Execution of a DNGUard Protected Program

[rule]
description = """
Identifies when a program is loading DNGUard DLL (DNGuard HVM is a .NET obfuscator and code protector), this may
indicate an attempt to bypass static detection by obfuscating malicious code.
"""
id = "e691d379-6d01-43cc-9f1e-ab10df48a6bc"
license = "Elastic License v2"
name = "Execution of a DNGUard Protected Program"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1027/002/", "http://www.dnguard.net/products.php"]
version = "1.0.23"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
  not process.executable : "?:\\Program Files (x86)\\Digiarty\\WinX MediaTrans\\MediaTrans.exe"]
  [library where
   (dll.name :"HVMRuntm.dll" or
    dll.hash.sha256 :"a0b11444c5913bc048c2f97b670cc801176df17565c48d6e7a30fef651ca8426" or
    dll.pe.imphash : "b2ff0f091ba14e9fe411060ab1560c66")]
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"
[[threat.technique.subtechnique]]
id = "T1027.002"
name = "Software Packing"
reference = "https://attack.mitre.org/techniques/T1027/002/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"