Evasion via LdrpKernel32 Overwrite

[rule]
description = """
Identifies attempts to load a malicious DLL early via hijacking the normal NTDLL bootstrap process. Instead of loading
kernel32 it will load a malicious one that may execute malicious code and resume the rest of the loading process steps.
"""
id = "6a01a5d9-1fb0-4ad9-a813-d541012996b8"
license = "Elastic License v2"
name = "Evasion via LdrpKernel32 Overwrite"
os_list = ["windows"]
reference = ["https://github.com/rbmm/LdrpKernel32DllName"]
version = "1.0.13"

query = '''
library where (dll.code_signature.trusted == false or dll.code_signature.exists == false) and process.uptime == 0 and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "*!BaseThreadInitThunk*") and 
 process.executable : ("?:\\*", "\\Device\\Mup\\*") and 
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info : ("?:\\Windows\\System32\\kernel32.dll!BaseThreadInitThunk*",
                                        "?:\\Windows\\SysWOW64\\kernel32.dll!BaseThreadInitThunk*",
                                        "?:\\Windows\\WinSxS\\*\\kernel32.dll!BaseThreadInitThunk*",
                                        "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\*!BaseThreadInitThunk*",
                                        "\\Device\\*\\Windows\\*\\kernel32.dll!BaseThreadInitThunk*")) and
 not dll.path : ("?:\\Windows\\assembly\\NativeImages_*\\System.Numerics.ni.dll", "C:\\Program Files\\Fortinet\\FortiClient\\utilsdll.dll")
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"