Potential Command and Control via Internet Explorer
editPotential Command and Control via Internet Explorer
editIdentifies instances of Internet Explorer (iexplore.exe) being started via the Component Object Model (COM) making unusual network connections. Adversaries could abuse Internet Explorer via COM to avoid suspicious processes making network connections and bypass host-based firewall restrictions.
Rule type: eql
Rule indices:
- winlogbeat-*
- logs-endpoint.events.*
- logs-windows.*
Severity: medium
Risk score: 47
Runs every: 5 minutes
Searches indices from: now-9m (Date Math format, see also Additional look-back time
)
Maximum alerts per execution: 100
Tags:
- Elastic
- Host
- Windows
- Threat Detection
- Command and Control
Version: 100 (version history)
Added (Elastic Stack release): 7.11.0
Last modified (Elastic Stack release): 8.5.0
Rule authors: Elastic
Rule license: Elastic License v2
Potential false positives
editProcesses such as MS Office using IEproxy to render HTML content.
Rule query
editsequence by host.id, user.name with maxspan = 5s [library where dll.name : "IEProxy.dll" and process.name : ("rundll32.exe", "regsvr32.exe")] [process where event.type == "start" and process.parent.name : "iexplore.exe" and process.parent.args : "-Embedding"] /* IE started via COM in normal conditions makes few connections, mainly to Microsoft and OCSP related domains, add FPs here */ [network where network.protocol == "dns" and process.name : "iexplore.exe" and not dns.question.name : ( "*.microsoft.com", "*.digicert.com", "*.msocsp.com", "*.windowsupdate.com", "*.bing.com", "*.identrust.com", "*.sharepoint.com", "*.office365.com", "*.office.com" ) ] /* with runs=5 */
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Command and Control
- ID: TA0011
- Reference URL: https://attack.mitre.org/tactics/TA0011/
-
Technique:
- Name: Application Layer Protocol
- ID: T1071
- Reference URL: https://attack.mitre.org/techniques/T1071/
-
Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
-
Technique:
- Name: Inter-Process Communication
- ID: T1559
- Reference URL: https://attack.mitre.org/techniques/T1559/
Rule version history
edit- Version 100 (8.5.0 release)
-
- Formatting only
- Version 6 (8.4.0 release)
-
- Formatting only
- Version 5 (8.1.0 release)
-
-
Updated query, changed from:
sequence by host.id, user.id with maxspan = 5s [library where dll.name : "IEProxy.dll" and process.name : ("rundll32.exe", "regsvr32.exe")] [process where event.type == "start" and process.parent.name : "iexplore.exe" and process.parent.args : "-Embedding"] /* IE started via COM in normal conditions makes few connections, mainly to Microsoft and OCSP related domains, add FPs here */ [network where network.protocol == "dns" and process.name : "iexplore.exe" and not dns.question.name : ( "*.microsoft.com", "*.digicert.com", "*.msocsp.com", "*.windowsupdate.com", "*.bing.com", "*.identrust.com", "*.sharepoint.com", "*.office365.com", "*.office.com" ) ]
-
- Version 4 (7.16.0 release)
-
- Formatting only
- Version 3 (7.13.0 release)
-
-
Updated query, changed from:
sequence by host.id, process.entity_id with maxspan = 1s [process where event.type == "start" and process.parent.name : "iexplore.exe" and process.parent.args : "-Embedding"] /* IE started via COM in normal conditions makes few connections, mainly to Microsoft and OCSP related domains, add FPs here */ [network where network.protocol == "dns" and process.name : "iexplore.exe" and not dns.question.name : ( "*.microsoft.com", "*.digicert.com", "*.msocsp.com", "*.windowsupdate.com", "*.bing.com", "*.identrust.com" ) ]
-
- Version 2 (7.12.0 release)
-
-
Updated query, changed from:
sequence by host.id, process.entity_id with maxspan = 1s [process where event.type:"start" and process.parent.name:"iexplore.exe" and process.parent.args:"-Embedding"] /* IE started via COM in normal conditions makes few connections, mainly to Microsoft and OCSP related domains, add FPs here */ [network where network.protocol : "dns" and process.name:"iexplore.exe" and not wildcard(dns.question.name, "*.microsoft.com", "*.digicert.com", "*.msocsp.com", "*.windowsupdate.com", "*.bing.com", "*.identrust.com") ]
-