Signed Binary, Unsigned Behaviour
A developer's Windows 10 laptop trips a Sysmon-based EDR rule. C:\ProgramData\NorthPeak\npagent.exe opened a handle to lsass.exe with GrantedAccess 0x1410 - PROCESS_VM_READ plus full QUERY_INFORMATION, broader than the 0x1010 that AV and backup scanners normally request. Minutes later a WMI permanent event subscription appears, with an __EventFilter named 'Updater' and a CommandLineEventConsumer running an encoded PowerShell command. A service named NorthPeakSvc was created on the host three days ago; npagent.exe is Authenticode-signed and the certificate chain validates. The same agent version is deployed on 60 other workstations, but none of those have the WMI subscription, and on the other 59 the service runs from C:\Program Files\NorthPeak. The user says IT 'pushed something last week'. There is a quarter-end change freeze, and the laptop holds an uncommitted branch of the payment service repository.
1. Is this a genuine but misused vendor binary, a tampered binary, or a masquerade? What do you check to separate those three?
Read the worked answer
Three hypotheses fit, and they have different remedies: the vendor binary is genuine and something else created the persistence; the binary is genuine but tampered or side-loaded; or it is a lookalike carrying a stolen or misissued signature.
Separate them with hashes, not names. Compare the SHA-256 of npagent.exe on this host with the copy on the 59 clean hosts. An identical hash plus a valid chain and a valid signing timestamp means the file itself is not the loader - either another process created the WMI persistence using the agent, or the agent has a vulnerability being abused. A different hash under the same name and path is the tampering case; if the hash differs but the signature still verifies, suspect DLL side-loading rather than a modified EXE, and check for an unsigned DLL sitting beside it.
Then pivot to the persistence. Sysmon EID 19/20/21 or WMI-Activity logs give creation time and the creating process. Record the consumer command line, decode it, and identify the account context - SYSTEM here means full persistent control.
Explain the path anomaly. A genuine MSI does not install to ProgramData by default. Check the uninstall registry key and product code, then verify the deployment against the change record and the software deployment tool's own logs rather than the user's recollection of 'something last week'. If no ticket exists, the benign explanation is gone.
2. Do you isolate the host now, given the developer's uncommitted work and 59 other hosts running the same agent?
Read the worked answer
Yes - contain this host, in a way that preserves evidence and does not touch the other 59.
The decision rests on what the adversary holds. A SYSTEM-level WMI subscription with a CommandLineEventConsumer is durable, complete control of the endpoint, on a corporate network, owned by a developer with repository credentials, on a host that has already shown lsass access. The cost of containment is a few hours of one person's time and a delayed commit. The cost of not containing is domain credential theft.
Order:
- Confirm EDR network containment preserves the management channel - that keeps telemetry, which pulling the cable would not.
- If memory acquisition capability is deployed, capture before killing anything; an encoded PowerShell payload may be memory-only.
- Reset the user's credentials and revoke sessions from a clean machine. Assume every password typed on this host is exposed.
- Remove the WMI subscription only after recording filter name, consumer command, creation time and creating process.
Do not reboot as a fix. The WMI repository is on disk, so the subscription survives a restart, while the reboot destroys the running process, network connections and memory that tell you what executed. Rebooting feels like progress and is the single most expensive mistake available here.
For the other 59: don't isolate them. Compare their npagent.exe hashes and check each for WMI subscriptions of the same name, which is a fast, low-risk sweep.