Suspicious keyscrambler child process

[swachchhanda000]

Summary of the Pull Request

KeyScrambler suspicious child process

Changelog

new: Potentially Suspicious Child Process Of KeyScrambler.exe

Example Log Event

{
    "EventTime": "2024-04-15T11:14:18.365386+00:00",
    "Hostname": "ACME",
    "Keywords": "9223372036854775808",
    "LevelValue": 4,
    "EventType": "INFO",
    "SeverityValue": 2,
    "Severity": "INFO",
    "EventID": 1,
    "SourceName": "Microsoft-Windows-Sysmon",
    "ProviderGuid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
    "Version": 5,
    "TaskValue": 1,
    "OpcoACMEalue": 0,
    "RecordNumber": 6952439,
    "ExecutionProcessID": 3472,
    "ExecutionThreadID": 4260,
    "Channel": "Microsoft-Windows-Sysmon/Operational",
    "Domain": "NT AUTHORITY",
    "AccountName": "SYSTEM",
    "UserID": "S-1-5-18",
    "AccountType": "User",
    "Message": "Process Create:\r\nRuleName: -\r\nUtcTime: 2024-04-15 11:14:18.364\r\nProcessGuid: {2dd6ca0d-0c0a-661d-4404-000000001300}\r\nProcessId: 4812\r\nImage: C:\\Windows\\SysWOW64\\cmd.exe\r\nFileVersion: 10.0.19041.3636 (WinBuild.160101.0800)\r\nDescription: Windows Command Processor\r\nProduct: Microsoft® Windows® Operating System\r\nCompany: Microsoft Corporation\r\nOriginalFileName: Cmd.Exe\r\nCommandLine: cmd.exe /C calc.exe\r\nCurrentDirectory: C:\\Users\\hostA\\Desktop\\\r\nUser: ACME\\hostA\r\nLogonGuid: {2dd6ca0d-b974-661c-0be3-110000000000}\r\nLogonId: 0x11E30B\r\nTerminalSessionId: 2\r\nIntegrityLevel: High\r\nHashes: SHA1=C2DBE672C77E7C3C1A8B2FA858CCD251C88BF116,MD5=D3348AC2130C7E754754A6E9CB053B09,SHA256=E9EF013238495BFFCE7459E059BFFE340A0F08B439EC94E7D4436F4E13714ECD,IMPHASH=392B4D61B1D1DADC1F06444DF258188A\r\nParentProcessGuid: {2dd6ca0d-0c0a-661d-4304-000000001300}\r\nParentProcessId: 3256\r\nParentImage: C:\\Users\\hostA\\Desktop\\KeyScrambler.exe\r\nParentCommandLine: \"C:\\Users\\hostA\\Desktop\\KeyScrambler.exe\" \r\nParentUser: ACME\\hostA",
    "Category": "Process Create (rule: ProcessCreate)",
    "Opcode": "Info",
    "Level": "Information",
    "RuleName": "-",
    "UtcTime": "2024-04-15 11:14:18.364",
    "ProcessGuid": "{2dd6ca0d-0c0a-661d-4404-000000001300}",
    "ProcessId": "4812",
    "Image": "C:\\Windows\\SysWOW64\\cmd.exe",
    "FileVersion": "10.0.19041.3636 (WinBuild.160101.0800)",
    "Description": "Windows Command Processor",
    "Product": "Microsoft® Windows® Operating System",
    "Company": "Microsoft Corporation",
    "OriginalFileName": "Cmd.Exe",
    "CommandLine": "cmd.exe /C calc.exe",
    "CurrentDirectory": "C:\\Users\\hostA\\Desktop\\",
    "User": "ACME\\hostA",
    "LogonGuid": "{2dd6ca0d-b974-661c-0be3-110000000000}",
    "LogonId": "0x11e30b",
    "TerminalSessionId": "2",
    "IntegrityLevel": "High",
    "Hashes": "SHA1=C2DBE672C77E7C3C1A8B2FA858CCD251C88BF116,MD5=D3348AC2130C7E754754A6E9CB053B09,SHA256=E9EF013238495BFFCE7459E059BFFE340A0F08B439EC94E7D4436F4E13714ECD,IMPHASH=392B4D61B1D1DADC1F06444DF258188A",
    "ParentProcessGuid": "{2dd6ca0d-0c0a-661d-4304-000000001300}",
    "ParentProcessId": "3256",
    "ParentImage": "C:\\Users\\hostA\\Desktop\\KeyScrambler.exe",
    "ParentCommandLine": "\"C:\\Users\\hostA\\Desktop\\KeyScrambler.exe\" ",
    "ParentUser": "ACME\\hostA",
    "EventReceivedTime": "2024-04-15T11:14:19.557036+00:00",
    "SourceModuleName": "in_win",
    "SourceModuleType": "im_msvistalog"
}

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions