API Call from a Suspicious Stack

[rule]
description = """
Identifies the call to some Windows APIs from an unusual call stack. This may be the result of an evasion attempt to
hide the origin of the API call from the call stack such as unbacked memory region.
"""
id = "1089f634-35bd-4877-a638-01e42cb47ae2"
license = "Elastic License v2"
name = "API Call from a Suspicious Stack"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.1"

query = '''
api where process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory", "ResumeThread") and
  process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|kernel32.dll|ntdll.dll" and
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like
                                                                                ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*",
                                                                                 "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*",
                                                                                 "c:\\windows\\sys?????\\kernelbase.dll+0x*",
                                                                                 "c:\\windows\\sys?????\\ntdll.dll+0x*",
                                                                                 "c:\\windows\\sys?????\\kernelbase.dll!MsixIsSystemPackageByPackageFullName*"))
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"