Suspicious WindowsTerminal Child Processes

Hunt Hypothesis

Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section)

Detection Rule

Sigma (Original)

title: Suspicious WindowsTerminal Child Processes
id: 8de89e52-f6e1-4b5b-afd1-41ecfa300d48
status: test
description: Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section)
references:
    - https://persistence-info.github.io/Data/windowsterminalprofile.html
    - https://twitter.com/nas_bench/status/1550836225652686848
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-25
modified: 2023-02-14
tags:
    - attack.execution
    - attack.persistence
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\WindowsTerminal.exe'
            - '\wt.exe'
    selection_susp:
        - Image|endswith:
              # Add more LOLBINS
              - '\rundll32.exe'
              - '\regsvr32.exe'
              - '\certutil.exe'
              - '\cscript.exe'
              - '\wscript.exe'
              - '\csc.exe'
        - Image|contains:
              # Add more suspicious paths
              - 'C:\Users\Public\'
              - '\Downloads\'
              - '\Desktop\'
              - '\AppData\Local\Temp\'
              - '\Windows\TEMP\'
        - CommandLine|contains:
              # Add more suspicious commandline
              - ' iex '
              - ' icm'
              - 'Invoke-'
              - 'Import-Module '
              - 'ipmo '
              - 'DownloadString('
              - ' /c '
              - ' /k '
              - ' /r '
    filter_builtin_visual_studio_shell:
        CommandLine|contains|all:
            - 'Import-Module'
            - 'Microsoft.VisualStudio.DevShell.dll'
            - 'Enter-VsDevShell'
    filter_open_settings:
        CommandLine|contains|all:
            - '\AppData\Local\Packages\Microsoft.WindowsTerminal_'
            - '\LocalState\settings.json'
    filter_vsdevcmd:
        CommandLine|contains|all:
            - 'C:\Program Files\Microsoft Visual Studio\'
            - '\Common7\Tools\VsDevCmd.bat'
    condition: all of selection_* and not 1 of filter_*
falsepositives:
    - Other legitimate "Windows Terminal" profiles
level: medium

KQL (Azure Sentinel)

imProcessCreate
| where (((ParentProcessName endswith "\\WindowsTerminal.exe" or ParentProcessName endswith "\\wt.exe") or (ActingProcessName endswith "\\WindowsTerminal.exe" or ActingProcessName endswith "\\wt.exe")) and ((TargetProcessName endswith "\\rundll32.exe" or TargetProcessName endswith "\\regsvr32.exe" or TargetProcessName endswith "\\certutil.exe" or TargetProcessName endswith "\\cscript.exe" or TargetProcessName endswith "\\wscript.exe" or TargetProcessName endswith "\\csc.exe") or (TargetProcessName contains "C:\\Users\\Public\\" or TargetProcessName contains "\\Downloads\\" or TargetProcessName contains "\\Desktop\\" or TargetProcessName contains "\\AppData\\Local\\Temp\\" or TargetProcessName contains "\\Windows\\TEMP\\") or (TargetProcessCommandLine contains " iex " or TargetProcessCommandLine contains " icm" or TargetProcessCommandLine contains "Invoke-" or TargetProcessCommandLine contains "Import-Module " or TargetProcessCommandLine contains "ipmo " or TargetProcessCommandLine contains "DownloadString(" or TargetProcessCommandLine contains " /c " or TargetProcessCommandLine contains " /k " or TargetProcessCommandLine contains " /r "))) and (not(((TargetProcessCommandLine contains "Import-Module" and TargetProcessCommandLine contains "Microsoft.VisualStudio.DevShell.dll" and TargetProcessCommandLine contains "Enter-VsDevShell") or (TargetProcessCommandLine contains "\\AppData\\Local\\Packages\\Microsoft.WindowsTerminal_" and TargetProcessCommandLine contains "\\LocalState\\settings.json") or (TargetProcessCommandLine contains "C:\\Program Files\\Microsoft Visual Studio\\" and TargetProcessCommandLine contains "\\Common7\\Tools\\VsDevCmd.bat"))))

Required Data Sources

False Positive Guidance

• Other legitimate “Windows Terminal” profiles

MITRE ATT&CK Context

• Tactic: Execution
• Tactic: Persistence

References

• https://persistence-info.github.io/Data/windowsterminalprofile.html
• https://twitter.com/nas_bench/status/1550836225652686848
• SigmaHQ Rule