Execution of Suspicious File Type Extension

Hunt Hypothesis

Detects whether the image specified in a process creation event doesn’t refer to an “.exe” (or other known executable extension) file. This can be caused by process ghosting or other unorthodox method

Detection Rule

Sigma (Original)

title: Execution of Suspicious File Type Extension
id: c09dad97-1c78-4f71-b127-7edb2b8e491a
status: test
description: |
    Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process.
    This rule might require some initial baselining to align with some third party tooling in the user environment.
references:
    - https://pentestlaboratories.com/2021/12/08/process-ghosting/
author: Max Altgelt (Nextron Systems)
date: 2021-12-09
modified: 2023-11-23
tags:
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    known_image_extension:
        Image|endswith:
            - '.bin'
            - '.cgi'
            - '.com'
            - '.exe'
            - '.scr'
            - '.tmp' # sadly many installers use this extension
    filter_main_image: # Windows utilities without extension
        Image:
            - 'System'
            - 'Registry'
            - 'MemCompression'
            - 'vmmem'
    filter_main_msi_installers:
        Image|contains: ':\Windows\Installer\MSI'
    filter_main_driver_store:
        Image|contains: ':\Windows\System32\DriverStore\FileRepository\'
    filter_main_msi_rollbackfiles:
        Image|contains: ':\Config.Msi\'
        Image|endswith:
            - '.rbf'
            - '.rbs'
    filter_main_windows_temp:
        - ParentImage|contains: ':\Windows\Temp\'
        - Image|contains: ':\Windows\Temp\'
    filter_main_deleted:
        Image|contains: ':\$Extend\$Deleted\'
    filter_main_empty:
        Image:
            - '-'
            - ''
    filter_main_null:
        Image: null
    filter_optional_avira:
        ParentImage|contains: ':\ProgramData\Avira\'
    filter_optional_nvidia:
        Image|contains: 'NVIDIA\NvBackend\'
        Image|endswith: '.dat'
    filter_optional_winpakpro:
        Image|contains:
            - ':\Program Files (x86)\WINPAKPRO\'
            - ':\Program Files\WINPAKPRO\'
        Image|endswith: '.ngn'
    filter_optional_myq_server:
        Image|endswith:
            - ':\Program Files (x86)\MyQ\Server\pcltool.dll'
            - ':\Program Files\MyQ\Server\pcltool.dll'
    filter_optional_wsl:
        Image|contains|all:
            - '\AppData\Local\Packages\'
            - '\LocalState\rootfs\'
    filter_optional_lzma_exe:
        Image|endswith: '\LZMA_EXE'
    filter_optional_firefox:
        Image|contains: ':\Program Files\Mozilla Firefox\'
    filter_optional_docker:
        ParentImage: 'C:\Windows\System32\services.exe'
        Image|endswith: 'com.docker.service'
    condition: not known_image_extension and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium

KQL (Azure Sentinel)

imProcessCreate
| where (not((TargetProcessName endswith ".bin" or TargetProcessName endswith ".cgi" or TargetProcessName endswith ".com" or TargetProcessName endswith ".exe" or TargetProcessName endswith ".scr" or TargetProcessName endswith ".tmp"))) and (not(((TargetProcessName in~ ("System", "Registry", "MemCompression", "vmmem")) or TargetProcessName contains ":\\Windows\\Installer\\MSI" or TargetProcessName contains ":\\Windows\\System32\\DriverStore\\FileRepository\\" or (TargetProcessName contains ":\\Config.Msi\\" and (TargetProcessName endswith ".rbf" or TargetProcessName endswith ".rbs")) or ((ParentProcessName contains ":\\Windows\\Temp\\" or ActingProcessName contains ":\\Windows\\Temp\\") or TargetProcessName contains ":\\Windows\\Temp\\") or TargetProcessName contains ":\\$Extend\\$Deleted\\" or (TargetProcessName in~ ("-", "")) or isnull(TargetProcessName)))) and (not(((ParentProcessName contains ":\\ProgramData\\Avira\\" or ActingProcessName contains ":\\ProgramData\\Avira\\") or (TargetProcessName contains "NVIDIA\\NvBackend\\" and TargetProcessName endswith ".dat") or ((TargetProcessName contains ":\\Program Files (x86)\\WINPAKPRO\\" or TargetProcessName contains ":\\Program Files\\WINPAKPRO\\") and TargetProcessName endswith ".ngn") or (TargetProcessName endswith ":\\Program Files (x86)\\MyQ\\Server\\pcltool.dll" or TargetProcessName endswith ":\\Program Files\\MyQ\\Server\\pcltool.dll") or (TargetProcessName contains "\\AppData\\Local\\Packages\\" and TargetProcessName contains "\\LocalState\\rootfs\\") or TargetProcessName endswith "\\LZMA_EXE" or TargetProcessName contains ":\\Program Files\\Mozilla Firefox\\" or ((ParentProcessName =~ "C:\\Windows\\System32\\services.exe" or ActingProcessName =~ "C:\\Windows\\System32\\services.exe") and TargetProcessName endswith "com.docker.service"))))

Required Data Sources

False Positive Guidance

• Unknown

References

• https://pentestlaboratories.com/2021/12/08/process-ghosting/
• SigmaHQ Rule