Sigma rule: Potential Process Injection Via Msra.EXE

Rule

Title

Potential Process Injection Via Msra.EXE

Status

test

Level

high

Author

Alexander McDonald

Date

2022-06-24

Modified

2023-02-03

File

rules/windows/process_creation/proc_creation_win_msra_process_injection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage|endswith: '\msra.exe'
    ParentCommandLine|endswith: 'msra.exe'
    Image|endswith:
        - '\arp.exe'
        - '\cmd.exe'
        - '\net.exe'
        - '\netstat.exe'
        - '\nslookup.exe'
        - '\route.exe'
        - '\schtasks.exe'
        - '\whoami.exe'
condition: selection

False positives (as the rule lists them)

• Legitimate use of Msra.exe

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1055

MITRE ATT&CK ids this rule names

• T1055

References

• https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/
• https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_msra_process_injection.yml