IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›Elastic Security Solution [7.11] ›Detections and Alerts ›Prebuilt rule reference
« Potential Application Shimming via Sdbinst Potential Credential Access via Windows Utilities »

Potential Command and Control via Internet Exploreredit

Identifies instances of Internet Explorer (iexplore.exe) being started via the Component Object Model (COM) making unusual network connections. Adversaries could abuse Internet Explorer via COM to avoid suspicious processes making network connections and bypass host-based firewall restrictions.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-endpoint.events.*

Severity: medium

Risk score: 43

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Command and Control

Version: 1

Added (Elastic Stack release): 7.11.0

Rule authors: Elastic

Rule license: Elastic License

Rule queryedit

sequence by host.id, process.entity_id with maxspan = 1s [process
where event.type:"start" and process.parent.name:"iexplore.exe" and
process.parent.args:"-Embedding"] /* IE started via COM in normal
conditions makes few connections, mainly to Microsoft and OCSP related
domains, add FPs here */ [network where network.protocol : "dns" and
process.name:"iexplore.exe" and not wildcard(dns.question.name,
"*.microsoft.com",
"*.digicert.com", "*.msocsp.com",
"*.windowsupdate.com",
"*.bing.com", "*.identrust.com")
]

Threat mappingedit

Framework: MITRE ATT&CKTM

« Potential Application Shimming via Sdbinst Potential Credential Access via Windows Utilities »