Asynchronous Procedure Call from Unusual Module

[rule]
description = """
Identifies attempts to queue an Asynchronous Procedure Call (APC) to a remote process. This may indicate a remote code
injection attack.
"""
id = "300195cb-5d38-4375-ab59-0110c8a486d9"
license = "Elastic License v2"
name = "Asynchronous Procedure Call from Unusual Module"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/doubling-down-etw-callstacks",
    "https://www.ired.team/offensive-security/code-injection-process-injection/apc-queue-code-injection",
]
version = "1.0.4"

query = '''
api where process.pid != 4 and process.Ext.api.name in ("NtQueueApcThread", "QueueUserAPC") and
 process.Ext.api.behaviors == "cross-process" and
 process.thread.Ext.call_stack_final_user_module.name != null and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
 not process.thread.Ext.call_stack_final_user_module.name in ("Undetermined", "Kernel", "Unknown") and
 (
  _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) or
  _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.subject_name in ("AutoIt Consulting Ltd", "Python Software Foundation")) or
  (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
   (process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\microsoft.net\\framework*\\clr.dll" or process.thread.Ext.call_stack_final_user_module.protection_provenance == "clr.dll"))
 ) and
 process.Ext.api.summary != "NtQueueApcThread( csrss.exe, basesrv.dll!BaseSrvNlsUpdateRegistryCache, NULL, Data, Data )" and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
                                          "Microsoft Windows Software Compatibility Publisher",
                                          "Mozilla Corporation", "Beijing Qihu Technology Co., Ltd.",
                                          "Symantec Corporation", "Deep Instinct Ltd",
                                          "TPZ SOLUCOES DIGITAIS LTDA",
                                          "Carbon Black, Inc.", 
                                          "MUSARUBRA US LLC")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!NtCreateUserProcess+*",
                                           "c:\\windows\\sys?????\\ntdll.dll!ZwCreateUserProcess*")) and
 not (process.thread.Ext.call_stack_final_user_module.hash.sha256 == "d7d35019ce0c03d97c32ab25a145371806ca2d1572af1e5146ea886d41818850" and
      Target.process.executable : "?:\\Windows\\SysWOW64\\rserver30\\FamItrfc.Exe")
'''

min_endpoint_version = "8.14.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.004"
name = "Asynchronous Procedure Call"
reference = "https://attack.mitre.org/techniques/T1055/004/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"