Create proc_creation_win_lolbin_agentexecutor.yml

[memory-shards]

Proposed rule for Windows lolbin AgentExecutor that doesn't have much coverage. Rule created as final project for Detection Engineering with Sigma course with @defensivedepth

[frack113]

Hello, it is yaml do not use tab but space. The fisrt line must be title.

[memory-shards]

Hello, sorry for those two errors. Fixed.

[nasbench]

I've taken a look at agent executor a little bit and it seems we need access to intune or the binary itself to be able to improve the rule as there are a couple more flags that seem interesting and we need to filter out the legitimate process that launches it from intune.

[nasbench]

Hi,

I've reversed the binary and reworked the rules. Added some new flags I found that could enable execution.

There is the executeWinGet param that seems that could be used to install packages via Winget. This could be interesting but haven't looked at it in-depth yet. There is also the -detect flag that expects some kind of Base64 input. (Maybe a task for a future me or someone interested in finding new LOLBINs)

Here is the hash for the AgentExecutor I looked at 55acc88ee71eaddc9052251e500de0cdbe32582785fc797d8e6bc8025f720d49