update create-process-suspended to include DEBUG_ONLY_THIS_PROCESS (#978

)
mandiant · Jan 7, 2025 · ff9db74 · ff9db74
1 parent e033410
commit ff9db74
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/host-interaction/process/create/create-process-suspended.yml b/host-interaction/process/create/create-process-suspended.yml
@@ -4,18 +4,23 @@ rule:
     namespace: host-interaction/process/create
     authors:
       - william.ballenthin@mandiant.com
+      - mehunhoff@google.com
     scopes:
       static: basic block
       dynamic: call
     mbc:
       - Process::Create Process::Create Suspended Process [C0017.003]
+    references:
+      - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/an-in-depth-look-at-mailto-ransomware-part-two-of-three/
+      - https://learn.microsoft.com/en-us/windows/win32/procthread/process-creation-flags#flags
     examples:
       - Practical Malware Analysis Lab 03-03.exe_:0x4010EA
   features:
     - and:
       - or:
         - number: 0x08000004 = CREATE_NO_WINDOW | CREATE_SUSPENDED
         - number: 4 = CREATE_SUSPENDED
+        - number: 2 = DEBUG_ONLY_THIS_PROCESS
       - or:
         - api: kernel32.CreateProcess
         - api: advapi32.CreateProcessAsUser