Network Connect API from Unbacked Memory

[rule]
description = """
Identifies attempts to perform a network connection from a suspicious unbacked memory block. This may be the result of
code injection.
"""
id = "720e0265-03bc-4cb7-9116-7fad5ea9cdfc"
license = "Elastic License v2"
name = "Network Connect API from Unbacked Memory"
os_list = ["windows"]
version = "1.0.18"

query = '''
api where process.Ext.api.name == "connect" and process.Ext.api.summary: "*ipv4*" and

 process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
 (
  process.thread.Ext.call_stack_summary :
               ("ntdll.dll|mswsock.dll|ws2_32.dll|Unbacked",
                "ntdll.dll|mswsock.dll|Unbacked",
                "wow64cpu.dll|wow64.dll|ntdll.dll|mswsock.dll|ws2_32.dll|Unbacked",
                "wow64cpu.dll|wow64.dll|ntdll.dll|mswsock.dll|Unbacked") or

  ((process.code_signature.trusted == false or process.code_signature.exists == false) and
   startswith~(process.thread.Ext.call_stack_summary, concat("wow64cpu.dll|wow64.dll|ntdll.dll|mswsock.dll|ws2_32.dll|Unbacked|", process.name))) or

   ((process.code_signature.trusted == false or process.code_signature.exists == false) and
    startswith~(process.thread.Ext.call_stack_summary, concat("ntdll.dll|mswsock.dll|ws2_32.dll|Unbacked", process.name)))
 ) and

 /* trailing bytes are not null */
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and $entry.callsite_trailing_bytes : "?*") and

 /* excluding signed final usermod */
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true) and

 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                  ("02ecce804add1da0a9e7be506f7369d3d5753c51c80abe32b24be05c321c5ff7",
                                   "f823fc285b259fd0a5391a5c807279e90fe5317e6cfd7b00a49f07c278832cbc", 
                                   "236b9ab2b531da7312da1429cba1bd9f45cae4ed46cba1792924013b9919f8cf", 
                                   "5d4708e841bdd2523c963e45932555ba98e203c6a99f242573f251374f73cb63", 
                                   "ff4dd86a9ef8ccedd9a01dee516775eea75edcef0ff313b718df3dc4a026f395",
                                   "0e675101b1814b932f8c1209b5e355636c18767da413a261667ce2bedd3c7914",
                                   "aeda6c3b3b1dc1e91d1cbbea6863eaf5fe02eef74827fe533f4b7d55e388a9b1",
                                   "99f9058c1481370d03a511a8863a9b6e36c34d4f0066b17ad0f6666c86eed152",
                                   "9b1865415f947505eff3084830193d1a6bf317d8e704d401b1a8ffb91a3d9277",
                                   "7f28d5f5d96183ed01c345fdc5d28e82ae255aa19ecb329ab9fa9ecdf10f79de",
                                   "5ec183e4e31a18a7788ffa4514e1e555d458725e4521160221ea36df5e29a35f",
                                   "5d1ace7a28fb13f34a4f56045f41285b2f07764f42e09fc4d5ce72b10ffbed38",
                                   "df13445949901d9f43575ad8fd5005a490e9a2fa68e27e26e6ea6d4014b83635",
                                   "8b354c30a6fccb12963cf2bf06fcf60efcc2bef7e3b735cab36f4b26e8cd105b",
                                   "c809da8be3cad745801f3668df829bddc39e7ffb0c526fe98ada697b60811922",
                                   "b4e067d5b1f09821e7a3b6106547ee23572f64e604ffa29041b8cbc7e63b58a7",
                                   "dcfa8e77235026558f65e6ab82d2b9e69768f023204062f628234b2b5506fd32",
                                   "617b0977d387472a4ca0948f1ba19640a21d1fa1dca52e3047c5e630af231062",
                                   "50f903bc4b496b94051b9cba15eccd9c25bb963c7424f2845fbc0897bd7d391d",
                                   "c094179af7a6a3bfae751fc30ff13b711e055ffa563fc98b3d3b3aa57584a424",
                                   "2fe43a4716927f4600f44bfc7ffa43584fb5bea404ff5624d4bb5efaddec174a",
                                   "bb55748883f650e45921b875a546e0174ff8251d77043d3cab4de60eff7cd9f8",
                                   "f2c8fbd754527f3411c31068975f316970fcb3bb7ba611d5d2f20d17489e6d32",
                                   "c160ce8529cd5131f1c349bc92c5b3e989b0cac7fcbdd1318eb484eb3b4ca49f",
                                   "3d86479ab47b249241e7d392ef5daf2263b341f4a77755ac285c629dfc71f06c",
                                   "bf85b58dada12a821a8ee445a6d7b97b7e984eb4db88a9bcb3e3fa698c88d345",
                                   "a87b3f02042de4d655f72af65ed5242fae5c675bebd19e962978c13e6d99ba00",
                                   "eb70e1f2aad9d66f0ca71b3b57ad6b8c6f7fa623155a589afe82a899f7dd88c4",
                                   "bbff088a88a0a754dc9d312e52ef7e60dd93537d78d73f79c89aa5b5091457fc",
                                   "c817a4c49167176bfa6335b950d629b31ff553e943b9ab835b88f6c2ee09fc82",
                                   "7dd3acf9f47641ce621e4db5980ab8f7a3f67c9a4f008f36b56d59afefbedfa9",
                                   "0be7c1898ca40070ba6807cdc95722a35cbee79fa08399abd714b90a5b5239d5",
                                   "9ce7991f13bf252648ea4766299cb59ab291771937b11a7a7a04df2c540d565d",
                                   "3f74481e6991404f951ff5168c6726a521c566eb408a654d776109afdb963655",
                                   "6e7533220f0715156b9baa401fb13a71735aabfb1443dad6a3835ab8a38750bf",
                                   "7b5e0b0bc2ca257071210ddb787cb18d65621bb7d1034ea946937ca565977bbd",
                                   "c9e303d84e5fa603c85abee0caefa8b0ef393aab6805e2ea5098ca927fa2b6cf",
                                   "6e79c9271cddc0a4bb3e8af619967d54ea6df7067798fd5da9ccca233b221da0",
                                   "fddac9c6330518eb74b92abeee411e91ef3189fb3ed04508a9f3ebd5991fdb30",
                                   "335790ae673d41cc7d4b3c6c1a9c16c7bb3260fc24d4caced80dbe4cfd9a4f6e",
                                   "6f7d83b779e164ddf58c2bff7a719caba1887c6c92dc72fd2eb4e1394fbf51c4",
                                   "26e5c00c35c5c3edc86dfc0a720aed109a13b1b7c67ac654a0ce8ff82a1f2c16",
                                   "fdff5c5612e0bcbc8aba52720e5d37e5c3821267179e2fa7341084148ad4b1ea",
                                   "834b0fce44e8db2367967f8d5262a0dafe45e7c5bd69c98f1a9eeec2136dcbc1",
                                   "7eb92b8b9ce2d44a500c56ea04e805cb78614c572dc723c79c59ca93315ba709",
                                   "3eb37ba3fc39f5749bbb3f17382d0966adf2e061f4f0d1757ebd75fed1302dd6",
                                   "0b29ecbb5277629a1be89193941ec9d58867118ab7ef6a9d0235f7c5388904d7",
                                   "0f4828417f3c8f8c6a5d74c39cb1dc746b241901e8bdd53bb09808858b7b0a08",
                                   "cd08541db31221a2e26238cd6a2bcd6a9ebb9a4c4205c09b1b2050fde409f284",
                                   "f834e4447d0b4c421ac2a0a9b10304a47688f358a6db9c1281bffe44957bcc4e",
                                   "d0615bcbcaf0c64b2613c224924fce9e891a62287acc243a9b142ee0d021b207",
                                   "7c71327ab87990b1ac0446813f2f1e69c33cc634afab5857cfa9fca17d0cc37e",
                                   "ecbd9f72fe48043302f547643b26e2da9c12c4d8030d28e53f1651fb0e06a2ca",
                                   "c11d8f8d419aee8d67166ae9eeed3999364fa41a7d701ede076f2d2ad8acb8be",
                                   "ad71a3681f0fa629133a67f04d64c626d995da07d04322238aa4997a2671735a",
                                   /* Benign .NET / line-of-business self-JIT connect FPs (final user module == app's own image) */
                                   "69ace587844c0aa44ea1dee8940511551e87e8fbb3a932849edce65fd50847d9",
                                   "ed31c93ea887979c30f1f1cce1cc89511d43ba8ee1a773e3222e715983de21b3",
                                   "7b0574df592f2f9bd4aa48c2cd539c2b9de446ad35ccf251febb600c0d60504d",
                                   "b1e85acdf8534d1e212eb718bc4c9a8f4a6f43946ef5848033e760a80b32498d",
                                   "99def4498e85e1d743de4617cbd92f466a4e44cd63bd1903f8dc9188383d510f",
                                   "3a93f916e0d1ace1bb58ca3f43f795a810b63e612c0111a3f6ba89f9200f6a6f",
                                   "05ef99be431f5c9b358d441c16e768935d1985575b17da389e16c86846abf2d3",
                                   "70b2465ae7ea0e4c1305444461d7e288408672dbb7c89dd1fdfb15811f4cf301",
                                   "fef5877c154ea2c659b208c18858f41a02645afd76cd4c4b8c78743c448d2ea0",
                                   "fb281ac7ace96aa7c861c50817129be075ebf324f75ae80325cad09ff7c93fc7",
                                   "7034ceeb12f7424cd823613644f75b4730fd01de2acd34f21eaec5a1b5bf477f",
                                   "bbb81a7eca67cb4c0ea4ca96bcecd6cf6e0ccab0900836fd412ea932056d45c6",
                                   "2b578ecba28f0170ce30d54b394069da0994ff21411567dc30a45b8a480fe00d",
                                   "c779c56ed1a67711518bd6216e0966bc0ec1ab8d7a236645d5861d9d55bb6278",
                                   "920ef6ece9c965246e8386fd45dd85aa799a572d810a03fdac711b0eea6640d9",
                                   "13090ed9a4bbdb2bb1a23f5b21d89d71bbabe474b9556ba62f517e010ed700f7") and

 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and
                  $entry.callsite_trailing_bytes :
                       ("*85f60f95c10fb6c9894dac488bcce82f000000908b45*",
                        "*8bc641c6470c01488b558849895710488d65c85b5e5f415c41",
                        "c2280090b808001a00ba408f*d2c2240090b809001c00ba408f*",
                        "41c6470c01833d*5e8bc641c6470c01488b558849895710488d65*",
                        "81bbc40000002afb0149742a33c08d55f450ff8d78ffffff6a0252e8e27c100083c408588b955cffffff64891500000000e96703000085c00f842d020000e89f",
                        "8bd8488d8d28ffffffff15f40a04009033c0488945b033c0488945b8ff15591304008bc8ff154113040085db0f95c30fb6db807dc000740e488b4d184c8d1de0",
                        "488b9550ffffffc6420c01833d3efbd15f007406ff150a18d15f89855cffffffe8a7f4535f908b8d5cffffff898d70ffffff83bd70ffffff000f95c10fb6c989",
                        "41c6470c01833dd1b6055c007406ff15310a055c488b8d70ffffff49894f108bd833c0488945b033c0488945b848b850652addfd7f0000ffd08bc8e87dcaa15b",
                        "41c6470c01833dc8c42649007406ff1540d026498bf0e8a11a8d488bc641c6470c01488b558849895710488d65c85b5e5f415c415d415e415f5dc30019130a00")) and

 not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Unknown", "Kernel", "Kernel|*", "*.ni.dll", "coreclr.dll", "Undetermined", "hmpalert.dll", "em003_64.dll") and

 not process.executable : ("C:\\Program Files\\Veeam\\Backup and Replication\\Backup\\Veeam.Backup.Service.exe",
                           "C:\\Program Files\\Citrix\\Broker\\Service\\BrokerService.exe",
                           "C:\\Program Files\\Qlik\\Sense\\ServiceDispatcher\\dotnet\\dotnet.exe",
                           "C:\\Program Files\\Solari di Udine\\Inout Integration Service\\INOUT.Integration.Service.exe",
                           "C:\\Program Files\\Intel\\SUR\\QUEENCREEK\\SurSvc.exe",
                           "C:\\Program Files (x86)\\AdRem\\NetCrunch\\Console\\*\\NCConsole.exe",
                           "C:\\Program Files\\Epic Games\\MarvelRivalsjKtnW\\MarvelGame\\Marvel\\Binaries\\Win64\\Marvel-Win64-Shipping.exe",
                           "C:\\Program Files\\winacme\\wacs.exe") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance == "inprocessclient64.dll"
'''

min_endpoint_version = "8.14.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"

[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.14.0"