Detectionmediumtest

Potentially Suspicious Child Process of KeyScrambler.exe

Detects potentially suspicious child processes of KeyScrambler.exe

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan PoudelCreated Mon May 13ca5583e9-8f80-46ac-ab91-7f314d13b984windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_parent:
        ParentImage|endswith: '\KeyScrambler.exe'
    selection_binaries:
        # Note: add additional binaries that the attacker might use
        - Image|endswith:
              - '\cmd.exe'
              - '\cscript.exe'
              - '\mshta.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\regsvr32.exe'
              - '\rundll32.exe'
              - '\wscript.exe'
        - OriginalFileName:
              - 'Cmd.Exe'
              - 'cscript.exe'
              - 'mshta.exe'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
              - 'regsvr32.exe'
              - 'RUNDLL32.EXE'
              - 'wscript.exe'
    condition: all of selection_*

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

twitter.com

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0002 · Execution TA0005 · Defense Evasion TA0004 · Privilege Escalation

Techniques

T1203 · Exploitation for Client Execution

Sub-techniques

T1574.001 · DLL Search Order Hijacking

Related Rules

SimilarDetectionhigh

Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

ca5583e9-8f80-46ac-ab91-7f314d13b984

Status

test

Level

medium

Type

Detection

Created

Mon May 13

Author

Swachchhanda Shrawan Poudel

Path

rules/windows/process_creation/proc_creation_win_keyscrambler_susp_child_process.yml

Raw Tags

attack.persistenceattack.executionattack.defense-evasionattack.privilege-escalationattack.t1203attack.t1574.001

View on GitHub