Detection rules › Elastic

Suspicious Process Creation CallTrace

Author
Elastic
Source
upstream

Identifies when a process is created and immediately accessed from an unknown memory code region and by the same parent process. This may indicate a code injection attempt.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1055 Process Injection, T1055.012 Process Injection: Process Hollowing
Defense EvasionT1055 Process Injection, T1055.012 Process Injection: Process Hollowing

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon10ProcessAccess

Stages and Predicates

Stage 1: eql:process

not (process.args:(12288 or 8192) and process.executable:"?:\\Windows\\splwow64.exe" and process.parent.name:"winword.exe") and not (process.executable:"?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe" and process.parent.name:"winword.exe") and not (process.executable:"?:\\Program Files\\Microsoft Office\\root\\Office*\\ADDINS\\*.exe" and process.parent.name:"EXCEL.EXE") and not (process.parent.args:"?:\\Program Files\\*" and process.parent.name:"regsvr32.exe") and not (process.parent.args:"?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc" and process.parent.name:"rundll32.exe") and process.parent.name:"winword.exe"

Stage 2: eql:process

winlog.event_data.CallTrace:"UNKNOWN"

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

StageFieldKindExcluded values
1Imageeq?:\Windows\splwow64.exe
2parent_process_nameeqwinword.exe, excel.exe, outlook.exe, powerpnt.exe
3process.argsin12288, 8192
4Imagewildcard?:\Program Files (x86)\Microsoft\EdgeWebView\Application\*\msedgewebview2.exe, ?:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe, ?:\Windows\SysWOW64\DWWIN.EXE
5parent_process_nameeqwinword.exe, excel.exe, outlook.exe, powerpnt.exe
6Imagewildcard?:\Program Files\Microsoft Office\root\Office*\ADDINS\*.exe
7parent_process_nameeqEXCEL.EXE
8parent_process_nameeqregsvr32.exe
9process.parent.argsstarts_with?:\Program Files\, ?:\Program Files (x86)\
10parent_process_nameeqrundll32.exe
11process.parent.argswildcard?:\WINDOWS\Installer\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc, --no-sandbox

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
process.parent.namewildcard
  • cmstp.exe
  • cscript.exe
  • eqnedt32.exe
  • excel.exe
  • fltldr.exe
  • msaccess.exe
  • mshta.exe
  • mspub.exe
  • msxsl.exe
  • outlook.exe
  • powerpnt.exe
  • regsvr32.exe
  • rundll32.exe
  • winword.exe
  • wmic.exe
  • wscript.exe
winlog.event_data.CallTracewildcard
  • *UNKNOWN* corpus 2 (elastic 2)