Windows: Detect kavremover/cleanapi LOLBIN-style command-line execution

title: "Windows: Detect kavremover/cleanapi LOLBIN-style command-line execution"
id: c5f2aaab-27c6-42f7-af41-fb166b844539
status: test
description: This rule flags process executions where the command line contains the pattern ' run run-cmd ', which is characteristic of abusing the kavremover/cleanapi component as a LOLBIN to run arbitrary commands or binaries. Attackers can use signed, trusted executables to blend into normal activity while achieving execution. The detection relies on Windows process creation telemetry, using parent process image suffix matching to distinguish likely legitimate launch chains from suspicious use.
references:
  - https://nasbench.medium.com/lolbined-using-kaspersky-endpoint-security-kes-installer-to-execute-arbitrary-commands-1c999f1b7fea
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_kavremover_uncommon_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-01
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains: " run run-cmd "
  filter_main_legit_parents:
    ParentImage|endswith:
      - \cleanapi.exe
      - \kavremover.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d047726b-c71c-4048-a99b-2e2f50dc107d
    type: derived