Windows Process Creation: ConfigSecurityPolicy.EXE Arbitrary File Transfer via URLs

title: "Windows Process Creation: ConfigSecurityPolicy.EXE Arbitrary File Transfer via URLs"
id: 75a291b6-a9ea-459b-916e-9dc0cf6a1d4b
status: test
description: This rule flags execution of ConfigSecurityPolicy.exe when its command line includes file transfer URLs over FTP or HTTP/S. Attackers may abuse this Windows Defender-related binary to upload or download external content while blending in with legitimate Windows tooling. The detection relies on process creation telemetry, specifically the process image/filename and command-line URL indicators.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/ConfigSecurityPolicy/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_configsecuritypolicy_download_file.yml
author: frack113, Huntrule Team
date: 2021-11-26
modified: 2022-05-16
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - CommandLine|contains: ConfigSecurityPolicy.exe
    - Image|endswith: \ConfigSecurityPolicy.exe
    - OriginalFileName: ConfigSecurityPolicy.exe
  selection_url:
    CommandLine|contains:
      - ftp://
      - http://
      - https://
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1f0f6176-6482-4027-b151-00071af39d7e
    type: derived