Suspicious Child Process Of Manage Engine ServiceDesk

Title: Suspicious Child Process Of Manage Engine ServiceDesk
Status: test
Description:Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service
References:
  -https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
  -https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py
  -https://blog.viettelcybersecurity.com/saml-show-stopper/
Author: Florian Roth (Nextron Systems)
Date: 2023-01-18
modified:2023-08-29
Tags:

• -'attack.command-and-control'
• -'attack.t1102'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|contains|all:
      -'\ManageEngine\ServiceDesk\'
      -'\java.exe'

    Image|endswith:
      -'\AppVLP.exe'
      -'\bash.exe'
      -'\bitsadmin.exe'
      -'\calc.exe'
      -'\certutil.exe'
      -'\cscript.exe'
      -'\curl.exe'
      -'\forfiles.exe'
      -'\mftrace.exe'
      -'\mshta.exe'
      -'\net.exe'
      -'\net1.exe'
      -'\notepad.exe'
      -'\powershell.exe'
      -'\pwsh.exe'
      -'\query.exe'
      -'\reg.exe'
      -'\schtasks.exe'
      -'\scrcons.exe'
      -'\sh.exe'
      -'\systeminfo.exe'
      -'\whoami.exe'
      -'\wmic.exe'
      -'\wscript.exe'

  filter_main_net:
    Image|endswith:
      -'\net.exe'
      -'\net1.exe'

    CommandLine|contains: ' stop'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Legitimate sub processes started by Manage Engine ServiceDesk Pro
Level: high