Match Legitimate Resource Name or Location

let SystemProcessPaths = dynamic([
  @"C:\Windows\System32\svchost.exe",
  @"C:\Windows\System32\csrss.exe",
  @"C:\Windows\System32\lsass.exe",
  @"C:\Windows\System32\services.exe",
  @"C:\Windows\System32\smss.exe",
  @"C:\Windows\System32\wininit.exe",
  @"C:\Windows\System32\conhost.exe",
  @"C:\Windows\System32\dllhost.exe",
  @"C:\Windows\System32\RuntimeBroker.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("svchost.exe", "csrss.exe", "lsass.exe", "services.exe", "smss.exe", "wininit.exe", "conhost.exe", "dllhost.exe", "RuntimeBroker.exe", "taskhostw.exe", "spoolsv.exe", "msdtc.exe", "wuauclt.exe", "vmtoolsd.exe")
| where not(FolderPath in~ (SystemProcessPaths))
| where not(FolderPath startswith @"C:\Windows\System32\" or FolderPath startswith @"C:\Windows\SysWOW64\")
| extend ParentMismatch = case(
    FileName =~ "svchost.exe" and InitiatingProcessFileName !~ "services.exe", true,
    FileName =~ "csrss.exe" and InitiatingProcessFileName !in~ ("smss.exe", "csrss.exe"), true,
    FileName =~ "lsass.exe" and InitiatingProcessFileName !~ "wininit.exe", true,
    FileName =~ "services.exe" and InitiatingProcessFileName !~ "wininit.exe", true,
    false)
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine,
         InitiatingProcessFileName, ParentMismatch, SHA256
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\svchost.exe" OR Image="*\\csrss.exe" OR Image="*\\lsass.exe" OR Image="*\\services.exe" OR Image="*\\smss.exe" OR Image="*\\wininit.exe" OR Image="*\\conhost.exe" OR Image="*\\dllhost.exe" OR Image="*\\RuntimeBroker.exe" OR Image="*\\msdtc.exe" OR Image="*\\wuauclt.exe")
  NOT (Image="C:\\Windows\\System32\\*" OR Image="C:\\Windows\\SysWOW64\\*" OR Image="C:\\Windows\\explorer.exe")
| eval ProcessName=mvindex(split(Image, "\\"), -1)
| eval ParentName=mvindex(split(ParentImage, "\\"), -1)
| eval ParentMismatch=case(
    lower(ProcessName)=="svchost.exe" AND lower(ParentName)!="services.exe", "TRUE",
    lower(ProcessName)=="csrss.exe" AND lower(ParentName)!="smss.exe", "TRUE",
    lower(ProcessName)=="lsass.exe" AND lower(ParentName)!="wininit.exe", "TRUE",
    1==1, "FALSE")
| table _time, host, User, Image, ParentImage, ParentMismatch, CommandLine, Hashes
| sort - _time

process where event.type == "start"
  and process.name in~ ("svchost.exe", "csrss.exe", "lsass.exe", "services.exe", "smss.exe", "wininit.exe", "conhost.exe", "dllhost.exe", "RuntimeBroker.exe", "msdtc.exe", "wuauclt.exe", "taskhostw.exe", "spoolsv.exe")
  and not (
    process.executable like~ "C:\\Windows\\System32\\*" or
    process.executable like~ "C:\\Windows\\SysWOW64\\*"
  )
  or (
    process.name == "svchost.exe" and process.parent.name != "services.exe" and
    process.executable like~ "C:\\Windows\\System32\\svchost.exe"
  )
  or (
    process.name == "lsass.exe" and process.parent.name != "wininit.exe" and
    process.executable like~ "C:\\Windows\\System32\\lsass.exe"
  )
  or (
    process.name == "csrss.exe" and process.parent.name not in ("smss.exe", "csrss.exe") and
    process.executable like~ "C:\\Windows\\System32\\csrss.exe"
  )

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  "Process Name",
  "Process Path",
  "Parent Process Name",
  "Command",
  sourceip
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (382, 399)
  AND QIDNAME(qid) ILIKE '%process create%'
  AND (
    "Process Name" ILIKE 'svchost.exe'
    OR "Process Name" ILIKE 'csrss.exe'
    OR "Process Name" ILIKE 'lsass.exe'
    OR "Process Name" ILIKE 'services.exe'
    OR "Process Name" ILIKE 'smss.exe'
    OR "Process Name" ILIKE 'wininit.exe'
    OR "Process Name" ILIKE 'conhost.exe'
    OR "Process Name" ILIKE 'dllhost.exe'
    OR "Process Name" ILIKE 'RuntimeBroker.exe'
    OR "Process Name" ILIKE 'msdtc.exe'
    OR "Process Name" ILIKE 'wuauclt.exe'
  )
  AND NOT (
    "Process Path" ILIKE 'C:\Windows\System32\%'
    OR "Process Path" ILIKE 'C:\Windows\SysWOW64\%'
  )
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory="windows/sysmon" OR _sourceCategory="windows/security"
| json field=_raw "EventID" as event_id nodrop
| json field=_raw "Image" as process_path nodrop
| json field=_raw "ParentImage" as parent_path nodrop
| json field=_raw "CommandLine" as command_line nodrop
| json field=_raw "User" as user nodrop
| json field=_raw "Hashes" as hashes nodrop
| where event_id = "1"
| parse regex field=process_path "(?:[^\\\\]+\\\\)*(?P<process_name>[^\\\\]+\.exe)$" nodrop
| parse regex field=parent_path "(?:[^\\\\]+\\\\)*(?P<parent_name>[^\\\\]+\.exe)$" nodrop
| where process_name in ("svchost.exe", "csrss.exe", "lsass.exe", "services.exe", "smss.exe", "wininit.exe", "conhost.exe", "dllhost.exe", "RuntimeBroker.exe", "msdtc.exe", "wuauclt.exe") (case insensitive)
| where !(process_path matches "C:\\Windows\\System32\\*") AND !(process_path matches "C:\\Windows\\SysWOW64\\*")
| if (process_name matches "(?i)svchost\.exe" and !(parent_name matches "(?i)services\.exe"), "TRUE", "FALSE") as parent_mismatch_svchost
| if (process_name matches "(?i)lsass\.exe" and !(parent_name matches "(?i)wininit\.exe"), "TRUE", "FALSE") as parent_mismatch_lsass
| if (process_name matches "(?i)csrss\.exe" and !(parent_name matches "(?i)smss\.exe"), "TRUE", "FALSE") as parent_mismatch_csrss
| if (parent_mismatch_svchost="TRUE" or parent_mismatch_lsass="TRUE" or parent_mismatch_csrss="TRUE", "TRUE", "FALSE") as any_parent_mismatch
| fields _messageTime, _collector, user, process_name, process_path, parent_name, parent_path, any_parent_mismatch, command_line, hashes
| sort by _messageTime desc

rule t1036_005_masquerading_system_process_name {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects processes using legitimate Windows system process names executing from non-standard paths (outside System32/SysWOW64), or with unexpected parent process relationships. Covers MITRE ATT&CK T1036.005."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1036.005"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = $proc_path
    $e.target.process.file.full_path = $target_path
    $e.target.process.file.names[0] = $proc_name

    // Match known system process names
    re.regex($proc_name, `(?i)^(svchost|csrss|lsass|services|smss|wininit|conhost|dllhost|RuntimeBroker|msdtc|wuauclt|taskhostw|spoolsv)\.exe$`)

    // Not in standard system paths
    not re.regex($target_path, `(?i)^C:\\Windows\\(System32|SysWOW64)\\`)

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)\\(svchost|csrss|lsass|services|smss|wininit|conhost|dllhost|RuntimeBroker|msdtc|wuauclt|taskhostw|spoolsv)\.exe$/
| !ImageFileName = /(?i)^C:\\Windows\\(System32|SysWOW64)\\/
| ParentBaseFileName := replace(ParentImageFileName, /^.*\\/, "")
| ProcessName := replace(ImageFileName, /^.*\\/, "")
| ParentMismatch := case {
    ProcessName = /(?i)^svchost\.exe$/ and !ParentBaseFileName = /(?i)^services\.exe$/ : "true" ;
    ProcessName = /(?i)^lsass\.exe$/ and !ParentBaseFileName = /(?i)^wininit\.exe$/ : "true" ;
    ProcessName = /(?i)^csrss\.exe$/ and !ParentBaseFileName = /(?i)^(smss|csrss)\.exe$/ : "true" ;
    ProcessName = /(?i)^services\.exe$/ and !ParentBaseFileName = /(?i)^wininit\.exe$/ : "true" ;
    * : "false"
  }
| groupBy([ComputerName, UserName, ImageFileName, ParentImageFileName, CommandLine, SHA256HashData], function=count(aid, as=EventCount))
| sort(EventCount, order=desc)
| select([ComputerName, UserName, ProcessName, ImageFileName, ParentBaseFileName, ParentImageFileName, ParentMismatch, CommandLine, SHA256HashData, EventCount])