Suspicious Child Processes Spawned by KeyScrambler.exe on Windows

title: Suspicious Child Processes Spawned by KeyScrambler.exe on Windows
id: 6883cd75-ec0b-442d-8aa7-81fa9074d661
related:
  - id: d2451be2-b582-4e15-8701-4196ac180260
    type: similar
  - id: ca5583e9-8f80-46ac-ab91-7f314d13b984
    type: derived
status: test
description: This rule flags Windows process creation events where KeyScrambler.exe spawns child processes commonly abused for execution and scripting. Attackers may use these interpreters and utilities to run additional payloads under the context of a legitimate program, supporting persistence, privilege escalation, and stealth. It relies on process creation telemetry, matching the parent image ending with KeyScrambler.exe and the child process image name or original file name against a defined set.
references:
  - https://twitter.com/DTCERT/status/1712785421845790799
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_keyscrambler_susp_child_process.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-05-13
tags:
  - attack.persistence
  - attack.execution
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1203
  - attack.t1574.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \KeyScrambler.exe
  selection_binaries:
    - Image|endswith:
        - \cmd.exe
        - \cscript.exe
        - \mshta.exe
        - \powershell.exe
        - \pwsh.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \wscript.exe
    - OriginalFileName:
        - Cmd.Exe
        - cscript.exe
        - mshta.exe
        - PowerShell.EXE
        - pwsh.dll
        - regsvr32.exe
        - RUNDLL32.EXE
        - wscript.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1