Name:Windows Process Injection into Commonly Abused Processes id:1e1dedc6-f6f3-41a0-9dd7-a1245904fe75 version:9 date:None author:0xC0FFEEEE, Github Community status:production type:Anomaly Description:The following analytic detects potential process injection attempts into executables that are commonly abused leveraging Sysmon EventCode 10.
It identifies Access Mask requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files.
This activity was associated with the SliverC2 framework by BishopFox.
Monitoring this activity may indicate an initial payload attempting to execute malicious code. Data_source:
how_to_implement:To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives:False positives may be present based on SourceImage paths, particularly those with a legitimate reason for accessing lsass.exe or regsvr32.exe. If removing the paths is important, realize svchost and many native binaries inject into processes consistently. Restrict or tune as needed. References: -https://dominicbreuker.com/post/learning_sliver_c2_08_implant_basics/ -https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors -https://redcanary.com/threat-detection-report/techniques/process-injection/ drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['BishopFox Sliver Adversary Emulation Framework', 'Earth Alux', 'SAP NetWeaver Exploitation', 'APT37 Rustonotto and FadeStealer']
