Process logs are important data sources. IT professionals can analyze the logs in QRadar to detect, hunt and trace threats, and to check if the malware spread throughout the network.

An example of a process log looks like this: “A new process has been created, Process Name: notepad.exe, process ID: 123, ….”

Traditional process logs provided by Microsoft Windows are not enough. The analysis below is based on process logs generated by Microsoft Sysmon, an advanced background monitor that records process-related activity.

Example One: Checking the Process Hash

When we have the hash of the process (e.g., MD5, SH1, etc.), we can check if the process is known to be malware. Online platforms such as VirusTotal enable analysts to search for malware by hash.

Below is an example of a process-created event:

By checking the process hash in VirusTotal, we can see that it’s a malicious process, since the detection ratio is 45/56. You can trace the malicious process by checking its parent process, as well as the user who created and ran it. With a security information and event management (SIEM) solution, you can then search for any endpoint that had a process with that hash to see if the same malware appears in another endpoint. For example:

Example Two: Network Connection Logs

It’s important to know the process that initiated the network connection. If we look for any outbound connections to a suspicious destination IP, for example, we can check the process that initiated that connection. This is the art of tracing.

If you don’t have the process logs, however, you will not see the process ID. SIEM solutions usually check outbound connections using firewall events. Some processes, such as Explorer.exe, should not create any connections. You can create a search to look for any network connections where the process image is Explorer.exe. Fraudsters often try to inject malicious code into legitimate processes like this.

Example Three: Process Sequence

We can detect malicious files by analyzing their behavior, not by signature matching, also based on log files. For example, we can search for Metasploit Windows Command Shell payload or shellcode, such as windows/shell/reverse_tcp.

If the above malicious file (openMe.exe) is opened at an endpoint, we will see the following events:

So we see a sequence of events as a new process, openMe.exe, is created, followed by its child process, cmd.exe. Then the parent process establishes a network connection. You can write a sequence rule in QRadar to detect that pattern. You can also add restrictions to the rule.

Example Four: Process Injection, Malware Style

A process can create a thread in another process. This is a well-known technique that cybercriminals use to inject and hide their malicious code. Once that happens, you will no longer see the malicious process in the standard Windows task manager.

Using a Meterpreter session, I can migrate to another process. For example:

If that happens, we will see the following event:

Benefits of Analyzing Process Logs

Thorough analysis of process logs can enable IT professionals to:

  • Check the process image entropy to determine whether a process is encrypted or compressed.
  • Profile endpoint process profiling for one week. After than, an alarm will sound if the system detects an unknown process. You can also accomplish this in QRadar by using reference data.
  • Verify the process image or search for any process-created event where the image is not verified or signed.

This is a really powerful log source to trace and track what’s going on at the endpoint. It also enables security teams to detect malware by analyzing the process event sequence, which can be invaluable for an organization.

More from Intelligence & Analytics

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Accelerating security outcomes with a cloud-native SIEM

5 min read - As organizations modernize their IT infrastructure and increase adoption of cloud services, security teams face new challenges in terms of staffing, budgets and technologies. To keep pace, security programs must evolve to secure modern IT environments against fast-evolving threats with constrained resources. This will require rethinking traditional security strategies and focusing investments on capabilities like cloud security, AI-powered defense and skills development. The path forward calls on security teams to be agile, innovative and strategic amidst the changes in technology…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today