Query: rule covering Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Matching passage: Sigma rule: Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.. Logsource: windows / process_creation. Rule: title: Csc.EXE Execution Form Potentially Suspicious Parent id: b730a276-6b63-41b8-bcf8-55930c8fc6ee status: test description: Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery. references: - https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing - https://reaqta.com/2017/11/short-journey-darkvnc/ - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2019-02-11 modified: 2026-03-23 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1059.007 - attack.t1218.005 - attack.t1027.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \csc.exe - OriginalFileName: csc.exe selection_parent_generic: ParentImage|endswith: - \cscript.exe - \excel.exe - \mshta.exe - \onenote.exe - \outlook.exe - \powerpnt.exe - \winword.exe - \wscript.exe selection_parent_powershell: ParentImage|endswith: - \powershell.exe - \pwsh.exe ParentCommandLine|contains: - '-Encoded ' - FromBase64String selection_parent_susp_location: - ParentCommandLine|re: (?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$ - ParentCommandLine|contains: - :\PerfLogs\ - :\Users\Public\ - :\Windows\Temp\ - \Temporary Internet - ParentCommandLine|contains|all: - :\Users\ - \Favorites\ - ParentCommandLine|contains|all: - :\Users\ - \Favourites\ - ParentCommandLine|contains|all: - :\Users\ - \Contacts\ - ParentCommandLine|contains|all: - :\Users\ - \Pictures\ filter_main_programfiles: ParentImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ filter_main_sdiagnhost: ParentImage: C:\Windows\System32\sdiagnhost.exe filter_main_w3p: ParentImage: C:\Windows\System32\inetsrv\w3wp.exe filter_optional_chocolatey: ParentImage: C:\ProgramData\chocolatey\choco.exe filter_optional_defender: ParentCommandLine|contains: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection filter_optional_ansible: ParentCommandLine|contains: - JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw - cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzAC
Near-miss passage: Sigma rule: A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for b. Logsource: windows / process_creation. Rule: title: Potential UAC Bypass Via Sdclt.EXE id: 40f9af16-589d-4984-b78d-8c2aec023197 status: test description: A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/6 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: sdclt.exe IntegrityLevel: - High - S-1-16-12288 condition: selection falsepositives: - Unknown level: medium