Windows mpiexec.exe LOLBin usage with -n 1 /n 1 flag combination

title: Windows mpiexec.exe LOLBin usage with -n 1 /n 1 flag combination
id: b6f245a1-e180-4fd9-8b70-af3f21924769
status: test
description: This rule flags process creation events where mpiexec.exe is executed and the command line contains either the /n 1 or -n 1 argument, correlated with a specific mpiexec.exe imphash. Such use matters because mpiexec is an execution-capable component that can be leveraged to run other binaries through nonstandard invocation patterns. The detection relies on Windows process creation telemetry, matching the image path ending with '\mpiexec.exe' and the command line substrings along with the recorded imphash value.
references:
  - https://twitter.com/mrd0x/status/1465058133303246867
  - https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_mpiexec.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-11
modified: 2024-11-23
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    - Image|endswith: \mpiexec.exe
    - Hashes|contains: IMPHASH=d8b52ef6aaa3a81501bdfff9dbb96217
  selection_flags:
    CommandLine|contains:
      - " /n 1 "
      - " -n 1 "
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 729ce0ea-5d8f-4769-9762-e35de441586d
    type: derived