# Suspicious parent-child process creation seen through Sysmon Event ID 1.
#
# An Office application or a browser starting a command interpreter is the
# classic first stage of a macro or a downloaded-document intrusion.
#
# This rule belongs to a CUSTOM integration. The standard space is read-only,
# and a custom rule cannot be attached to a standard integration, so create an
# integration such as "sysmon-custom" (category System Activity) and set
# logsource.product to that title. logsource does not take part in matching;
# the detection block does. Point the detector at
# wazuh-events-v5-system-activity, where the standard Windows integration
# writes Sysmon events.
#
# FIELDS: verified on a Wazuh 5.0.0-beta5 lab (23 September 2026) against real
# Sysmon events from a Windows 11 endpoint. The standard windows integration
# sets event.dataset to "sysmon" and event.code to the STRING "1", and writes
# process.name, process.executable, process.command_line, process.args,
# process.pid, process.entity_id, process.working_directory,
# process.hash.md5/sha256, process.pe.*, process.parent.{name,executable,
# command_line,args,pid,entity_id}, user.{name,id,domain}, related.hash,
# related.user, host.name. Every field selected below is populated. There are
# no winlog.* fields. If your content differs, run logtest-sysmon.json and
# adjust the selection to the field paths the normalization output shows.
#
# The shipped beta5 content produced no findings from benign Sysmon activity,
# so a custom rule like this one is how the channel earns a detection today.
#
# Sources:
#   https://documentation.wazuh.com/5.0-beta/user-manual/data-analysis/rules.html
#   https://documentation.wazuh.com/5.0-beta/user-manual/capabilities/log-data-collection/use-cases.html
#   https://github.com/wazuh/wazuh/blob/main/docs/guide/migration/rules-4x-to-5x.md
---
id: "a532ee04-5fbf-42ec-b040-3c744be9b52d"
enabled: true
status: "experimental"
level: "high"
logsource:
  product: "sysmon-custom"
  category: "process_creation"
  service: "sysmon"
  definition: "Requires Sysmon installed with a configuration that logs Event ID 1,
    and the Microsoft-Windows-Sysmon/Operational channel collected by the agent."
detection:
  condition: "selection_parent and selection_child and not filter_signed_updaters"
  selection_parent:
    event.dataset: "sysmon"
    event.code: "1"
    process.parent.name:
      - "winword.exe"
      - "excel.exe"
      - "powerpnt.exe"
      - "outlook.exe"
      - "msaccess.exe"
      - "onenote.exe"
      - "mshta.exe"
      - "chrome.exe"
      - "msedge.exe"
      - "firefox.exe"
  selection_child:
    process.name:
      - "cmd.exe"
      - "powershell.exe"
      - "pwsh.exe"
      - "wscript.exe"
      - "cscript.exe"
      - "mshta.exe"
      - "rundll32.exe"
      - "regsvr32.exe"
      - "bitsadmin.exe"
      - "certutil.exe"
  filter_signed_updaters:
    process.command_line|contains:
      - "\\Microsoft\\EdgeUpdate\\"
      - "\\Google\\Update\\"
metadata:
  title: "Office or browser process started {{ process.name }} on {{ wazuh.agent.host.name }}"
  author: "Security engineering"
  date: "2026-09-22"
  modified: "2026-09-22"
  description: >-
    A document application or a browser created a command interpreter or a
    living-off-the-land binary. Treat the parent document or download as the
    lead and pull process.command_line from the finding before anything else.
  references:
    - "https://attack.mitre.org/techniques/T1566/001/"
    - "https://attack.mitre.org/techniques/T1059/"
  documentation: "Pivot on process.parent.executable and the agent, then look for
    a Sysmon Event ID 3 network connection or Event ID 11 file create from the
    child process in the following minutes."
  supports:
    - "windows"
mitre:
  tactic:
    - "TA0001"
    - "TA0002"
  technique:
    - "T1566"
    - "T1059"
  subtechnique:
    - "T1566.001"
    - "T1059.001"
    - "T1059.003"
compliance:
  pci_dss:
    - "5.2"
    - "10.2.7"
  iso_27001:
    - "A.8.7"
  nist_800_53:
    - "SI-3"
    - "SI-4"
tags:
  - "attack.initial-access"
  - "attack.execution"
  - "attack.t1566.001"
  - "attack.t1059.001"
falsepositives:
  - "Mail-merge and add-in installers that shell out during a legitimate workflow"
  - "Software deployment tools driving Office through a script"
  - "Help-desk macros that were written before anyone worried about this pattern"