Evasion via Event Tracing for Windows Patching

[rule]
description = """
Identifies attempts to patch Microsoft Event Tracing for Windows via memory modification. This may indicate an attempt
to disrupt detection of malicious activity by the Event Tracing facility for Windows.
"""
id = "3046168a-91cb-4ecd-a061-b75b1df1c107"
license = "Elastic License v2"
name = "Evasion via Event Tracing for Windows Patching"
os_list = ["windows"]
reference = [
    "https://blog.xpnsec.com/hiding-your-dotnet-etw/",
    "https://www.elastic.co/security-labs/doubling-down-etw-callstacks",
]
version = "1.0.16"

query = '''
api where process.Ext.api.name :  "WriteProcessMemory*" and
 process.Ext.api.summary : ("*ntdll.dll!Etw*", "*ntdll.dll!NtTrace*") and
 process.executable != null and
 not process.executable : ("?:\\Windows\\System32\\lsass.exe",
                           "\\Device\\HarddiskVolume*\\Windows\\System32\\lsass.exe",
                           "?:\\Windows\\System32\\csrss.exe") and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != "7d678faf97ffbd27c01161ec6aaf9854226bef44ef70542e973aae004a85ea16" and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
                                          "Microsoft Windows Software Compatibility Publisher",
                                          "SentinelOne Inc."))
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"