benign patterns like "*C:\\\\WINDOWS\\\\temp\\\\nessus_*.txt*" or "*C:\\\\WINDOWS\\\\temp\\\\nessus_*.tmp*".
|
||||
- Check the parent process of the flagged event to determine if it is a legitimate process or if it has been potentially compromised.
|
||||
- Investigate the user account associated with the process to assess if it has been involved in any other suspicious activities or if it has elevated privileges that could be exploited.
|
||||
- Correlate the event with other security alerts or logs to identify any related activities or patterns that could indicate a broader attack campaign.
|
||||
- Consult threat intelligence sources to determine if the process or its associated indicators are linked to known malicious activities or threat actors.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Nessus scan files in the Windows temp directory may trigger false positives due to their temporary nature and frequent legitimate use. Users can mitigate this by adding exceptions for file paths like C:\\WINDOWS\\temp\\nessus_*.txt and C:\\WINDOWS\\temp\\nessus_*.tmp.
|
||||
- Legitimate software updates or installations might be flagged if they mimic known malicious patterns. Users should review the process details and whitelist trusted software update processes.
|
||||
- System administration tools that perform actions similar to those used in attacks could be misidentified. Users should verify the legitimacy of these tools and exclude them from the rule if they are part of regular administrative tasks.
|
||||
- Custom scripts or automation tools that are not widely recognized might be flagged. Users should ensure these scripts are secure and add them to an allowlist if they are part of routine operations.
|
||||
- Frequent false positives from specific processes can be managed by adjusting the threshold of the machine learning model or refining the blocklist to better distinguish between benign and malicious activities.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected system from the network to prevent further spread of potential malicious activity.
|
||||
- Terminate the suspicious process identified by the ProblemChild model to halt any ongoing malicious actions.
|
||||
- Conduct a thorough scan of the affected system using updated antivirus and anti-malware tools to identify and remove any additional threats.
|
||||
- Review and analyze the process execution history and associated files to understand the scope of the compromise and identify any persistence mechanisms.
|
||||
- Restore any altered or deleted files from backups, ensuring that the backup is clean and free from malware.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
|
||||
- Implement enhanced monitoring and logging for similar processes and activities to detect and respond to future attempts at masquerading or defense evasion."""
|
||||
|
||||
|
||||
[[rule.threat]]
|
||||
|
||||
+41
-43
@@ -2,26 +2,59 @@
|
||||
creation_date = "2023/10/16"
|
||||
integration = ["problemchild", "endpoint", "windows"]
|
||||
maturity = "production"
|
||||
updated_date = "2025/03/19"
|
||||
min_stack_version = "8.14.0"
|
||||
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
|
||||
updated_date = "2025/03/20"
|
||||
|
||||
[rule]
|
||||
anomaly_threshold = 75
|
||||
author = ["Elastic"]
|
||||
description = """
|
||||
A machine learning job combination has identified a host with one or more suspicious Windows processes that exhibit
|
||||
unusually high malicious probability scores.These process(es) have been classified as malicious in several ways. The process(es)
|
||||
were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious
|
||||
processes, each process has the same host name, and the aggregate score of the event cluster was calculated to be
|
||||
unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly
|
||||
involving LOLbins, that may be resistant to detection using conventional search rules.
|
||||
unusually high malicious probability scores.These process(es) have been classified as malicious in several ways. The
|
||||
process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of
|
||||
suspicious processes, each process has the same host name, and the aggregate score of the event cluster was calculated
|
||||
to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity,
|
||||
possibly involving LOLbins, that may be resistant to detection using conventional search rules.
|
||||
"""
|
||||
from = "now-45m"
|
||||
interval = "15m"
|
||||
license = "Elastic License v2"
|
||||
machine_learning_job_id = "problem_child_high_sum_by_host"
|
||||
name = "Host Detected with Suspicious Windows Process(es)"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Host Detected with Suspicious Windows Process(es)
|
||||
|
||||
The detection leverages machine learning to identify clusters of Windows processes with high malicious probability scores. Adversaries exploit legitimate tools, known as LOLbins, to evade detection. This rule uses both supervised and unsupervised ML models to flag unusual process clusters on a single host, indicating potential masquerading tactics for defense evasion.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the host name associated with the suspicious process cluster to determine if it is a critical asset or has a history of similar alerts.
|
||||
- Examine the specific processes flagged by the ProblemChild supervised ML model to identify any known LOLbins or unusual command-line arguments that may indicate masquerading.
|
||||
- Check the timeline of the process execution to see if it coincides with any known scheduled tasks or user activity that could explain the anomaly.
|
||||
- Investigate the parent-child relationship of the processes to identify any unexpected or unauthorized process spawning patterns.
|
||||
- Correlate the alert with other security events or logs from the same host to identify any additional indicators of compromise or related suspicious activity.
|
||||
- Assess the network activity associated with the host during the time of the alert to detect any potential data exfiltration or communication with known malicious IP addresses.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Legitimate administrative tools like PowerShell or Windows Management Instrumentation (WMI) may be flagged as suspicious due to their dual-use nature. Users can create exceptions for these tools when used by trusted administrators or during scheduled maintenance.
|
||||
- Automated scripts or scheduled tasks that perform routine system checks or updates might trigger alerts. Review these processes and whitelist them if they are verified as part of regular operations.
|
||||
- Software updates or installations that involve multiple processes spawning in a short time frame can be mistaken for malicious clusters. Ensure that these activities are documented and create exceptions for known update processes.
|
||||
- Development or testing environments where new or experimental software is frequently executed may generate false positives. Consider excluding these environments from monitoring or adjusting the sensitivity of the rule for these specific hosts.
|
||||
- Frequent use of remote desktop or remote management tools by IT staff can appear suspicious. Implement user-based exceptions for known IT personnel to reduce unnecessary alerts.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected host immediately to prevent further spread of potential malicious activity. Disconnect it from the network to contain the threat.
|
||||
- Terminate the suspicious processes identified by the alert. Use task management tools or scripts to ensure all instances of the processes are stopped.
|
||||
- Conduct a thorough review of the host's system logs and process history to identify any additional indicators of compromise or related malicious activity.
|
||||
- Restore the host from a known good backup if available, ensuring that the backup is free from any signs of compromise.
|
||||
- Update and patch the host's operating system and all installed software to close any vulnerabilities that may have been exploited.
|
||||
- Implement application whitelisting to prevent unauthorized or suspicious processes from executing in the future.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional hosts are affected."""
|
||||
references = [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
|
||||
"https://docs.elastic.co/en/integrations/problemchild",
|
||||
@@ -58,41 +91,6 @@ tags = [
|
||||
"Resources: Investigation Guide",
|
||||
]
|
||||
type = "machine_learning"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Host Detected with Suspicious Windows Process(es)
|
||||
|
||||
The detection leverages machine learning to identify clusters of Windows processes with high malicious probability scores. Adversaries exploit legitimate tools, known as LOLbins, to evade detection. This rule uses both supervised and unsupervised ML models to flag unusual process clusters on a single host, indicating potential masquerading tactics for defense evasion.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the host name associated with the suspicious process cluster to determine if it is a critical asset or has a history of similar alerts.
|
||||
- Examine the specific processes flagged by the ProblemChild supervised ML model to identify any known LOLbins or unusual command-line arguments that may indicate masquerading.
|
||||
- Check the timeline of the process execution to see if it coincides with any known scheduled tasks or user activity that could explain the anomaly.
|
||||
- Investigate the parent-child relationship of the processes to identify any unexpected or unauthorized process spawning patterns.
|
||||
- Correlate the alert with other security events or logs from the same host to identify any additional indicators of compromise or related suspicious activity.
|
||||
- Assess the network activity associated with the host during the time of the alert to detect any potential data exfiltration or communication with known malicious IP addresses.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Legitimate administrative tools like PowerShell or Windows Management Instrumentation (WMI) may be flagged as suspicious due to their dual-use nature. Users can create exceptions for these tools when used by trusted administrators or during scheduled maintenance.
|
||||
- Automated scripts or scheduled tasks that perform routine system checks or updates might trigger alerts. Review these processes and whitelist them if they are verified as part of regular operations.
|
||||
- Software updates or installations that involve multiple processes spawning in a short time frame can be mistaken for malicious clusters. Ensure that these activities are documented and create exceptions for known update processes.
|
||||
- Development or testing environments where new or experimental software is frequently executed may generate false positives. Consider excluding these environments from monitoring or adjusting the sensitivity of the rule for these specific hosts.
|
||||
- Frequent use of remote desktop or remote management tools by IT staff can appear suspicious. Implement user-based exceptions for known IT personnel to reduce unnecessary alerts.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected host immediately to prevent further spread of potential malicious activity. Disconnect it from the network to contain the threat.
|
||||
- Terminate the suspicious processes identified by the alert. Use task management tools or scripts to ensure all instances of the processes are stopped.
|
||||
- Conduct a thorough review of the host's system logs and process history to identify any additional indicators of compromise or related malicious activity.
|
||||
- Restore the host from a known good backup if available, ensuring that the backup is free from any signs of compromise.
|
||||
- Update and patch the host's operating system and all installed software to close any vulnerabilities that may have been exploited.
|
||||
- Implement application whitelisting to prevent unauthorized or suspicious processes from executing in the future.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional hosts are affected."""
|
||||
[[rule.threat]]
|
||||
framework = "MITRE ATT&CK"
|
||||
[[rule.threat.technique]]
|
||||
|
||||
+42
-44
@@ -2,26 +2,59 @@
|
||||
creation_date = "2023/10/16"
|
||||
integration = ["problemchild", "endpoint", "windows"]
|
||||
maturity = "production"
|
||||
updated_date = "2025/03/19"
|
||||
min_stack_version = "8.14.0"
|
||||
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
|
||||
updated_date = "2025/03/20"
|
||||
|
||||
[rule]
|
||||
anomaly_threshold = 75
|
||||
author = ["Elastic"]
|
||||
description = """
|
||||
A machine learning job combination has identified a parent process with one or more suspicious Windows processes that exhibit
|
||||
unusually high malicious probability scores. These process(es) have been classified as malicious in several ways. The process(es)
|
||||
were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious
|
||||
processes, each process has the same parent process name, and the aggregate score of the event cluster was calculated to
|
||||
be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly
|
||||
involving LOLbins, that may be resistant to detection using conventional search rules.
|
||||
A machine learning job combination has identified a parent process with one or more suspicious Windows processes that
|
||||
exhibit unusually high malicious probability scores. These process(es) have been classified as malicious in several
|
||||
ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a
|
||||
cluster of suspicious processes, each process has the same parent process name, and the aggregate score of the event
|
||||
cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or
|
||||
malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules.
|
||||
"""
|
||||
from = "now-45m"
|
||||
interval = "15m"
|
||||
license = "Elastic License v2"
|
||||
machine_learning_job_id = "problem_child_high_sum_by_parent"
|
||||
name = "Parent Process Detected with Suspicious Windows Process(es)"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Parent Process Detected with Suspicious Windows Process(es)
|
||||
|
||||
In Windows environments, processes are often spawned by parent processes, forming a hierarchy. Adversaries exploit this by using legitimate processes to launch malicious ones, often leveraging Living off the Land Binaries (LOLBins) to evade detection. The detection rule employs machine learning to identify clusters of processes with high malicious probability, focusing on those sharing a common parent process. This approach helps uncover stealthy attacks that traditional methods might miss, enhancing defense against tactics like masquerading.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the parent process name associated with the suspicious process cluster to identify if it is a known legitimate process or a potential masquerading attempt.
|
||||
- Examine the command line arguments and execution context of the suspicious processes to identify any use of LOLBins or unusual patterns that could indicate malicious activity.
|
||||
- Check the process creation timestamps and correlate them with any known events or user activities to determine if the process execution aligns with expected behavior.
|
||||
- Investigate the network activity of the suspicious processes to identify any unusual outbound connections or data exfiltration attempts.
|
||||
- Analyze the user account context under which the suspicious processes were executed to determine if there is any indication of compromised credentials or privilege escalation.
|
||||
- Cross-reference the detected processes with threat intelligence sources to identify any known indicators of compromise or related threat actor activity.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Legitimate administrative tools may trigger false positives if they frequently spawn processes that resemble malicious activity. Users can create exceptions for known safe tools by whitelisting their parent process names.
|
||||
- Software updates or installations often generate clusters of processes that might be flagged as suspicious. Users should monitor these activities and exclude them if they are verified as legitimate.
|
||||
- Automated scripts or batch jobs that run regularly and spawn multiple processes can be mistaken for malicious clusters. Identifying these scripts and excluding their parent processes can reduce false positives.
|
||||
- Security software or monitoring tools that perform regular scans or updates might mimic malicious behavior. Users should ensure these tools are recognized and excluded from the rule's scope.
|
||||
- Custom business applications that are not widely recognized might be flagged. Users should document and exclude these applications if they are confirmed to be safe and necessary for operations.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any ongoing malicious activity.
|
||||
- Terminate the suspicious processes identified by the alert to stop any malicious actions they may be performing.
|
||||
- Conduct a thorough review of the parent process and its associated binaries to ensure they have not been tampered with or replaced by malicious versions.
|
||||
- Restore any affected files or system components from a known good backup to ensure system integrity and functionality.
|
||||
- Update and patch the system to close any vulnerabilities that may have been exploited by the adversary, focusing on those related to LOLBins and masquerading techniques.
|
||||
- Monitor the system and network for any signs of re-infection or related suspicious activity, using enhanced logging and alerting mechanisms.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""
|
||||
references = [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
|
||||
"https://docs.elastic.co/en/integrations/problemchild",
|
||||
@@ -60,41 +93,6 @@ tags = [
|
||||
"Resources: Investigation Guide",
|
||||
]
|
||||
type = "machine_learning"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating Parent Process Detected with Suspicious Windows Process(es)
|
||||
|
||||
In Windows environments, processes are often spawned by parent processes, forming a hierarchy. Adversaries exploit this by using legitimate processes to launch malicious ones, often leveraging Living off the Land Binaries (LOLBins) to evade detection. The detection rule employs machine learning to identify clusters of processes with high malicious probability, focusing on those sharing a common parent process. This approach helps uncover stealthy attacks that traditional methods might miss, enhancing defense against tactics like masquerading.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the parent process name associated with the suspicious process cluster to identify if it is a known legitimate process or a potential masquerading attempt.
|
||||
- Examine the command line arguments and execution context of the suspicious processes to identify any use of LOLBins or unusual patterns that could indicate malicious activity.
|
||||
- Check the process creation timestamps and correlate them with any known events or user activities to determine if the process execution aligns with expected behavior.
|
||||
- Investigate the network activity of the suspicious processes to identify any unusual outbound connections or data exfiltration attempts.
|
||||
- Analyze the user account context under which the suspicious processes were executed to determine if there is any indication of compromised credentials or privilege escalation.
|
||||
- Cross-reference the detected processes with threat intelligence sources to identify any known indicators of compromise or related threat actor activity.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Legitimate administrative tools may trigger false positives if they frequently spawn processes that resemble malicious activity. Users can create exceptions for known safe tools by whitelisting their parent process names.
|
||||
- Software updates or installations often generate clusters of processes that might be flagged as suspicious. Users should monitor these activities and exclude them if they are verified as legitimate.
|
||||
- Automated scripts or batch jobs that run regularly and spawn multiple processes can be mistaken for malicious clusters. Identifying these scripts and excluding their parent processes can reduce false positives.
|
||||
- Security software or monitoring tools that perform regular scans or updates might mimic malicious behavior. Users should ensure these tools are recognized and excluded from the rule's scope.
|
||||
- Custom business applications that are not widely recognized might be flagged. Users should document and exclude these applications if they are confirmed to be safe and necessary for operations.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any ongoing malicious activity.
|
||||
- Terminate the suspicious processes identified by the alert to stop any malicious actions they may be performing.
|
||||
- Conduct a thorough review of the parent process and its associated binaries to ensure they have not been tampered with or replaced by malicious versions.
|
||||
- Restore any affected files or system components from a known good backup to ensure system integrity and functionality.
|
||||
- Update and patch the system to close any vulnerabilities that may have been exploited by the adversary, focusing on those related to LOLBins and masquerading techniques.
|
||||
- Monitor the system and network for any signs of re-infection or related suspicious activity, using enhanced logging and alerting mechanisms.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected."""
|
||||
[[rule.threat]]
|
||||
framework = "MITRE ATT&CK"
|
||||
[[rule.threat.technique]]
|
||||
|
||||
+41
-43
@@ -2,26 +2,59 @@
|
||||
creation_date = "2023/10/16"
|
||||
integration = ["problemchild", "endpoint", "windows"]
|
||||
maturity = "production"
|
||||
updated_date = "2025/03/19"
|
||||
min_stack_version = "8.14.0"
|
||||
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
|
||||
updated_date = "2025/03/20"
|
||||
|
||||
[rule]
|
||||
anomaly_threshold = 75
|
||||
author = ["Elastic"]
|
||||
description = """
|
||||
A machine learning job combination has identified a user with one or more suspicious Windows processes that exhibit
|
||||
unusually high malicious probability scores. These process(es) have been classified as malicious in several ways. The process(es)
|
||||
were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious
|
||||
processes, each process has the same user name, and the aggregate score of the event cluster was calculated to be
|
||||
unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly
|
||||
involving LOLbins, that may be resistant to detection using conventional search rules.
|
||||
unusually high malicious probability scores. These process(es) have been classified as malicious in several ways. The
|
||||
process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of
|
||||
suspicious processes, each process has the same user name, and the aggregate score of the event cluster was calculated
|
||||
to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity,
|
||||
possibly involving LOLbins, that may be resistant to detection using conventional search rules.
|
||||
"""
|
||||
from = "now-45m"
|
||||
interval = "15m"
|
||||
license = "Elastic License v2"
|
||||
machine_learning_job_id = "problem_child_high_sum_by_user"
|
||||
name = "User Detected with Suspicious Windows Process(es)"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating User Detected with Suspicious Windows Process(es)
|
||||
|
||||
The detection leverages machine learning to identify clusters of Windows processes with high malicious probability, often linked to tactics like masquerading. Adversaries exploit legitimate tools (LOLBins) to evade detection. This rule uses both supervised and unsupervised ML models to flag unusual process clusters, focusing on user-associated anomalies to uncover potential threats.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the list of processes flagged by the alert to identify any known legitimate applications or tools that might have been misclassified.
|
||||
- Investigate the user account associated with the suspicious process cluster to determine if there is any history of unusual activity or if the account has been compromised.
|
||||
- Examine the parent-child relationship of the processes to understand the execution chain and identify any potential masquerading attempts or use of LOLBins.
|
||||
- Check for any recent changes or updates to the system that might explain the unusual process behavior, such as software installations or updates.
|
||||
- Correlate the detected processes with any known indicators of compromise (IOCs) or threat intelligence feeds to assess if they are linked to known malicious activity.
|
||||
- Analyze the network activity associated with the processes to identify any suspicious outbound connections or data exfiltration attempts.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Legitimate administrative tools like PowerShell or Windows Management Instrumentation (WMI) may trigger false positives due to their frequent use in system management. Users can create exceptions for these tools when used by trusted administrators.
|
||||
- Software updates or installations often involve processes that mimic suspicious behavior. Exclude these processes by identifying and whitelisting update-related activities from known software vendors.
|
||||
- Automated scripts or scheduled tasks that perform routine maintenance can be misclassified as malicious. Review and whitelist these tasks if they are part of regular system operations.
|
||||
- Development environments may spawn multiple processes that resemble malicious clusters. Developers should document and exclude these processes when they are part of legitimate development activities.
|
||||
- Security software or monitoring tools might generate process clusters that appear suspicious. Ensure these tools are recognized and excluded from analysis to prevent false alerts.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected system from the network to prevent further spread of potential malicious activity.
|
||||
- Terminate the suspicious processes identified by the alert to halt any ongoing malicious actions.
|
||||
- Conduct a thorough review of the affected user's account for any unauthorized access or changes, and reset credentials if necessary.
|
||||
- Analyze the use of any identified LOLBins to determine if they were used maliciously and restrict their execution through application whitelisting or policy adjustments.
|
||||
- Collect and preserve relevant logs and forensic data from the affected system for further analysis and to aid in understanding the scope of the incident.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for a deeper investigation and to determine if additional systems are compromised.
|
||||
- Implement enhanced monitoring and detection rules to identify similar patterns of behavior in the future, focusing on the specific tactics and techniques used in this incident."""
|
||||
references = [
|
||||
"https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html",
|
||||
"https://docs.elastic.co/en/integrations/problemchild",
|
||||
@@ -60,41 +93,6 @@ tags = [
|
||||
"Resources: Investigation Guide",
|
||||
]
|
||||
type = "machine_learning"
|
||||
note = """## Triage and analysis
|
||||
|
||||
> **Disclaimer**:
|
||||
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
|
||||
|
||||
### Investigating User Detected with Suspicious Windows Process(es)
|
||||
|
||||
The detection leverages machine learning to identify clusters of Windows processes with high malicious probability, often linked to tactics like masquerading. Adversaries exploit legitimate tools (LOLBins) to evade detection. This rule uses both supervised and unsupervised ML models to flag unusual process clusters, focusing on user-associated anomalies to uncover potential threats.
|
||||
|
||||
### Possible investigation steps
|
||||
|
||||
- Review the list of processes flagged by the alert to identify any known legitimate applications or tools that might have been misclassified.
|
||||
- Investigate the user account associated with the suspicious process cluster to determine if there is any history of unusual activity or if the account has been compromised.
|
||||
- Examine the parent-child relationship of the processes to understand the execution chain and identify any potential masquerading attempts or use of LOLBins.
|
||||
- Check for any recent changes or updates to the system that might explain the unusual process behavior, such as software installations or updates.
|
||||
- Correlate the detected processes with any known indicators of compromise (IOCs) or threat intelligence feeds to assess if they are linked to known malicious activity.
|
||||
- Analyze the network activity associated with the processes to identify any suspicious outbound connections or data exfiltration attempts.
|
||||
|
||||
### False positive analysis
|
||||
|
||||
- Legitimate administrative tools like PowerShell or Windows Management Instrumentation (WMI) may trigger false positives due to their frequent use in system management. Users can create exceptions for these tools when used by trusted administrators.
|
||||
- Software updates or installations often involve processes that mimic suspicious behavior. Exclude these processes by identifying and whitelisting update-related activities from known software vendors.
|
||||
- Automated scripts or scheduled tasks that perform routine maintenance can be misclassified as malicious. Review and whitelist these tasks if they are part of regular system operations.
|
||||
- Development environments may spawn multiple processes that resemble malicious clusters. Developers should document and exclude these processes when they are part of legitimate development activities.
|
||||
- Security software or monitoring tools might generate process clusters that appear suspicious. Ensure these tools are recognized and excluded from analysis to prevent false alerts.
|
||||
|
||||
### Response and remediation
|
||||
|
||||
- Isolate the affected system from the network to prevent further spread of potential malicious activity.
|
||||
- Terminate the suspicious processes identified by the alert to halt any ongoing malicious actions.
|
||||
- Conduct a thorough review of the affected user's account for any unauthorized access or changes, and reset credentials if necessary.
|
||||
- Analyze the use of any identified LOLBins to determine if they were used maliciously and restrict their execution through application whitelisting or policy adjustments.
|
||||
- Collect and preserve relevant logs and forensic data from the affected system for further analysis and to aid in understanding the scope of the incident.
|
||||
- Escalate the incident to the security operations center (SOC) or incident response team for a deeper investigation and to determine if additional systems are compromised.
|
||||
- Implement enhanced monitoring and detection rules to identify similar patterns of behavior in the future, focusing on the specific tactics and techniques used in this incident."""
|
||||
[[rule.threat]]
|
||||
framework = "MITRE ATT&CK"
|
||||
[[rule.threat.technique]]
|
||||
|
||||
Reference in New Issue
Block a user