Query: detection rule: Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Matching passage: Sigma rule: Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.. Logsource: windows / process_creation. Rule: title: Csc.EXE Execution Form Potentially Suspicious Parent id: b730a276-6b63-41b8-bcf8-55930c8fc6ee status: test description: Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery. references: - https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing - https://reaqta.com/2017/11/short-journey-darkvnc/ - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2019-02-11 modified: 2026-03-23 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1059.007 - attack.t1218.005 - attack.t1027.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \csc.exe - OriginalFileName: csc.exe selection_parent_generic: ParentImage|endswith: - \cscript.exe - \excel.exe - \mshta.exe - \onenote.exe - \outlook.exe - \powerpnt.exe - \winword.exe - \wscript.exe selection_parent_powershell: ParentImage|endswith: - \powershell.exe - \pwsh.exe ParentCommandLine|contains: - '-Encoded ' - FromBase64String selection_parent_susp_location: - ParentCommandLine|re: (?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$ - ParentCommandLine|contains: - :\PerfLogs\ - :\Users\Public\ - :\Windows\Temp\ - \Temporary Internet - ParentCommandLine|contains|all: - :\Users\ - \Favorites\ - ParentCommandLine|contains|all: - :\Users\ - \Favourites\ - ParentCommandLine|contains|all: - :\Users\ - \Contacts\ - ParentCommandLine|contains|all: - :\Users\ - \Pictures\ filter_main_programfiles: ParentImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ filter_main_sdiagnhost: ParentImage: C:\Windows\System32\sdiagnhost.exe filter_main_w3p: ParentImage: C:\Windows\System32\inetsrv\w3wp.exe filter_optional_chocolatey: ParentImage: C:\ProgramData\chocolatey\choco.exe filter_optional_defender: ParentCommandLine|contains: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection filter_optional_ansible: ParentCommandLine|contains: - JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw - cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzAC
Near-miss passage: Sigma rule: Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring". Logsource: windows / windefend. Rule: title: Microsoft Defender Tamper Protection Trigger id: 49e5bc24-8b86-49f1-b743-535f332c2856 status: stable description: Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring" references: - https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide author: Bhabesh Raj, Nasreddine Bencherchali date: 2021-07-05 modified: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5013 Value|endswith: - \Windows Defender\DisableAntiSpyware - \Windows Defender\DisableAntiVirus - \Windows Defender\Scan\DisableArchiveScanning - \Windows Defender\Scan\DisableScanningNetworkFiles - \Real-Time Protection\DisableRealtimeMonitoring - \Real-Time Protection\DisableBehaviorMonitoring - \Real-Time Protection\DisableIOAVProtection - \Real-Time Protection\DisableScriptScanning condition: selection falsepositives: - Administrator might try to disable defender features during testing (must be investigated) level: high