fix: FPs with Google Updater Uninstall Script

[Neo23x0]

Summary of the Pull Request

Filter false positives with Google Updater uninstall script running ping.exe to wait

Changelog

fix: Suspicious SYSTEM User Process Creation - filter false positives with Google Updater uninstall script

Example Log Event

ProcessId: 5420 Image: C:\Windows\SysWOW64\PING.EXE FileVersion: 10.0.22000.2360 (WinBuild.160101.0800) Description: TCP/IP Ping Command Product: Microsoft® Windows® Operating System Company: Microsoft Corporation OriginalFileName: ping.exe CommandLine: ping -n 2 127.0.0.1 CurrentDirectory: C:\Windows\system32\ User: NT AUTHORITY\SYSTEM LogonGuid: {70ca0443-1b1e-66c3-e703-000000000000} LogonId: 0x3e7 TerminalSessionId: 0 IntegrityLevel: System Hashes: MD5=82E8450A1FA4F2D027C1A90726C3BA39,SHA256=E444CAAC62A336207A93AE8547327EC97C66BA092AE3B1DD87E84B499C35E42F,IMPHASH=497E84B252F5A68B5DC294926603C721 ParentProcessGuid: {70ca0443-086b-6725-1c71-060000003c00} ParentProcessId: 8568 ParentImage: C:\Windows\SysWOW64\cmd.exe ParentCommandLine: "C:\Windows\system32\cmd.exe" /Q /C ""C:\Program Files (x86)\Google\GoogleUpdater\130.0.6679.0\uninstall.cmd" --dir="C:\Program Files (x86)\Google\GoogleUpdater\130.0.6679.0"" ParentUser: NT AUTHORITY\SYSTEM

uninstall.cmd

@echo off
rem Deletes recursively the directory specified by the
command line
rem argument of the script. The directory must be an updater install path.
echo %1 %2
if not "%1"=="--dir" (
echo "Invalid switch."
exit 1
set Directory=%2
rem Validate the path is an updater path.
@echo %Directory%
FindStr /L \Google\GoogleUpdater > nul
if %ERRORLEVEL% NEQ 0 (
echo "Invalid argument."
exit 2
rem Try deleting the directory 15 times and wait one second between tries.
for /L %%G IN (1,1,15) do (
ping -n 2 127.0.0.1 > nul
rmdir %Directory% /s /q > nul
if not exist %Directory% exit 0
exit 3

Fixed Issues

filter false positives with Google Updater uninstall script

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions