Network Connection Initiated By IMEWDBLD.EXE
Last updated on:
In this page
Rule name | Rule type | Log sources | MITRE ATT&CK tags | Severity |
Network Connection Initiated By IMEWDBLD.EXE | Standard | Windows | Command and Control: Ingress Tool Transfer (T1105) | Trouble |
About the rule
Rule Type
Standard
Rule Description
IMEWDBLD.EXE is an executable associated with Input Method Editors (IME) related to Microsoft IME Dictionary Updates for East Asian languages. Network connection initiated by IMEWDBLD.EXE is a instance where outbound network connection is triggered to connect to command and control servers and abuse via living-off-the-land binaries (LOLBIN) and by downloading other malicious payloads.
Severity
Trouble
Rule journey
Attack chain scenario
Initial access (RDP) → Execution (malicious DLL) → Defense Evasion (Through LOLBIN) → Command and control → Impact
Impact
- Leveraging signed LOLBIN, attackers evade the detection mechanism.
- Through IMEWDBLD.EXE attackers tries to establish communication with C2 server
- Data exfiltration is achieved
Rule Requirement
Prerequisites
- Download and install Sysmon from Microsoft Sysinternals. Then, open a Command prompt with administrator privileges and create a Sysmon configuration which monitors the network connection using -
sysmon.exe -i [configfile.xml].
- Add network connection events to monitor in your configuration file using -
<Sysmon>
<EventFiltering>
<NetworkConnect onmatch="exclude"/>
<!-- This captures all network connection events -->
</EventFiltering>
</Sysmon>
- Create a new registry key "Microsoft-Windows-Sysmon/Network" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\".
- Allocate the registry value of Max Size to 200MB to ensure adequate storage for network logs, as they tend to be high volume.
Criteria
Action1: actionname = "sa_network_connection" AND IS_INITIATED = "true" AND PROCESSNAME endswith "\IMEWDBLD.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.PROCESSNAME,Action1.DESTINATIONHOST,Action1.DESTINATION_IPV6,Action1.DEST_IP,Action1.SOURCEHOST,Action1.SOURCE_IP,Action1.SOURCE_IPV6
Detection
Execution Mode
realtime
Log Sources
Windows
MITRE ATT&CK
Command and Control: Ingress Tool Transfer (T1105)
Security Standards
Enabling this rule will help you meet the security standard's requirement listed below:
PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected.
This security framework ensures the organization to secure the data against unauthorized access, alteration, or transmission. Encryption techniques (SSL or TLS), using data integrity measures, documenting network traffic are a few preventive measures for data leak.
DE.CM-01: Networks and network services are monitored to find potentially adverse events.
Security administrators have to continuously monitor all the network and its services in real-time using SIEM tools and identify the unusual behavior during the connection initiated to LocalToNet tunneling services. Enforce the policies on the web traffic to ensure the network security.
DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events.
Monitoring user activities and interactions with systems to track actions like logins, file access, or use of sensitive systems to identify suspicious behavior. By analyzing and correlating activity patterns in real time, it would lead to quickly detect anomalies and potential threats.
PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Security administrators ensure to draft and implement strict privilege permission for critical operations of certification and its processes. Leverage IAM and SIEM solutions to ensure access permission and authorizations and regular auditing practices.
Author
frack113
Future actions
Known False Positives
Security researchers or automated malware analysis sandboxes may purposely execute IMEWDBLD.EXE with network arguments as part of testing or behavioral analysis, creating network traffic flagged by monitoring tools. This activity is safe when performed in controlled, isolated lab environments.
Next Steps
When this rule is triggered, the following measures can be implemented:
- Identification: Identify the event and check if the flagged incident is new or the existing one.
- Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
- Response: Respond promptly by initiating an automated workflow to interrupt the network connections and kill or terminate the malicious process.
- Reconfiguration: Update the network policies and port configurations and continuously monitor traffic trends in the network.
Mitigation
Mitigation ID | Mitigation Name | Mitigation description |
M1031 | This mitigation technique uses intrusion signatures to block traffic for a particular malware at the network endpoints. Often, these signatures like are different for different malware, and adversaries are likely to change its tools and control signatures over time in such a way to avoid detection by common defensive tools. |
