Suspicious Process Parents

Title: Suspicious Process Parents
Status: test
Description:Detects suspicious parent processes that should not have any children or should only have a single possible child program
References:
  -https://twitter.com/x86matthew/status/1505476263464607744?s=12
  -https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b
Author: Florian Roth (Nextron Systems)
Date: 2022-03-21
modified:2022-09-08
Tags:

• -'attack.stealth'
• -'attack.t1036'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith:
      -'\minesweeper.exe'
      -'\winver.exe'
      -'\bitsadmin.exe'

  selection_special:
    ParentImage|endswith:
      -'\csrss.exe'
      -'\certutil.exe'
      -'\eventvwr.exe'
      -'\calc.exe'
      -'\notepad.exe'

  filter_special:
    Image|endswith:
      -'\WerFault.exe'
      -'\wermgr.exe'
      -'\conhost.exe'
      -'\mmc.exe'
      -'\win32calc.exe'
      -'\notepad.exe'

  filter_null:
    Image: 'None'
  condition:selection or ( selection_special and not 1 of filter_* )
Falsepositives:
  -Unknown
Level: high