Library Loaded From a Potentially Altered Call Stack

[rule]
description = """
Detects attempts to load a networking module from a potentially altered call stack in order to conceal the true source
of the call.
"""
id = "3ab93164-3d6a-4a84-a7db-cc4dbb2012f4"
license = "Elastic License v2"
name = "Library Loaded From a Potentially Altered Call Stack"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.8"

query = '''
library where process.executable != null and
 dll.name : ("vaultcli.dll", "wmiutils.dll", "taskschd.dll", "dnsapi.dll", "dsquery.dll",
              "mstask.dll", "mstscax.dll", "sqlite3.dll", "ws2_32.dll", "wininet.dll", "amsi.dll",
              "dnsapi.dll", "winhttp.dll", "psapi.dll", "bitsproxy.dll", "softokn3.dll",
              "System.Management.Automation.dll", "Wldap32.dll", "wtsapi32.dll") and
 process.thread.Ext.call_stack_summary like "ntdll.dll|*" and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "C:\\Windows\\Sys?????\\ntdll.dll!LdrLoadDll*") and
 not stringcontains~(process.thread.Ext.call_stack_summary, process.name) and
 not process.thread.Ext.call_stack_summary like ("*Unbacked*", "*Unknown*", "*hmpalert.dll*",
                                                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll",
                                                 "ntdll.dll|wow64.dll|ntdll.dll", "*tmmon64.dll*",
                                                 "ntdll.dll|*wcp.dll|cbscore.dll|*",
                                                 "ntdll.dll|*$$deletemekernelbase.dll*",
                                                 "ntdll.dll|*$$deleteme.kernelbase.dll*",
                                                 "ntdll.dll|kernelbase.dll|combase.dll|*",
                                                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|mscoreei.dll|*",
                                                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|combase.dll|*",
                                                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|clr.dll|*",
                                                 "ntdll.dll|*kernelbase.dll|clr.dll|*",
                                                 "ntdll.dll|ctiuser.dll|ntdll.dll|kernelbase.dll|ctiuser.dll|*",
                                                 "ntdll.dll|kernelbase.dll|wsmsvc.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                                 "ntdll.dll|advapi32.dll|system.management.automation.ni.dll|clr.dll|*",
                                                 "ntdll.dll|kernel32.dll|kernelbase.dll|kernel32.dll|dwminit.dll|kernel32.dll|ntdll.dll",
                                                 "ntdll.dll|kernelbase.dll|fastprox.dll|combase.dll|rpcrt4.dll|combase.dll|wbemprox.dll|*",
                                                 "ntdll.dll|kernel32.dll|kernelbase.dll|kernel32.dll|seagull_v3_configdispatcher.dll|winspool.drv|printisolationproxy.dll|rpcrt4.dll|combase.dll|rpcrt4.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                                 "ntdll.dll|kernelbase.dll|netjoin.dll|wkssvc.dll|rpcrt4.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                                 "ntdll.dll|kernelbase.dll|doclient.dll|ucrtbase.dll|kernel32.dll|ntdll.dll",
                                                 "ntdll.dll|kernelbase.dll|msi.dll|kernel32.dll|ntdll.dll",
                                                 "ntdll.dll|umppc2*.dll|ntdll.dll|kernelbase.dll|combase.dll|qmgr.dll|combase.dll|qmgr.dll|combase.dll|rpcrt4.dll|combase.dll|rpcrt4.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                                 "ntdll.dll|kernel32.dll|kernelbase.dll|kernel32.dll|devicesoftwareinstallationclient.dll|drvstore.dll|devicesoftwareinstallationclient.dll|drvstore.dll|*",
                                                 "ntdll.dll|kernelbase.dll|ucrtbase.dll|msvcp_win.dll|coremessaging.dll|dcomp.dll|windows.ui.xaml.dll|coremessaging.dll|user32.dll|ntdll.dll") and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.symbol_info : ("*KernelBase.dll!LoadLibrary*", "*KernelBase.dll+0x*","*ntdll.dll!TpCallbackIndependent*",
                   "*ntdll.dll!LdrAddLoadAsDataTable*", "*ntdll.dll!LdrUnloadDll*", "*ntdll.dll!LdrInitializeThunk*",
                   "*ntdll.dll!TpSimpleTryPost*", "*wcp.dll!?RtlRunPrimitiveOperationsInXmlAgainstExecutor*",
                   "*KernelBase.dll!FreeLibraryAndExitThread*", "?:\\Users\\*", "?:\\Program Files*", "?:\\ProgramData*",
                   "?:\\*\\Mount*", "\\Device\\Mup*", "D:\\*", "F:\\*", "F:\\*", "I:\\*", "?:\\Windows\\temp\\*",
                   "*ntdll.dll!LdrResolveDelayLoadedAPI*", "*KernelBase.dll!FindFirstFileExW*",
                   "*ntdll.dll!TpReleaseCleanupGroupMembers*", "*KernelBase.dll!VirtualUnlock*", "*KernelBase.dll!GetCPHashNode*",
                   "C:\\Windows\\System32\\KernelBase.dll!GetEnvironmentVariableW+*", "C:\\Windows\\System32\\KernelBase.dll!DeviceIoControl*",
                   "C:\\Windows\\System32\\KernelBase.dll!GetComputerName*", "C:\\Windows\\System32\\KernelBase.dll!CreateProcessInternal*",
                   "C:\\Windows\\System32\\KernelBase.dll!GetProcAddress*", "C:\\Windows\\Sys*\\ntdll.dll!LdrShutdownThread*"))
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"