异常进程扩展
编辑异常进程扩展
编辑识别运行具有异常扩展名的进程，这些扩展名通常对 Windows 可执行文件无效。
规则类型: eql
规则索引:
- logs-endpoint.events.process-*
严重性: 低
风险评分: 21
每隔: 60 分钟
搜索索引自: now-119m (日期数学格式，另请参见 额外回溯时间)
每次执行的最大告警数: 100
参考资料: 无
标签:
- 领域：终端
- 操作系统：Windows
- 用例：威胁检测
- 策略：防御规避
- 数据源：Elastic Defend
- 规则类型：BBR
版本: 4
规则作者:
- Elastic
规则许可证: Elastic License v2
规则查询
编辑process where host.os.type == "windows" and event.type == "start" and
process.executable : "?*" and
not process.name : ("*.exe", "*.com", "*.scr", "*.tmp", "*.dat") and
not process.executable :
(
"MemCompression",
"Registry",
"vmmem",
"vmmemWSL",
"?:\\Program Files\\Dell\\SupportAssistAgent\\*.p5x",
"?:\\Program Files\\Docker\\Docker\\com.docker.service",
"?:\\Users\\*\\AppData\\Local\\Intel\\AGS\\Libs\\AGSRunner.bin",
"\\Device\\Mup\\*\\Software Management\\Select.Html.dep",
"?:\\DJJApplications\\MedicalRecords\\bin\\Select.Html.dep",
"?:\\ProgramData\\Software Management\\Select.Html.dep",
"?:\\Program Files (x86)\\EnCase Applications\\Examiner Service\\EnCase64\\enhkey.dll",
"?:\\Program Files (x86)\\Panda Security\\WAC\\PSNAEInj64.dll",
"?:\\Program Files (x86)\\Johnson Controls\\LicenseActivator\\crp32002.ngn"
) and
not (
(process.name : "C9632CF058AE4321B6B0B5EA39B710FE" and process.code_signature.subject_name == "Dell Inc") or
(process.name : "*.upd" and process.code_signature.subject_name == "Bloomberg LP") or
(process.name: "FD552E21-686E-413C-931D-3B82A9D29F3B" and process.code_signature.subject_name: "Adobe Inc.") or
(process.name: "3B91051C-AE82-43C9-BCEF-0309CD2DD9EB" and process.code_signature.subject_name: "McAfee, LLC") or
(process.name: "soffice.bin" and process.code_signature.subject_name: "The Document Foundation") or
(process.name: ("VeeamVixProxy_*", "{????????-????-????-????-????????????}") and process.code_signature.subject_name: "Veeam Software Group GmbH") or
(process.name: "1cv8p64.bin" and process.code_signature.subject_name: "LLC 1C-Soft") or
(process.name: "AGSRunner.bin" and process.code_signature.subject_name: "Intel Corporation")
)
框架: MITRE ATT&CKTM
-
策略
- 名称：防御规避
- ID：TA0005
- 参考网址：https://attack.mitre.org/tactics/TA0005/
-
技术
- 名称：伪装
- ID：T1036
- 参考网址：https://attack.mitre.org/techniques/T1036/
-
子技术
- 名称：伪装文件类型
- ID：T1036.008
- 参考网址：https://attack.mitre.org/techniques/T1036/008/