Potential Command and Control via Internet Explorer

edit

Potential Command and Control via Internet Explorer

edit

Identifies instances of Internet Explorer (iexplore.exe) being started via the Component Object Model (COM) making unusual network connections. Adversaries could abuse Internet Explorer via COM to avoid suspicious processes making network connections and bypass host-based firewall restrictions.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-endpoint.events.*
  • logs-windows.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Command and Control

Version: 6 (version history)

Added (Elastic Stack release): 7.11.0

Last modified (Elastic Stack release): 8.4.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positives

edit

Processes such as MS Office using IEproxy to render HTML content.

Rule query

edit
sequence by host.id, user.name with maxspan = 5s [library where
dll.name : "IEProxy.dll" and process.name : ("rundll32.exe",
"regsvr32.exe")] [process where event.type == "start" and
process.parent.name : "iexplore.exe" and process.parent.args :
"-Embedding"] /* IE started via COM in normal conditions makes few
connections, mainly to Microsoft and OCSP related domains, add FPs
here */ [network where network.protocol == "dns" and process.name :
"iexplore.exe" and not dns.question.name : (
"*.microsoft.com", "*.digicert.com", "*.msocsp.com",
"*.windowsupdate.com", "*.bing.com", "*.identrust.com",
"*.sharepoint.com", "*.office365.com", "*.office.com" )
] /* with runs=5 */

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 6 (8.4.0 release)
  • Formatting only
Version 5 (8.1.0 release)
  • Updated query, changed from:

    sequence by host.id, user.id with maxspan = 5s [library where
    dll.name : "IEProxy.dll" and process.name : ("rundll32.exe",
    "regsvr32.exe")] [process where event.type == "start" and
    process.parent.name : "iexplore.exe" and process.parent.args :
    "-Embedding"] /* IE started via COM in normal conditions makes few
    connections, mainly to Microsoft and OCSP related domains, add FPs
    here */ [network where network.protocol == "dns" and process.name :
    "iexplore.exe" and not dns.question.name : (
    "*.microsoft.com", "*.digicert.com", "*.msocsp.com",
    "*.windowsupdate.com", "*.bing.com", "*.identrust.com",
    "*.sharepoint.com", "*.office365.com", "*.office.com" )
    ]
Version 4 (7.16.0 release)
  • Formatting only
Version 3 (7.13.0 release)
  • Updated query, changed from:

    sequence by host.id, process.entity_id with maxspan = 1s [process
    where event.type == "start" and process.parent.name : "iexplore.exe"
    and process.parent.args : "-Embedding"] /* IE started via COM in
    normal conditions makes few connections, mainly to Microsoft and OCSP
    related domains, add FPs here */ [network where network.protocol ==
    "dns" and process.name : "iexplore.exe" and not dns.question.name :
    ( "*.microsoft.com", "*.digicert.com", "*.msocsp.com",
    "*.windowsupdate.com", "*.bing.com", "*.identrust.com" )
    ]
Version 2 (7.12.0 release)
  • Updated query, changed from:

    sequence by host.id, process.entity_id with maxspan = 1s [process
    where event.type:"start" and process.parent.name:"iexplore.exe" and
    process.parent.args:"-Embedding"] /* IE started via COM in normal
    conditions makes few connections, mainly to Microsoft and OCSP related
    domains, add FPs here */ [network where network.protocol : "dns" and
    process.name:"iexplore.exe" and not wildcard(dns.question.name,
    "*.microsoft.com",
    "*.digicert.com", "*.msocsp.com",
    "*.windowsupdate.com",
    "*.bing.com", "*.identrust.com")
    ]