Installer or updater process spawning a shell, script host or downloader

1title: Installer or updater process spawning a shell, script host or downloader2id: ffc1e08b-50bf-400e-87b1-dca3bfb6800b3status: experimental4description: |5  MITRE's Windows analytic for a compromised software supply chain is a6  four-stage chain: installer runs, binaries are written into program paths, the7  first run spawns unexpected children or loads unsigned modules, and the host8  beacons to something that is not an approved update endpoint. Stage three is9  the only part that is one event, so this rule matches process creation where10  the parent is an installer, updater or setup binary and the child is a shell,11  script host or download utility.12  Read it as a hunt, not as supply-chain detection. The dominant real-world form13  of this technique never creates a process at all: a payload compiled into a14  signed vendor assembly, or a malicious DLL side-loaded by the signed15  application, runs in-process and produces zero events here. The leg that16  carries that is the brief's driver_load (Sysmon 6) and image_load (Sysmon 7)17  sources, where Signed, Signature and SignatureStatus let an unsigned or18  unexpectedly-signed module loading into a vendor process be scored — none of19  which this rule sees. The child list is a starting set taken from the20  analytic's wording ("spawns scripts/shells"), not an exhaustive interpreter21  inventory, and a tampered installer that runs its payload as its own child EXE22  never touches it. The write-to-first-run-to-egress correlation MITRE specifies23  needs a 90-minute join across file, module and network telemetry, which Sigma24  cannot express, and the ApprovedSigners and ApprovedUpdateHosts knobs are list25  lookups rather than field tests, so neither is modelled here.26  UNVERIFIED — derived from MITRE ATT&CK DET0309 and never executed against logs.27references:28  - https://attack.mitre.org/techniques/T1195/00229  - https://attack.mitre.org/detectionstrategies/DET030930author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)31date: 2026-08-1632tags:33  - attack.initial-access34  - attack.t1195.00235logsource:36  category: process_creation37  product: windows38detection:39  selection_installer_parent:40    ParentImage|endswith:41      - '\msiexec.exe'42      - '\setup.exe'43      - '\install.exe'44      - '\installer.exe'45      - '\update.exe'46      - '\updater.exe'47      - '\upgrade.exe'48  selection_unexpected_child:49    Image|endswith:50      - '\cmd.exe'51      - '\powershell.exe'52      - '\pwsh.exe'53      - '\wscript.exe'54      - '\cscript.exe'55      - '\mshta.exe'56      - '\bitsadmin.exe'57      - '\certutil.exe'58      - '\curl.exe'59      - '\regsvr32.exe'60  condition: selection_installer_parent and selection_unexpected_child61falsepositives:62  - "MSI custom actions, which routinely shell out to cmd.exe or PowerShell to register services, patch configuration files or run post-install checks. This is the dominant match by a wide margin and it is legitimate for most vendors — the separation is which publisher signed the parent, which is MITRE's ApprovedSigners knob and not a field this log source carries. It is why the level here is low."63  - "Third-party installer frameworks — Inno Setup, NSIS, InstallShield — whose setup.exe runs cmd /c for post-install cleanup, service registration or PATH edits. On developer and end-user workstations this is the single commonest instance of this exact parent-child pair."64  - "Enterprise software deployment (SCCM, Intune, Chocolatey, WinGet) whose packages wrap the vendor installer in a PowerShell or batch wrapper, so the parent-child pair appears on every managed host during a rollout wave."65  - "Application self-updaters — Squirrel-packaged apps run theirs as Update.exe — invoking cmd.exe to move files or clean up old versions on each release."66  - "Driver and runtime redistributables that call certutil to verify a hash or install a certificate as part of a supported install sequence."67level: low