API via Callback from a Suspicious Stack

[rule]
description = """
Identifies the call of Memory Windows APIs indirectly via a callback function. This may be the result of an evasion
attempt to hide the origin of the API call from the call stack such as unbacked memory region.
"""
id = "8154cddf-423f-4600-b20e-3ec55d972c7a"
license = "Elastic License v2"
name = " API via Callback from a Suspicious Stack"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/doubling-down-etw-callstacks",
    "https://klezvirus.github.io/posts/Callback-Hell/",
]
version = "1.0.1"

query = '''
api where
 process.Ext.api.name in ("VirtualProtect", "VirtualAlloc", "WriteProcessMemory", "VirtualProtectEx", "VirtualAllocEx", "SuspendThread") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "C:\\Windows\\System32\\ntdll.dll!TpCallbackIndependent*") and
  process.thread.Ext.call_stack_summary like ("ntdll.dll|kernelbase.dll|*|ntdll.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                              "ntdll.dll|kernelbase.dll|*|gdi32full.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                              "ntdll.dll|kernelbase.dll|*|gdi32full.dll|user32.dll|ntdll.dll|kernel32.dll|ntdll.dll")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"