windows-incorrect_parent_process.conf

{
  "platform": "windows",
  "description": "ATT&CK: T1173,T1086,T1204,T1183",
  "queries": {
    "services.exe_incorrect_parent_process": {
        "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent!=(SELECT pid from processes where name='wininit.exe') AND LOWER(name)='services.exe') OR pid=(SELECT pid FROM processes WHERE parent!=(SELECT pid from processes where name='wininit.exe') AND LOWER(name)='services.exe');",
        "interval": 60,
        "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1204",
        "removed": false
        },
    "lsass.exe_incorrect_parent_process": {
        "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent!=(SELECT pid from processes where name='wininit.exe') AND LOWER(name)='lsass.exe') OR pid=(SELECT pid FROM processes WHERE parent!=(SELECT pid from processes where name='wininit.exe') AND LOWER(name)='lsass.exe');",
        "interval": 60,
        "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1204",
        "removed": false
        },
    "svchost.exe_incorrect_parent_process": {
        "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent!=(SELECT pid from processes where name='services.exe') AND LOWER(name)='svchost.exe') OR pid=(SELECT pid FROM processes WHERE parent!=(SELECT pid from processes where name='services.exe') AND LOWER(name)='svchost.exe');",
        "interval": 60,
        "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1204",
        "removed": false
        },
    "cmd.exe_incorrect_parent_process": {
      "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='cmd.exe') OR pid=(SELECT pid FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='cmd.exe');",
      "interval": 60,
      "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1173,T1204",
      "removed": false
        },
    "powershell.exe_incorrect_parent_process": {
        "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='powershell.exe') OR pid=(SELECT pid FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='powershell.exe');",
        "interval": 60,
        "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1173,T1086,T1204",
        "removed": false
        },
    "notepad++.exe_incorrect_parent_process": {
        "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='notepad++.exe') OR pid=(SELECT pid FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='notepad++.exe');",
        "interval": 60,
        "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1204",
        "removed": false
        },
    "notepad.exe_incorrect_parent_process": {
        "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='notepad.exe') OR pid=(SELECT pid FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='notepad.exe');",
        "interval": 60,
        "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1204",
        "removed": false
        },
    "iexplore.exe_incorrect_parent_process": {
        "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='iexplore.exe') OR pid=(SELECT pid FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='iexplore.exe');",
        "interval": 60,
        "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1204",
        "removed": false
        },
    "firefox.exe_incorrect_parent_process": {
        "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='firefox.exe') OR pid=(SELECT pid FROM processes WHERE parent!=(SELECT pid from processes where name='explorer.exe') AND LOWER(name)='firefox.exe');",
        "interval": 60,
        "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1204",
        "removed": false
        },
    "chrome.exe_incorrect_parent_process": {
        "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent != (SELECT pid from processes where name='explorer.exe') AND LOWER(name)='chrome.exe') OR pid=(SELECT pid FROM processes WHERE parent != (SELECT pid from processes where name='explorer.exe') AND LOWER(name)='chrome.exe');",
        "interval": 60,
        "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1204",
        "removed": false
        },
    "conhost.exe_incorrect_parent_process": {
        "query": "SELECT name as bad_parent_child_name, pid bad_parent_child_pid FROM processes WHERE pid=(SELECT parent FROM processes WHERE parent != (SELECT pid from processes where name='csrss.exe') AND LOWER(name)='conhost.exe') OR pid=(SELECT pid FROM processes WHERE parent != (SELECT pid from processes where name='csrss.exe') AND LOWER(name)='conhost.exe');",
        "interval": 60,
        "description": "Detect processes masquerading as legitimate Windows processes - ATT&CK T1204",
        "removed": false
        }
    }
}