AMSI Bypass via Unbacked Memory

[rule]
description = """
Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface DLL from unbacked
memory.
"""
id = "06516087-9305-482b-af9a-92f4386d2f19"
license = "Elastic License v2"
name = "AMSI Bypass via Unbacked Memory"
os_list = ["windows"]
reference = [
    "https://aidenpearce369.github.io/offsec/AMSI-Memory-Bypass/",
    "https://modexp.wordpress.com/2019/06/03/disable-amsi-wldp-dotnet/",
]
version = "1.0.9"

query = '''
api where process.Ext.api.summary : "* amsi.dll*" and 
 ((process.Ext.api.name in ("VirtualProtect", "VirtualProtectEx") and process.Ext.api.parameters.protection like "?W*") or
  process.Ext.api.name == "WriteProcessMemory") and
 process.executable != null and process.thread.Ext.call_stack_summary like "?*" and process.thread.Ext.call_stack_final_user_module.name != null and
 process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
 process.thread.Ext.call_stack_final_user_module.protection_provenance != null and 
 not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Kernel", "Kernel|*") and
 not (process.thread.Ext.call_stack_summary == "Unbacked" and process.thread.Ext.call_stack_final_user_module.protection_provenance == "Unbacked") and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != "07e82c4bc4f48e94a634480ff5140b94b2026a7716473867806355957dc4d291" and
 not process.parent.executable : "C:\\Program Files (x86)\\Steam\\steamapps\\common\\BattleBit Remastered\\EasyAntiCheat.exe" and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher", "Microsoft Windows Software Compatibility Publisher")) and
 not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework\\*\\ngen.exe" and
      process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|protector32.dll")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"