Library Loaded via a Worker Callback

[rule]
description = """
Identifies the load of a library indirectly via a callback function. This may be the result of an evasion attempt to
hide the origin of the API call from the call stack such as unbacked memory region.
"""
id = "b2beb283-0a5c-4a7c-bd97-54b920392897"
license = "Elastic License v2"
name = "Library Loaded via a Worker Callback"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/doubling-down-etw-callstacks",
    "https://0xdarkvortex.dev/hiding-in-plainsight/",
]
version = "1.0.4"

query = '''
library where dll.name : ("ws2_32.dll", "winhttp.dll", "wininet.dll") and process.name != null and
 process.thread.Ext.call_stack_summary like "ntdll.dll|kernelbase.dll|*|ntdll.dll|kernel32.dll|ntdll.dll" and
 not process.thread.Ext.call_stack_summary like "ntdll.dll|kernelbase.dll|*|*|ntdll.dll|kernel32.dll|ntdll.dll" and
 not stringcontains~(process.thread.Ext.call_stack_summary, process.name) and
 not (user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
      process.executable : ("C:\\Windows\\System32\\svchost.exe",
                            "C:\\Windows\\System32\\lsass.exe",
                            "C:\\Windows\\System32\\LogonUI.exe")) and
 not process.thread.Ext.call_stack_summary in ("ntdll.dll|kernelbase.dll|smartcardcredentialprovider.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                               "ntdll.dll|kernelbase.dll|hostshellextension.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                               "ntdll.dll|kernelbase.dll|wsmsvc.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                               "ntdll.dll|kernelbase.dll|ws2_32.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                               "ntdll.dll|kernelbase.dll|das.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                               "ntdll.dll|kernelbase.dll|lucanet.dll|ntdll.dll|kernel32.dll|ntdll.dll") and
 not (process.code_signature.trusted == true and process.code_signature.subject_name : ("SentinelOne Inc.", "Sentinelone, Inc.", "Sentinel Labs, Inc.", "Bitglass, LLC", "Adobe Inc.")) and
 not (process.code_signature.trusted == true and process.code_signature.subject_name == "LucaNet AG" and process.executable : "C:\\Program Files\\LucaNet\\Youniverse\\.bin\\LucaNet.exe") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : ("*ntdll.dll!TppWorkpExecuteCallback*", "*ntdll.dll!TppWorkerThread*", "*ntdll.dll!RtlClearThreadWorkOnBehalfTicket*"))
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"