Detection rules › Elastic
Direct Syscall from Unsigned Module
Identifies the call of commonly abused Windows APIs to perform code injection and where the call stack not starting with Windows NT syscall DLLs such as ntdll and win32u. This may indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Rule body
[rule]
description = """
Identifies the call of commonly abused Windows APIs to perform code injection and where the call stack not starting with
Windows NT syscall DLLs such as ntdll and win32u. This may indicate the use of direct system calls to evade endpoint
security solutions hooking Windows APIs.
"""
id = "fe44381a-435c-4e19-ad89-40ac3750f514"
license = "Elastic License v2"
name = "Direct Syscall from Unsigned Module"
os_list = ["windows"]
reference = [
"https://www.elastic.co/security-labs/doubling-down-etw-callstacks",
"https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs",
]
version = "1.0.26"
query = '''
api where process.Ext.api.behaviors == "direct_syscall" and
process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "MapViewOfFile", "MapViewOfFile2") and
not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.status like ("trusted", "errorCode_endpoint*")) and
startswith(process.thread.Ext.call_stack_summary, process.thread.Ext.call_stack_final_user_module.name) and
not process.thread.Ext.call_stack_final_user_module.path like "?:\\windows\\assembly\\nativeimages_*" and
process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
process.thread.Ext.call_stack_final_user_module.protection_provenance != "Kernel" and
not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
("f0d37ab8636685fdf3c81f2f1df5fb0a2cdba6e6daf10200c250a31a822f0f10",
"8f7b60cb0dc32277e6e99ebfee047d5a587050a1fcd5c2f98be7204898d7b25d",
"dc1abae9fce7e192232a5be12c6096338529b327ad749e310e7375106e013579",
"f0d37ab8636685fdf3c81f2f1df5fb0a2cdba6e6daf10200c250a31a822f0f10",
"8f7b60cb0dc32277e6e99ebfee047d5a587050a1fcd5c2f98be7204898d7b25d",
"f1f2ab4ee6f0350d6db84a9983f5c734ef32958c848a472931f03ff733b5a5e7",
"99d836285aa612c98765ac6a538aa3ed74bf435b157311c65577949d794eac8b",
"f7fc4fbdd1706f443868047def63c1e9a746a0be2fac0577ce197e84c8b0a3ce",
"2e6febc71362a72e7bed50c8ffbbaef70f3b8ea542a309b9bf32b337b534e0b4",
"ca1b969a9ba62164ddb7fc5d315b0b82d8506238b15bbd7dd88857ef6acd367a",
"2a44a8af200c4ee36de4b0f91471ffca82ce25e0fe90401d64a9d4c01b9f9525",
"a14fd3fd3bd83ac7789295978bc2bfeed80657cc0298b8314dbb02ee19ca73fd",
"6dbf510f4f0ced77341146b24a9b0c320b516ade2248defa09931ea413f8b20e",
"abfa585a5358e658bd92d159e9f846b2950c7e300c47392283443a1bcb70fd52",
"a62ceea27ff8a0dcc0432fd171f8549d38f69e7233415cfe446305aa9e553970",
"d2a55e2d77369b71f90f8840c6b7d0a2739981283e6d77a3350a80de21125b3f",
"dc55eebfbddaee583a29f17610ef15397b97d37d7d4027d2060d6e88c4eb1182",
"bee2f0a5e13b857d749232273e7c45d597fb858bf0f0a72c793e1c37237675aa",
"6cfc98d1ffcdb983e64beac75ccde7d873e3c41fffde2f4d87dd0757eb5a620d",
"155954174a6fa52ec64ca44e4d77f387e7c9f363541c81a4a7812d9c783af3ca",
"8e619459168a1edc8de86d29cb557388d89cdebefae1d001ba394079a7622511",
"5f51051b50e1d9bb9c47089d5774ff3e491be45eeaf40cba7fd86c5d4fa8635d",
"d5693df142632f807bd5707cb5ee58e9edaaa3a40e84cd5c070ec63412820af9",
"f06bc48095cd11e51714d08b8889c32a058282fdb90487ada823a6550089df96",
"aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559",
"79364f3e140abd46d8d1bedd21db9646ab55cf35783ef7926a235fa7e1fe6797",
"c56440ab3d623249aabaec871a5da8eccb61dc6a0b3166c972d8c86e7d646ef4",
"ea71387e40682bcc23f676df2b856dca15853aeb854b94168c85bc0479ef1aed",
"ae8a5d43dfc2e8bac34a415449fa67b300cdf9e2995b0e8ec38cd8d0694da7ae",
"3034311292fade8a24ab8e7312cfb7132153c14b9383439b527e8296fe06a492",
"51855557b6215ae93482598f5de7e4875a8612d1a2645893905f0c35d321fd73",
"19b7261bb6162e32eaaf7727d2f77b4647d95ff7554300726e2649ffa99b6eec",
"79b62fd3ed24ca4778dc0261c7570e71f3d0c83913c38f58ab1660dc7a670aee",
"ce0f4cd9d9af178aead83df4f46146f1c66cc2c3e600c8aafa0a392fc5ad9637",
"c572cbc2269ef4adca064f23edd04bbd360fb0e8de40abe90c2be35265fffd3f",
"9a2678818bdc614eab85cddb993daa4c783cd36d8c3eda95c2506a7e6e24698b",
"d0fe1eecad868460c162fd40cacf2ac954008b2de1234b2d1cd3b1e361f5e6c0",
"5c55fe4218757fea3012295b8284e967852f4df0c622b173dbdb51012edeeee0",
"4ae78c687615e7dc4c268d3eee519a19aa581e701b7e46e4bc7ee79501e83ad5",
"ecce95f1b2383a852c1b2226970453494c5bf315c2e0b2adda7e3142e028791e",
"545a3aec876c49c56693f48f5fde740487330ca097775d9a434157aabf25db10",
"a543689f34083f810e0184ec77d8ee9e57d44ebd6212af444853a3a89a3c82c0",
"5a8ae397c178fe9397a41b71b2046ded55feb409fadc30f4053194802f5c2dcd",
"60feb037f14dcc3d1f9adfc35647633cab48a652221b8e2e3c5d68b4313d7d0a",
"03c77f2408290a5b734a86d6a1bfc97739e2f54f165ae333c4eddb380e0adef7",
"d01b8dc8fbf8139a8b0c59a038c7ca755a87630ed242c306fb2b53985e545685",
"ea5f2055397fc76db031de944b10a27a6a7975713f2902df3a3970b65e271b4f",
"d01b8dc8fbf8139a8b0c59a038c7ca755a87630ed242c306fb2b53985e545685",
"ec5e3f367dc8663405dd3f3549e8b8d65d772b148e1e6d7d17ea4fdf5a95195c",
"7024db838ba2d2abb1ff1f96a91b0359cbc7f56d4acfc6c8d851d70fa8b49a1c",
"1bb34f11b79fad256ca2e72ea7bcc618815632d585538e1e601c7fc5512ba72d",
"b72a06025452c94223100a34efacddf3d81cf57f3941fa1f2a6dce66b9b54d5b",
"9c1b56c021a7fdf1d1aa008834499046227ace6f6c7d976ef89d27a84858fdb0",
"0743c51969f7d6eb123a60a8ae9e2451bbd0859b89a57c93cbf9c6e904d6defc",
"bc0715826ce01c4782065a28eaef6547dc60cd60b6069ef76e5a26635e510256",
"6e0f6c689e9b80c69445b574e705f79044c5fd148b9912c79f1381e96fe6edcb",
"c717ae53f81fbb66d2554e3c65c295cb2c98e9c817df9c0cdd378d92b5471d5c",
"50e219e52377465a403da3e1275c10579b3042bfbd03ae383648a81b53b4586e",
"58ac11fdd8de211df2a12d1dc8dafcab56ffdbcec0d0f41b4125de191b4f2180",
"1ba0f1f7aef9c790ad3e431b0850a51da6348e3a65c8620997f737b43215547b",
"94e333beccbc0d7199d0a9bf13922ef8f388e1d7f7e055ad8ec8ca6160b50067",
"3613fc46eab116864d28b7a3af1b7301fc0309bf3ba99c661a8c36ad5c848d02",
"98a27a37c5dbe1e115a0f43d2f0cc8afd332e3e5fb5e4c37e09e83e35dc8efb3",
"56b848c3c125a2a666b13e22ba75df2b3609632d5989bc57a8d5566924829373",
"dfc43850daabf4fec146d04a4c62b3a8679639d2cfa399d005e9fdd5387c2fac",
"2a373bf09a7f1d8abf1dafc50df8dadc073b9a9ec1283efcfc42fd5d66f2c57d",
"72c9da48314a77642d5505d019f454fd32f0933ed8a056fb9c9a18818eb4a6f5",
"e540127862940234446ef7a919f7295a52e751e14f184e779a8b4b2dffb78978",
"f9674626d17346629508557918209728fc2a571aeed62201887281aa992758e8",
"f80c57719e52bbbd9d10aaabf9e30db7b76fabd5d0cb73f2a78b96d5613befc4",
"4706af5ee53476bc4701b81aff0f5f655aea433f1de39365bef271b24a29cd85",
"6fd1551bc0b7b588dabe1865a7a333a4987c552f4aa05b30cb92fbb33c03603e",
"a32c3fbbf74699a10e7642bf4901191f29c88c5aec93ae7ba28c79ab28462a69",
"30a7ee75311049b34c6240646cc01235fd9860b98c73c267ae7ffc4350aa0825",
"7e562fc41c9e36fbe0b06339e57cb842354a61b6c21bd975eb56ad550615a5f6",
"7a96d50d91310903f591478e7d1513be5689f1ecf59fe752fbaa6cb4ba8820ce",
"ae885757debdc97de2498d84cfb0b7f05e6af00ec14030b1fe678276518f56b0",
"1b5d9cec668335295c8e575bcedf4afcedbc445d8ccf8374c9380188965e78e3",
"f6391baaf220428eab56c30d45d53fc76e651c1b2e66f2908a312526a1e45331",
"79b73fa504fdc7c41be70f74c6ded66e12f271d3bb8afb5c1c94a6eb4514f0cf",
"1c2cf78885c0487e28fdcd201dca52a6dbded5eeb108e4638ddc867fac473e37",
"b1ce6d1ccf9f48f3ff3f45d94e088fc2fc964e55ee8f97c08c1c1adfb9c9328e",
"e4edc03903a3463425bf570ca35f66f2acbb8ba8b9c1757adb4a9e6f0a070f45",
"701d795207cfc31e2ace3823d9793edf3f8a5d1521acb64bb26f7e25c2871599",
"e825c36285a43e15aa5bbf270ff12a3323bb444d173621ab8158d05808bdaaf0",
"a6d3a9ae1527b586691d2d3b678279385e434beea0afa114b0a06e64a7f2148d",
"26234e9692dc1a048d143518306f83a4192a260b5b884aeef28478e40d209239",
"669ee31e18f1901098d0b296e0ebbe38b5602bf4c17000dda9409aa5bd64133a",
"499b68eb465d06a2b23c2da325786e15d721c3a0d7a32ce6f57305886cfb09d8",
"22121600323bc22f24944a97e0ea4b8b2250b9541f0505c1f1569ac8e585659f",
"5b4f622cb9b451a6427fc9caebecd7662ec14af325697c4619ec61b7117d6273",
"da7dfd4b7df4f2813428306649b10d1f2d6d71c1d43c5cfffe880101d62d7b08",
"7920398ba4c6a03a55c394145444fc5d475301fb5393e96a2b1667a9bbda1ac5",
"17a410b194cecfc6b771c14679944fc58911d528c2a7946a480e2ce3bc6e8bcf",
"549d3a52cd9b25d24fc547f25a9e6615501a18142baa362199f4f82577a48edf",
"018de92d5333ec58cc4620f1a7e0212b8883fe61b1af06af5d741b665d65b6ff",
"25db6d97dcec8e306149c19b9dd7e3f4818a58b57b6a9f192bd7529123bc4f24",
"76fcb15956144d5477d4636ee09ce3db64597c7ccdf840163862fa837534bdd1",
"2898c1471434df740f2ac0d561c5f4c17d1b8fc5ec17cd1e267afed6eadb9ff7") and
not (process.Ext.api.name == "VirtualProtect" and process.Ext.api.metadata.target_address_name == "terminal64.exe" and
process.thread.Ext.call_stack_final_user_module.name == "terminal64.exe") and
not (process.Ext.api.name == "VirtualProtect" and process.thread.Ext.call_stack_summary == "Unbacked") and
not (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
(process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\assembly\\nativeimages_*.ni.dll" or
process.thread.Ext.call_stack_final_user_module.protection_provenance == "system.transactions.ni.dll"))
'''
min_endpoint_version = "8.14.2"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.14.2"
Stages and Predicates
Stage 1: api
api where process.Ext.api.behaviors == "direct_syscall" and
process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "MapViewOfFile", "MapViewOfFile2") and
not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.status like ("trusted", "errorCode_endpoint*")) and
startswith(process.thread.Ext.call_stack_summary, process.thread.Ext.call_stack_final_user_module.name) and
not process.thread.Ext.call_stack_final_user_module.path like "?:\\windows\\assembly\\nativeimages_*" and
process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
process.thread.Ext.call_stack_final_user_module.protection_provenance != "Kernel" and
not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
("f0d37ab8636685fdf3c81f2f1df5fb0a2cdba6e6daf10200c250a31a822f0f10",
"8f7b60cb0dc32277e6e99ebfee047d5a587050a1fcd5c2f98be7204898d7b25d",
"dc1abae9fce7e192232a5be12c6096338529b327ad749e310e7375106e013579",
"f0d37ab8636685fdf3c81f2f1df5fb0a2cdba6e6daf10200c250a31a822f0f10",
"8f7b60cb0dc32277e6e99ebfee047d5a587050a1fcd5c2f98be7204898d7b25d",
"f1f2ab4ee6f0350d6db84a9983f5c734ef32958c848a472931f03ff733b5a5e7",
"99d836285aa612c98765ac6a538aa3ed74bf435b157311c65577949d794eac8b",
"f7fc4fbdd1706f443868047def63c1e9a746a0be2fac0577ce197e84c8b0a3ce",
"2e6febc71362a72e7bed50c8ffbbaef70f3b8ea542a309b9bf32b337b534e0b4",
"ca1b969a9ba62164ddb7fc5d315b0b82d8506238b15bbd7dd88857ef6acd367a",
"2a44a8af200c4ee36de4b0f91471ffca82ce25e0fe90401d64a9d4c01b9f9525",
"a14fd3fd3bd83ac7789295978bc2bfeed80657cc0298b8314dbb02ee19ca73fd",
"6dbf510f4f0ced77341146b24a9b0c320b516ade2248defa09931ea413f8b20e",
"abfa585a5358e658bd92d159e9f846b2950c7e300c47392283443a1bcb70fd52",
"a62ceea27ff8a0dcc0432fd171f8549d38f69e7233415cfe446305aa9e553970",
"d2a55e2d77369b71f90f8840c6b7d0a2739981283e6d77a3350a80de21125b3f",
"dc55eebfbddaee583a29f17610ef15397b97d37d7d4027d2060d6e88c4eb1182",
"bee2f0a5e13b857d749232273e7c45d597fb858bf0f0a72c793e1c37237675aa",
"6cfc98d1ffcdb983e64beac75ccde7d873e3c41fffde2f4d87dd0757eb5a620d",
"155954174a6fa52ec64ca44e4d77f387e7c9f363541c81a4a7812d9c783af3ca",
"8e619459168a1edc8de86d29cb557388d89cdebefae1d001ba394079a7622511",
"5f51051b50e1d9bb9c47089d5774ff3e491be45eeaf40cba7fd86c5d4fa8635d",
"d5693df142632f807bd5707cb5ee58e9edaaa3a40e84cd5c070ec63412820af9",
"f06bc48095cd11e51714d08b8889c32a058282fdb90487ada823a6550089df96",
"aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559",
"79364f3e140abd46d8d1bedd21db9646ab55cf35783ef7926a235fa7e1fe6797",
"c56440ab3d623249aabaec871a5da8eccb61dc6a0b3166c972d8c86e7d646ef4",
"ea71387e40682bcc23f676df2b856dca15853aeb854b94168c85bc0479ef1aed",
"ae8a5d43dfc2e8bac34a415449fa67b300cdf9e2995b0e8ec38cd8d0694da7ae",
"3034311292fade8a24ab8e7312cfb7132153c14b9383439b527e8296fe06a492",
"51855557b6215ae93482598f5de7e4875a8612d1a2645893905f0c35d321fd73",
"19b7261bb6162e32eaaf7727d2f77b4647d95ff7554300726e2649ffa99b6eec",
"79b62fd3ed24ca4778dc0261c7570e71f3d0c83913c38f58ab1660dc7a670aee",
"ce0f4cd9d9af178aead83df4f46146f1c66cc2c3e600c8aafa0a392fc5ad9637",
"c572cbc2269ef4adca064f23edd04bbd360fb0e8de40abe90c2be35265fffd3f",
"9a2678818bdc614eab85cddb993daa4c783cd36d8c3eda95c2506a7e6e24698b",
"d0fe1eecad868460c162fd40cacf2ac954008b2de1234b2d1cd3b1e361f5e6c0",
"5c55fe4218757fea3012295b8284e967852f4df0c622b173dbdb51012edeeee0",
"4ae78c687615e7dc4c268d3eee519a19aa581e701b7e46e4bc7ee79501e83ad5",
"ecce95f1b2383a852c1b2226970453494c5bf315c2e0b2adda7e3142e028791e",
"545a3aec876c49c56693f48f5fde740487330ca097775d9a434157aabf25db10",
"a543689f34083f810e0184ec77d8ee9e57d44ebd6212af444853a3a89a3c82c0",
"5a8ae397c178fe9397a41b71b2046ded55feb409fadc30f4053194802f5c2dcd",
"60feb037f14dcc3d1f9adfc35647633cab48a652221b8e2e3c5d68b4313d7d0a",
"03c77f2408290a5b734a86d6a1bfc97739e2f54f165ae333c4eddb380e0adef7",
"d01b8dc8fbf8139a8b0c59a038c7ca755a87630ed242c306fb2b53985e545685",
"ea5f2055397fc76db031de944b10a27a6a7975713f2902df3a3970b65e271b4f",
"d01b8dc8fbf8139a8b0c59a038c7ca755a87630ed242c306fb2b53985e545685",
"ec5e3f367dc8663405dd3f3549e8b8d65d772b148e1e6d7d17ea4fdf5a95195c",
"7024db838ba2d2abb1ff1f96a91b0359cbc7f56d4acfc6c8d851d70fa8b49a1c",
"1bb34f11b79fad256ca2e72ea7bcc618815632d585538e1e601c7fc5512ba72d",
"b72a06025452c94223100a34efacddf3d81cf57f3941fa1f2a6dce66b9b54d5b",
"9c1b56c021a7fdf1d1aa008834499046227ace6f6c7d976ef89d27a84858fdb0",
"0743c51969f7d6eb123a60a8ae9e2451bbd0859b89a57c93cbf9c6e904d6defc",
"bc0715826ce01c4782065a28eaef6547dc60cd60b6069ef76e5a26635e510256",
"6e0f6c689e9b80c69445b574e705f79044c5fd148b9912c79f1381e96fe6edcb",
"c717ae53f81fbb66d2554e3c65c295cb2c98e9c817df9c0cdd378d92b5471d5c",
"50e219e52377465a403da3e1275c10579b3042bfbd03ae383648a81b53b4586e",
"58ac11fdd8de211df2a12d1dc8dafcab56ffdbcec0d0f41b4125de191b4f2180",
"1ba0f1f7aef9c790ad3e431b0850a51da6348e3a65c8620997f737b43215547b",
"94e333beccbc0d7199d0a9bf13922ef8f388e1d7f7e055ad8ec8ca6160b50067",
"3613fc46eab116864d28b7a3af1b7301fc0309bf3ba99c661a8c36ad5c848d02",
"98a27a37c5dbe1e115a0f43d2f0cc8afd332e3e5fb5e4c37e09e83e35dc8efb3",
"56b848c3c125a2a666b13e22ba75df2b3609632d5989bc57a8d5566924829373",
"dfc43850daabf4fec146d04a4c62b3a8679639d2cfa399d005e9fdd5387c2fac",
"2a373bf09a7f1d8abf1dafc50df8dadc073b9a9ec1283efcfc42fd5d66f2c57d",
"72c9da48314a77642d5505d019f454fd32f0933ed8a056fb9c9a18818eb4a6f5",
"e540127862940234446ef7a919f7295a52e751e14f184e779a8b4b2dffb78978",
"f9674626d17346629508557918209728fc2a571aeed62201887281aa992758e8",
"f80c57719e52bbbd9d10aaabf9e30db7b76fabd5d0cb73f2a78b96d5613befc4",
"4706af5ee53476bc4701b81aff0f5f655aea433f1de39365bef271b24a29cd85",
"6fd1551bc0b7b588dabe1865a7a333a4987c552f4aa05b30cb92fbb33c03603e",
"a32c3fbbf74699a10e7642bf4901191f29c88c5aec93ae7ba28c79ab28462a69",
"30a7ee75311049b34c6240646cc01235fd9860b98c73c267ae7ffc4350aa0825",
"7e562fc41c9e36fbe0b06339e57cb842354a61b6c21bd975eb56ad550615a5f6",
"7a96d50d91310903f591478e7d1513be5689f1ecf59fe752fbaa6cb4ba8820ce",
"ae885757debdc97de2498d84cfb0b7f05e6af00ec14030b1fe678276518f56b0",
"1b5d9cec668335295c8e575bcedf4afcedbc445d8ccf8374c9380188965e78e3",
"f6391baaf220428eab56c30d45d53fc76e651c1b2e66f2908a312526a1e45331",
"79b73fa504fdc7c41be70f74c6ded66e12f271d3bb8afb5c1c94a6eb4514f0cf",
"1c2cf78885c0487e28fdcd201dca52a6dbded5eeb108e4638ddc867fac473e37",
"b1ce6d1ccf9f48f3ff3f45d94e088fc2fc964e55ee8f97c08c1c1adfb9c9328e",
"e4edc03903a3463425bf570ca35f66f2acbb8ba8b9c1757adb4a9e6f0a070f45",
"701d795207cfc31e2ace3823d9793edf3f8a5d1521acb64bb26f7e25c2871599",
"e825c36285a43e15aa5bbf270ff12a3323bb444d173621ab8158d05808bdaaf0",
"a6d3a9ae1527b586691d2d3b678279385e434beea0afa114b0a06e64a7f2148d",
"26234e9692dc1a048d143518306f83a4192a260b5b884aeef28478e40d209239",
"669ee31e18f1901098d0b296e0ebbe38b5602bf4c17000dda9409aa5bd64133a",
"499b68eb465d06a2b23c2da325786e15d721c3a0d7a32ce6f57305886cfb09d8",
"22121600323bc22f24944a97e0ea4b8b2250b9541f0505c1f1569ac8e585659f",
"5b4f622cb9b451a6427fc9caebecd7662ec14af325697c4619ec61b7117d6273",
"da7dfd4b7df4f2813428306649b10d1f2d6d71c1d43c5cfffe880101d62d7b08",
"7920398ba4c6a03a55c394145444fc5d475301fb5393e96a2b1667a9bbda1ac5",
"17a410b194cecfc6b771c14679944fc58911d528c2a7946a480e2ce3bc6e8bcf",
"549d3a52cd9b25d24fc547f25a9e6615501a18142baa362199f4f82577a48edf",
"018de92d5333ec58cc4620f1a7e0212b8883fe61b1af06af5d741b665d65b6ff",
"25db6d97dcec8e306149c19b9dd7e3f4818a58b57b6a9f192bd7529123bc4f24",
"76fcb15956144d5477d4636ee09ce3db64597c7ccdf840163862fa837534bdd1",
"2898c1471434df740f2ac0d561c5f4c17d1b8fc5ec17cd1e267afed6eadb9ff7") and
not (process.Ext.api.name == "VirtualProtect" and process.Ext.api.metadata.target_address_name == "terminal64.exe" and
process.thread.Ext.call_stack_final_user_module.name == "terminal64.exe") and
not (process.Ext.api.name == "VirtualProtect" and process.thread.Ext.call_stack_summary == "Unbacked") and
not (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
(process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\assembly\\nativeimages_*.ni.dll" or
process.thread.Ext.call_stack_final_user_module.protection_provenance == "system.transactions.ni.dll"))
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
process.thread.Ext.call_stack_final_user_module.protection_provenance | eq | system.transactions.ni.dll | excludes:process.thread.Ext.call_stack_final_user_module.protection_provenance field:"process.thread.Ext.call_stack_final_user_module.protection_provenance" value:"system.transactions.ni.dll" |
process.thread.Ext.call_stack_final_user_module.protection_provenance_path | wildcard | c:\windows\assembly\nativeimages_*.ni.dll | excludes:process.thread.Ext.call_stack_final_user_module.protection_provenance_path field:"process.thread.Ext.call_stack_final_user_module.protection_provenance_path" value:"c:\windows\assembly\nativeimages_*.ni.dll" |
process.thread.Ext.call_stack_final_user_module.name | eq | Unbacked | excludes:process.thread.Ext.call_stack_final_user_module.name field:"process.thread.Ext.call_stack_final_user_module.name" value:"Unbacked" |
process.Ext.api.metadata.target_address_name | eq | terminal64.exe | excludes:process.Ext.api.metadata.target_address_name field:"process.Ext.api.metadata.target_address_name" value:"terminal64.exe" |
process.Ext.api.name | eq | VirtualProtect | excludes:process.Ext.api.name field:"process.Ext.api.name" value:"VirtualProtect" |
process.thread.Ext.call_stack_final_user_module.name | eq | terminal64.exe | excludes:process.thread.Ext.call_stack_final_user_module.name field:"process.thread.Ext.call_stack_final_user_module.name" value:"terminal64.exe" |
process.thread.Ext.call_stack_summary | eq | Unbacked | excludes:process.thread.Ext.call_stack_summary field:"process.thread.Ext.call_stack_summary" value:"Unbacked" |
process.thread.Ext.call_stack_final_user_module.code_signature | array_any | excludes:process.thread.Ext.call_stack_final_user_module.code_signature | |
process.thread.Ext.call_stack_final_user_module.hash.sha256 | in | 018de92d5333ec58cc4620f1a7e0212b8883fe61b1af06af5d741b665d65b6ff, 03c77f2408290a5b734a86d6a1bfc97739e2f54f165ae333c4eddb380e0adef7, 0743c51969f7d6eb123a60a8ae9e2451bbd0859b89a57c93cbf9c6e904d6defc, 155954174a6fa52ec64ca44e4d77f387e7c9f363541c81a4a7812d9c783af3ca, 17a410b194cecfc6b771c14679944fc58911d528c2a7946a480e2ce3bc6e8bcf, 19b7261bb6162e32eaaf7727d2f77b4647d95ff7554300726e2649ffa99b6eec, 1b5d9cec668335295c8e575bcedf4afcedbc445d8ccf8374c9380188965e78e3, 1ba0f1f7aef9c790ad3e431b0850a51da6348e3a65c8620997f737b43215547b, 1bb34f11b79fad256ca2e72ea7bcc618815632d585538e1e601c7fc5512ba72d, 1c2cf78885c0487e28fdcd201dca52a6dbded5eeb108e4638ddc867fac473e37, 22121600323bc22f24944a97e0ea4b8b2250b9541f0505c1f1569ac8e585659f, 25db6d97dcec8e306149c19b9dd7e3f4818a58b57b6a9f192bd7529123bc4f24, 26234e9692dc1a048d143518306f83a4192a260b5b884aeef28478e40d209239, 2898c1471434df740f2ac0d561c5f4c17d1b8fc5ec17cd1e267afed6eadb9ff7, 2a373bf09a7f1d8abf1dafc50df8dadc073b9a9ec1283efcfc42fd5d66f2c57d, 2a44a8af200c4ee36de4b0f91471ffca82ce25e0fe90401d64a9d4c01b9f9525, 2e6febc71362a72e7bed50c8ffbbaef70f3b8ea542a309b9bf32b337b534e0b4, 3034311292fade8a24ab8e7312cfb7132153c14b9383439b527e8296fe06a492, 30a7ee75311049b34c6240646cc01235fd9860b98c73c267ae7ffc4350aa0825, 3613fc46eab116864d28b7a3af1b7301fc0309bf3ba99c661a8c36ad5c848d02, 4706af5ee53476bc4701b81aff0f5f655aea433f1de39365bef271b24a29cd85, 499b68eb465d06a2b23c2da325786e15d721c3a0d7a32ce6f57305886cfb09d8, 4ae78c687615e7dc4c268d3eee519a19aa581e701b7e46e4bc7ee79501e83ad5, 50e219e52377465a403da3e1275c10579b3042bfbd03ae383648a81b53b4586e, 51855557b6215ae93482598f5de7e4875a8612d1a2645893905f0c35d321fd73, 545a3aec876c49c56693f48f5fde740487330ca097775d9a434157aabf25db10, 549d3a52cd9b25d24fc547f25a9e6615501a18142baa362199f4f82577a48edf, 56b848c3c125a2a666b13e22ba75df2b3609632d5989bc57a8d5566924829373, 58ac11fdd8de211df2a12d1dc8dafcab56ffdbcec0d0f41b4125de191b4f2180, 5a8ae397c178fe9397a41b71b2046ded55feb409fadc30f4053194802f5c2dcd, 5b4f622cb9b451a6427fc9caebecd7662ec14af325697c4619ec61b7117d6273, 5c55fe4218757fea3012295b8284e967852f4df0c622b173dbdb51012edeeee0, 5f51051b50e1d9bb9c47089d5774ff3e491be45eeaf40cba7fd86c5d4fa8635d, 60feb037f14dcc3d1f9adfc35647633cab48a652221b8e2e3c5d68b4313d7d0a, 669ee31e18f1901098d0b296e0ebbe38b5602bf4c17000dda9409aa5bd64133a, 6cfc98d1ffcdb983e64beac75ccde7d873e3c41fffde2f4d87dd0757eb5a620d, 6dbf510f4f0ced77341146b24a9b0c320b516ade2248defa09931ea413f8b20e, 6e0f6c689e9b80c69445b574e705f79044c5fd148b9912c79f1381e96fe6edcb, 6fd1551bc0b7b588dabe1865a7a333a4987c552f4aa05b30cb92fbb33c03603e, 701d795207cfc31e2ace3823d9793edf3f8a5d1521acb64bb26f7e25c2871599, 7024db838ba2d2abb1ff1f96a91b0359cbc7f56d4acfc6c8d851d70fa8b49a1c, 72c9da48314a77642d5505d019f454fd32f0933ed8a056fb9c9a18818eb4a6f5, 76fcb15956144d5477d4636ee09ce3db64597c7ccdf840163862fa837534bdd1, 7920398ba4c6a03a55c394145444fc5d475301fb5393e96a2b1667a9bbda1ac5, 79364f3e140abd46d8d1bedd21db9646ab55cf35783ef7926a235fa7e1fe6797, 79b62fd3ed24ca4778dc0261c7570e71f3d0c83913c38f58ab1660dc7a670aee, 79b73fa504fdc7c41be70f74c6ded66e12f271d3bb8afb5c1c94a6eb4514f0cf, 7a96d50d91310903f591478e7d1513be5689f1ecf59fe752fbaa6cb4ba8820ce, 7e562fc41c9e36fbe0b06339e57cb842354a61b6c21bd975eb56ad550615a5f6, 8e619459168a1edc8de86d29cb557388d89cdebefae1d001ba394079a7622511, 8f7b60cb0dc32277e6e99ebfee047d5a587050a1fcd5c2f98be7204898d7b25d, 94e333beccbc0d7199d0a9bf13922ef8f388e1d7f7e055ad8ec8ca6160b50067, 98a27a37c5dbe1e115a0f43d2f0cc8afd332e3e5fb5e4c37e09e83e35dc8efb3, 99d836285aa612c98765ac6a538aa3ed74bf435b157311c65577949d794eac8b, 9a2678818bdc614eab85cddb993daa4c783cd36d8c3eda95c2506a7e6e24698b, 9c1b56c021a7fdf1d1aa008834499046227ace6f6c7d976ef89d27a84858fdb0, a14fd3fd3bd83ac7789295978bc2bfeed80657cc0298b8314dbb02ee19ca73fd, a32c3fbbf74699a10e7642bf4901191f29c88c5aec93ae7ba28c79ab28462a69, a543689f34083f810e0184ec77d8ee9e57d44ebd6212af444853a3a89a3c82c0, a62ceea27ff8a0dcc0432fd171f8549d38f69e7233415cfe446305aa9e553970, a6d3a9ae1527b586691d2d3b678279385e434beea0afa114b0a06e64a7f2148d, aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559, abfa585a5358e658bd92d159e9f846b2950c7e300c47392283443a1bcb70fd52, ae885757debdc97de2498d84cfb0b7f05e6af00ec14030b1fe678276518f56b0, ae8a5d43dfc2e8bac34a415449fa67b300cdf9e2995b0e8ec38cd8d0694da7ae, b1ce6d1ccf9f48f3ff3f45d94e088fc2fc964e55ee8f97c08c1c1adfb9c9328e, b72a06025452c94223100a34efacddf3d81cf57f3941fa1f2a6dce66b9b54d5b, bc0715826ce01c4782065a28eaef6547dc60cd60b6069ef76e5a26635e510256, bee2f0a5e13b857d749232273e7c45d597fb858bf0f0a72c793e1c37237675aa, c56440ab3d623249aabaec871a5da8eccb61dc6a0b3166c972d8c86e7d646ef4, c572cbc2269ef4adca064f23edd04bbd360fb0e8de40abe90c2be35265fffd3f, c717ae53f81fbb66d2554e3c65c295cb2c98e9c817df9c0cdd378d92b5471d5c, ca1b969a9ba62164ddb7fc5d315b0b82d8506238b15bbd7dd88857ef6acd367a, ce0f4cd9d9af178aead83df4f46146f1c66cc2c3e600c8aafa0a392fc5ad9637, d01b8dc8fbf8139a8b0c59a038c7ca755a87630ed242c306fb2b53985e545685, d0fe1eecad868460c162fd40cacf2ac954008b2de1234b2d1cd3b1e361f5e6c0, d2a55e2d77369b71f90f8840c6b7d0a2739981283e6d77a3350a80de21125b3f, d5693df142632f807bd5707cb5ee58e9edaaa3a40e84cd5c070ec63412820af9, da7dfd4b7df4f2813428306649b10d1f2d6d71c1d43c5cfffe880101d62d7b08, dc1abae9fce7e192232a5be12c6096338529b327ad749e310e7375106e013579, dc55eebfbddaee583a29f17610ef15397b97d37d7d4027d2060d6e88c4eb1182, dfc43850daabf4fec146d04a4c62b3a8679639d2cfa399d005e9fdd5387c2fac, e4edc03903a3463425bf570ca35f66f2acbb8ba8b9c1757adb4a9e6f0a070f45, e540127862940234446ef7a919f7295a52e751e14f184e779a8b4b2dffb78978, e825c36285a43e15aa5bbf270ff12a3323bb444d173621ab8158d05808bdaaf0, ea5f2055397fc76db031de944b10a27a6a7975713f2902df3a3970b65e271b4f, ea71387e40682bcc23f676df2b856dca15853aeb854b94168c85bc0479ef1aed, ec5e3f367dc8663405dd3f3549e8b8d65d772b148e1e6d7d17ea4fdf5a95195c, ecce95f1b2383a852c1b2226970453494c5bf315c2e0b2adda7e3142e028791e, f06bc48095cd11e51714d08b8889c32a058282fdb90487ada823a6550089df96, f0d37ab8636685fdf3c81f2f1df5fb0a2cdba6e6daf10200c250a31a822f0f10, f1f2ab4ee6f0350d6db84a9983f5c734ef32958c848a472931f03ff733b5a5e7, f6391baaf220428eab56c30d45d53fc76e651c1b2e66f2908a312526a1e45331, f7fc4fbdd1706f443868047def63c1e9a746a0be2fac0577ce197e84c8b0a3ce, f80c57719e52bbbd9d10aaabf9e30db7b76fabd5d0cb73f2a78b96d5613befc4, f9674626d17346629508557918209728fc2a571aeed62201887281aa992758e8 | excludes:process.thread.Ext.call_stack_final_user_module.hash.sha256 |
process.thread.Ext.call_stack_final_user_module.path | starts_with | ?:\windows\assembly\nativeimages_ | excludes:process.thread.Ext.call_stack_final_user_module.path field:"process.thread.Ext.call_stack_final_user_module.path" value:"?:\windows\assembly\nativeimages_" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
process.Ext.api.behaviors | eq |
| field:"process.Ext.api.behaviors" kind:eq value:"direct_syscall" |
process.Ext.api.name | in |
| field:"process.Ext.api.name" kind:in |
process.thread.Ext.call_stack_final_user_module.hash.sha256 | is_not_null | field:"process.thread.Ext.call_stack_final_user_module.hash.sha256" kind:is_not_null | |
process.thread.Ext.call_stack_final_user_module.protection_provenance | ne |
| field:"process.thread.Ext.call_stack_final_user_module.protection_provenance" kind:ne value:"Kernel" |
process.thread.Ext.call_stack_summary | starts_with |
| field:"process.thread.Ext.call_stack_summary" kind:starts_with value:"process.thread.Ext.call_stack_final_user_module.name" |