Process logs are important data sources. IT professionals can analyze the logs in QRadar to detect, hunt and trace threats, and to check if the malware spread throughout the network.
An example of a process log looks like this: “A new process has been created, Process Name: notepad.exe, process ID: 123, ….”
Traditional process logs provided by Microsoft Windows are not enough. The analysis below is based on process logs generated by Microsoft Sysmon, an advanced background monitor that records process-related activity.
Example One: Checking the Process Hash
When we have the hash of the process (e.g., MD5, SH1, etc.), we can check if the process is known to be malware. Online platforms such as VirusTotal enable analysts to search for malware by hash.
Below is an example of a process-created event:
By checking the process hash in VirusTotal, we can see that it’s a malicious process, since the detection ratio is 45/56. You can trace the malicious process by checking its parent process, as well as the user who created and ran it. With a security information and event management (SIEM) solution, you can then search for any endpoint that had a process with that hash to see if the same malware appears in another endpoint. For example:
Example Two: Network Connection Logs
It’s important to know the process that initiated the network connection. If we look for any outbound connections to a suspicious destination IP, for example, we can check the process that initiated that connection. This is the art of tracing.
If you don’t have the process logs, however, you will not see the process ID. SIEM solutions usually check outbound connections using firewall events. Some processes, such as Explorer.exe, should not create any connections. You can create a search to look for any network connections where the process image is Explorer.exe. Fraudsters often try to inject malicious code into legitimate processes like this.
Example Three: Process Sequence
We can detect malicious files by analyzing their behavior, not by signature matching, also based on log files. For example, we can search for Metasploit Windows Command Shell payload or shellcode, such as windows/shell/reverse_tcp.
If the above malicious file (openMe.exe) is opened at an endpoint, we will see the following events:
So we see a sequence of events as a new process, openMe.exe, is created, followed by its child process, cmd.exe. Then the parent process establishes a network connection. You can write a sequence rule in QRadar to detect that pattern. You can also add restrictions to the rule.
Example Four: Process Injection, Malware Style
A process can create a thread in another process. This is a well-known technique that cybercriminals use to inject and hide their malicious code. Once that happens, you will no longer see the malicious process in the standard Windows task manager.
Using a Meterpreter session, I can migrate to another process. For example:
If that happens, we will see the following event:
Benefits of Analyzing Process Logs
Thorough analysis of process logs can enable IT professionals to:
- Check the process image entropy to determine whether a process is encrypted or compressed.
- Profile endpoint process profiling for one week. After than, an alarm will sound if the system detects an unknown process. You can also accomplish this in QRadar by using reference data.
- Verify the process image or search for any process-created event where the image is not verified or signed.
This is a really powerful log source to trace and track what’s going on at the endpoint. It also enables security teams to detect malware by analyzing the process event sequence, which can be invaluable for an organization.