---
title: Suspicious Process Spawned by Windows Calculator
id: 5a9c4e2d-8b1f-4a3d-9e5f-6c7b8a9d0e1f
status: experimental
description: Detects when a Windows calculator application spawns a child process, which is highly unusual and indicative of process injection or exploitation attempts often used to bypass security controls.
references:
  - https://attack.mitre.org/techniques/T1055/
author: Security Arsenal
date: 2024/05/23
tags:
  - attack.defense_evasion
  - attack.t1055.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\calc.exe'
      - '\win32calc.exe'
  filter:
    Image|endswith:
      - '\calc.exe'
      - '\win32calc.exe'
condition: selection and not filter
falsepositives:
  - Unknown
level: high
---
title: Potential Credential Access via LSASS Memory Dump
id: b2c3d4e5-f6a7-48b9-c0d1-e2f3a4b5c6d7
status: experimental
description: Detects processes accessing the LSASS memory with specific access rights, which is a common technique used by credential dumping tools to steal passwords. This behavior deviates from the digital twin baseline of normal system operation.
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2024/05/23
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess:
      - '0x1010'
      - '0x143A'
      - '0x1410'
      - '0x101a'
      - '0x1f0fff'
    SourceImage|notcontains:
      - '\Program Files\\'
      - '\Program Files (x86)\\'
      - '\System32\\'
      - '\SysWOW64\\'
      - '\WindowsApps\\'
  filter:
    SourceImage|endswith: '\svchost.exe'
condition: selection and not filter
falsepositives:
  - Legitimate security scanners
  - Backup software
  - Antivirus/Antimalware solutions
level: critical

// Hunt for Impossible Travel - Logins from two distant locations within a short timeframe
let timeframe = 1h;
let lookback = 2d;
SigninLogs
| where Timestamp > ago(lookback)
| project Timestamp, UserPrincipalName, Location, Latitude, Longitude, ResultType
| where ResultType == 0
| evaluate geo_distance_cluster(Timestamp, UserPrincipalName, Latitude, Longitude, timeframe)
| where DistanceBetweenClusterInKilometers > 1000 
| sort by Timestamp desc
| project Timestamp, UserPrincipalName, ClusterStart, ClusterEnd, DistanceBetweenClusterInKilometers


// Hunt for rare application usage by user
// Identifies processes executed by a user that are statistically rare for them compared to the organization baseline
let TimeFrame = 7d;
let RareProcessThreshold = 2;
DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| summarize CountByUser = count() by AccountName, FileName, InitiatingProcessFileName
| summarize TotalExecutions = sum(CountByUser) by FileName
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(TimeFrame)
    | summarize CountByUser = count() by AccountName, FileName
) on FileName
| where CountByUser < RareProcessThreshold
| project AccountName, FileName, InitiatingProcessFileName, Timestamp

-- Hunt for processes with suspicious parent-child relationships
-- Anomalies here often indicate code injection or process hollowing
SELECT 
  Pid, 
  Ppid, 
  Name, 
  Exe, 
  Username, 
  CommandLine,
  Parent.Name AS ParentName,
  Parent.Exe AS ParentExe,
  Parent.CommandLine AS ParentCommandLine
FROM process_info()
-- Filter for common LOLBins spawned by unusual parents
WHERE Name IN (
    'powershell.exe', 
    'cmd.exe', 
    'wscript.exe', 
    'cscript.exe', 
    'regsvr32.exe', 
    'rundll32.exe'
)
AND ParentName NOT IN (
    'explorer.exe', 
    'services.exe', 
    'svchost.exe', 
    'cmd.exe', 
    'powershell.exe', 
    'winlogon.exe', 
    'userinit.exe'
)
AND ParentName != ''


-- Hunt for persistence mechanisms via Scheduled Tasks
-- Checks for tasks registered in the last 24 hours that are not signed by Microsoft
SELECT 
  TaskName, 
  Action, 
  Trigger, 
  Author, 
  Description,
  CreationDate
FROM scheduler_tasks()
WHERE CreationDate > now() - 24h
AND NOT (Exe =~ "C:\\Windows\\System32\\*")
-- Further filter to ensure we catch anomalies where binary paths look wrong
AND Action =~ "*.exe"

<#
.SYNOPSIS
    Audit Logging Readiness for Behavioral Analysis
.DESCRIPTION
    Checks if critical event channels and audit policies are enabled 
    to support high-fidelity digital twin monitoring.
#>

Write-Host "[+] Checking Advanced Audit Policies..." -ForegroundColor Cyan

$requiredPolicies = @(
    "Security System Extension",
    "Logoff",
    "Logon",
    "Object Access",
    "Process Creation",
    "Special Logon"
)

$missingPolicies = @()

foreach ($policy in $requiredPolicies) {
    $setting = auditpol /get /subcategory:"$policy" 2>$null | Select-String "Success"
    if ($setting -and $setting.ToString() -match "Success") {
        Write-Host "  [+] $policy - Enabled" -ForegroundColor Green
    } else {
        Write-Host "  [-] $policy - DISABLED or NOT FOUND" -ForegroundColor Red
        $missingPolicies += $policy
    }
}

Write-Host "
[+] Verifying PowerShell Script Block Logging..." -ForegroundColor Cyan

$registryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
$sblEnabled = (Get-ItemProperty -Path $registryPath -ErrorAction SilentlyContinue).EnableScriptBlockLogging

if ($sblEnabled -eq 1) {
    Write-Host "  [+] Script Block Logging - Enabled" -ForegroundColor Green
} else {
    Write-Host "  [-] Script Block Logging - DISABLED" -ForegroundColor Red
    $missingPolicies += "ScriptBlockLogging"
}

if ($missingPolicies.Count -gt 0) {
    Write-Host "
[!] ALERT: The following logging requirements are missing for effective monitoring:" -ForegroundColor Yellow
    $missingPolicies | ForEach-Object { Write-Host "    - $_" -ForegroundColor Yellow }
} else {
    Write-Host "
[SUCCESS] System is configured for high-fidelity telemetry collection." -ForegroundColor Green
}