Library Load from a Truncated Stack

[rule]
description = """
Detects attempts to load libraries from a potentially truncated call stack in order to conceal the true source of the
call.
"""
id = "250df259-4363-4aba-b13f-83829c978501"
license = "Elastic License v2"
name = "Library Load from a Truncated Stack"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.3"

query = '''
library where
(
  (dll.name : ("wininet.dll", "ws2_32.dll", "winhttp.dll", "amsi.dll", "netapi32.dll", "wldap32.dll", "wtsapi32.dll", "mswsock.dll", "urlmon.dll") and
   process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll" and
   _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "C:\\Windows\\Sys?????\\KernelBase.dll!LoadLibrary*")) or

  (dll.name : ("kernel32.dll", "kernelbase.dll", "dbghelp.dll", "ntdll.dll", "amsi.dll") and process.thread.Ext.call_stack_summary == "ntdll.dll" and
   _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "C:\\Windows\\System32\\ntdll.dll!??MapViewOfSectionEx*") and
   not _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.symbol_info: ("C:\\Windows\\System32\\ntdll.dll!??MapViewOfSectionEx*",
                                         "c:\\windows\\System32\\kernelbase.dll!LoadLibrary*",
                                         "c:\\windows\\System32\\ntdll.dll!Ldr*",
                                         "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart*")))
)
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"