Execution via stordiag.exe

Title: Execution via stordiag.exe
Status: test
Description:Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe
References:
  -https://strontic.github.io/xcyclopedia/library/stordiag.exe-1F08FC87C373673944F6A7E8B18CD845.html
  -https://twitter.com/eral4m/status/1451112385041911809
Author: Austin Songer (@austinsonger)
Date: 2021-10-21
modified:2022-12-25
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\stordiag.exe'
    Image|endswith:
      -'\schtasks.exe'
      -'\systeminfo.exe'
      -'\fltmc.exe'

  filter:
    ParentImage|startswith:
      -'c:\windows\system32\'
      -'c:\windows\syswow64\'

  condition:selection and not filter
Falsepositives:
  -Legitimate usage of stordiag.exe.
Level: high