Windows: Unusual Parent/Child Execution Involving ImagingDevices.exe

title: "Windows: Unusual Parent/Child Execution Involving ImagingDevices.exe"
id: b3dfebfa-6cfc-4d39-8f83-3db3b65541a3
status: test
description: This rule flags process creation events where ImagingDevices.exe (Windows Contacts) appears as the parent or child in uncommon process relationships. Attackers may leverage trusted or user-facing Windows components to launch additional binaries or to be spawned indirectly, helping execution blend into normal system activity. Detection relies on Windows process creation telemetry, matching on the Image and ParentImage filename endings for ImagingDevices.exe and specific system host parents.
references:
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_imagingdevices_unusual_parents.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-27
modified: 2022-12-29
tags:
  - attack.execution
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \WmiPrvSE.exe
      - \svchost.exe
      - \dllhost.exe
    Image|endswith: \ImagingDevices.exe
  selection_child:
    ParentImage|endswith: \ImagingDevices.exe
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f11f2808-adb4-46c0-802a-8660db50fa99
    type: derived