Delayed Common Language Runtime Load

[rule]
description = """
Identifies a delayed load of the Microsoft Common Language Runtime DLL CLR.dll associated with egress network
connections.
"""
id = "44fa18bd-c484-48f0-84ea-b8fd7d0586aa"
license = "Elastic License v2"
name = "Delayed Common Language Runtime Load"
os_list = ["windows"]
version = "1.0.6"

query = '''
sequence by process.entity_id with maxspan=5s 
 [network where process.pid != 4 and
   event.action in ("disconnect_received", "connection_attempted") and 
   not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
       "FE80::/10", "FF00::/8") and 
    not process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe", "\\Device\\Mup\\*") and
     not (process.code_signature.trusted == true and
          process.code_signature.subject_name : 
                     ("Flexera Software LLC", "Dassault Systemes SolidWorks Corp.", "Adaptive Protocols, Inc.", "SAP SE", "HP Inc.", 
                      "TechSmith Corporation", "FactSet Research Systems Inc.", "Corel Corporation", "Amazon.com Services LLC", "Commvault Systems, Inc.",
                      "ONELAUNCH TECHNOLOGIES INC.", "REFINITIV US LLC", "Corel Corporation", "Environmental Systems Research Institute, Inc.",
                      "Nox Limited", "Therefore Corporation GmbH", "Autodesk, Inc.", "National Instruments Corporation", "Siemens AG",
                      "The Reynolds and Reynolds Company"))
    ]
 [library where dll.name : ("clr.dll", "mscorwks.dll") and process.uptime >= 1 and 
  process.thread.Ext.call_stack_summary : "ntdll.dll|*mscoreei.dll*" and
  not process.thread.Ext.call_stack_summary : 
                           ("*mscoreei.dll|msi*.tmp|msi.dll*", 
                            "*|mscoreei.dll|mscoree.dll*", 
                            "*mscoreei.dll|combase.dll*", 
                            "*pghook.dll|mscoreei.dll|previewview.dll*",
                            "*mscoreei.dll|microsoft.teams.addinloader.dll*",
                            "*mscoreei.dll|vstoloader.dll*",
                            "*mscoreei.dll|onelaunch*.tmp|*",
                            "*mscoreei.dll|utils.dll|gencls.dll*",
                            "*mscoreei.dll|revupreviewhandler.dll*",
                            "*mscoreei.dll|previewview.dll*",
                            "*mscoreei.dll|twuniclitsprintx64.dll|rdclientax.dll*")]
'''

min_endpoint_version = "8.8.0"
optional_actions = []
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"