Library Loaded via a CallBack Function

[rule]
description = """
Identifies the load of library from via a callback function. This may be the result of an evasion attempt to hide the
origin of the LoadLibrary call from the call stack.
"""
id = "fae9f554-d3bc-4d48-8863-54d0dd68db54"
license = "Elastic License v2"
name = "Library Loaded via a CallBack Function"
os_list = ["windows"]
reference = [
    "https://malpedia.caad.fkie.fraunhofer.de/details/win.nighthawk",
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.23"

query = '''
sequence by process.entity_id 
 [process where event.action == "start"]
 [library where 
 (
  ((dll.Ext.relative_file_creation_time <= 300 or
    (dll.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not dll.path : "C:\\*")) and
   (dll.code_signature.trusted == false or dll.code_signature.exists == false)) or 
  
   dll.name in~ ("vaultcli.dll", "wmiutils.dll", "taskschd.dll", "dnsapi.dll", "dsquery.dll", 
              "mstask.dll", "mstscax.dll", "sqlite3.dll", "clr.dll", "coreclr.dll", "ws2_32.dll", 
              "wininet.dll", "dnsapi.dll", "winhttp.dll", "psapi.dll", "bitsproxy.dll", "softokn3.dll", 
              "System.Management.Automation.dll", "Wldap32.dll")
 ) and 

 process.thread.Ext.call_stack_summary in 
                ("ntdll.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll", 
                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "C:\\Windows\\Sys?????\\ntdll.dll!KiUserApcDispatcher*")
 ]
 until [process where event.action == "end"]
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"