IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Unusual Parent-Child Relationship
editUnusual Parent-Child Relationship
editIdentifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system.
Rule type: eql
Rule indices:
- winlogbeat-*
- logs-endpoint.events.*
- logs-windows.*
Severity: medium
Risk score: 47
Runs every: 5m
Searches indices from: now-9m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
References:
Tags:
- Elastic
- Host
- Windows
- Threat Detection
- Privilege Escalation
Version: 11
Rule authors:
- Elastic
Rule license: Elastic License v2
Investigation guide
edit## Config If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
Rule query
editprocess where event.type in ("start", "process_started") and process.parent.name != null and ( /* suspicious parent processes */ (process.name:"autochk.exe" and not process.parent.name:"smss.exe") or (process.name:("fontdrvhost.exe", "dwm.exe") and not process.parent.name:("wininit.exe", "winlogon.exe")) or (process.name:("consent.exe", "RuntimeBroker.exe", "TiWorker.exe") and not process.parent.name:"svchost.exe") or (process.name:"SearchIndexer.exe" and not process.parent.name:"services.exe") or (process.name:"SearchProtocolHost.exe" and not process.parent.name:("SearchIndexer.exe", "dllhost.exe")) or (process.name:"dllhost.exe" and not process.parent.name:("services.exe", "svchost.exe")) or (process.name:"smss.exe" and not process.parent.name:("System", "smss.exe")) or (process.name:"csrss.exe" and not process.parent.name:("smss.exe", "svchost.exe")) or (process.name:"wininit.exe" and not process.parent.name:"smss.exe") or (process.name:"winlogon.exe" and not process.parent.name:"smss.exe") or (process.name:("lsass.exe", "LsaIso.exe") and not process.parent.name:"wininit.exe") or (process.name:"LogonUI.exe" and not process.parent.name:("wininit.exe", "winlogon.exe")) or (process.name:"services.exe" and not process.parent.name:"wininit.exe") or (process.name:"svchost.exe" and not process.parent.name:("MsMpEng.exe", "services.exe")) or (process.name:"spoolsv.exe" and not process.parent.name:"services.exe") or (process.name:"taskhost.exe" and not process.parent.name:("services.exe", "svchost.exe")) or (process.name:"taskhostw.exe" and not process.parent.name:("services.exe", "svchost.exe")) or (process.name:"userinit.exe" and not process.parent.name:("dwm.exe", "winlogon.exe")) or (process.name:("wmiprvse.exe", "wsmprovhost.exe", "winrshost.exe") and not process.parent.name:"svchost.exe") or /* suspicious child processes */ (process.parent.name:("SearchProtocolHost.exe", "taskhost.exe", "csrss.exe") and not process.name:("werfault.exe", "wermgr.exe", "WerFaultSecure.exe")) or (process.parent.name:"autochk.exe" and not process.name:("chkdsk.exe", "doskey.exe", "WerFault.exe")) or (process.parent.name:"smss.exe" and not process.name:("autochk.exe", "smss.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "setupcl.exe", "WerFault.exe")) or (process.parent.name:"wermgr.exe" and not process.name:("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe")) or (process.parent.name:"conhost.exe" and not process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe", "WerFaultSecure.exe")) )
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Privilege Escalation
- ID: TA0004
- Reference URL: https://attack.mitre.org/tactics/TA0004/
-
Technique:
- Name: Process Injection
- ID: T1055
- Reference URL: https://attack.mitre.org/techniques/T1055/
-
Sub-technique:
- Name: Process Hollowing
- ID: T1055.012
- Reference URL: https://attack.mitre.org/techniques/T1055/012/