The SIEM app is now a part of the Elastic Security solution.
Click
here to view SIEM documentation for previous releases.
Unusual Parent-Child Relationship
editUnusual Parent-Child Relationship
editIdentifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system.
Rule type: query
Rule indices:
- winlogbeat-*
- logs-endpoint.events.*
Severity: medium
Risk score: 47
Runs every: 5 minutes
Searches indices from: now-9m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
Tags:
- Elastic
- Windows
Version: 4 (version history)
Added (Elastic Stack release): 7.6.0
Last modified (Elastic Stack release): 7.9.1
Rule authors: Elastic
Rule license: Elastic License
Rule query
editevent.category:process and event.type:(start or process_started) and process.parent.executable:* and (process.name:smss.exe and not process.parent.name:(System or smss.exe) or process.name:csrss.exe and not process.parent.name:(smss.exe or svchost.exe) or process.name:wininit.exe and not process.parent.name:smss.exe or process.name:winlogon.exe and not process.parent.name:smss.exe or process.name:lsass.exe and not process.parent.name:wininit.exe or process.name:LogonUI.exe and not process.parent.name:(wininit.exe or winlogon.exe) or process.name:services.exe and not process.parent.name:wininit.exe or process.name:svchost.exe and not process.parent.name:(MsMpEng.exe or services.exe) or process.name:spoolsv.exe and not process.parent.name:services.exe or process.name:taskhost.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:taskhostw.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:userinit.exe and not process.parent.name:(dwm.exe or winlogon.exe))
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Privilege Escalation
- ID: TA0004
- Reference URL: https://attack.mitre.org/tactics/TA0004/
-
Technique:
- Name: Process Hollowing
- ID: T1093
- Reference URL: https://attack.mitre.org/techniques/T1093/
Rule version history
edit- Version 4 (7.9.1 release)
-
- Formatting only
- Version 3 (7.9.0 release)
-
-
Updated query, changed from:
event.action:"Process Create (rule: ProcessCreate)" and process.parent.executable:* and (process.name:smss.exe and not process.parent.name:(System or smss.exe) or process.name:csrss.exe and not process.parent.name:(smss.exe or svchost.exe) or process.name:wininit.exe and not process.parent.name:smss.exe or process.name:winlogon.exe and not process.parent.name:smss.exe or process.name:lsass.exe and not process.parent.name:wininit.exe or process.name:LogonUI.exe and not process.parent.name:(wininit.exe or winlogon.exe) or process.name:services.exe and not process.parent.name:wininit.exe or process.name:svchost.exe and not process.parent.name:(MsMpEng.exe or services.exe) or process.name:spoolsv.exe and not process.parent.name:services.exe or process.name:taskhost.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:taskhostw.exe and not process.parent.name:(services.exe or svchost.exe) or process.name:userinit.exe and not process.parent.name:(dwm.exe or winlogon.exe))
-
- Version 2 (7.7.0 release)
-
-
Updated query, changed from:
event.action:"Process Create (rule: ProcessCreate)" and process.parent.executable:* and ( (process.name:"smss.exe" and not process.parent.name:("System" or "smss.exe")) or (process.name:"csrss.exe" and not process.parent.name:("smss.exe" or "svchost.exe")) or (process.name:"wininit.exe" and not process.parent.name:"smss.exe") or (process.name:"winlogon.exe" and not process.parent.name:"smss.exe") or (process.name:"lsass.exe" and not process.parent.name:"wininit.exe") or (process.name:"LogonUI.exe" and not process.parent.name:("winlogon.exe" or "wininit.exe")) or (process.name:"services.exe" and not process.parent.name:"wininit.exe") or (process.name:"svchost.exe" and not process.parent.name:("services.exe" or "MsMpEng.exe")) or (process.name:"spoolsv.exe" and not process.parent.name:"services.exe") or (process.name:"taskhost.exe" and not process.parent.name:("services.exe" or "svchost.exe")) or (process.name:"taskhostw.exe" and not process.parent.name:("services.exe" or "svchost.exe")) or (process.name:"userinit.exe" and not process.parent.name:("dwm.exe" or "winlogon.exe")) )
-