Library Loaded via Thread Fiber CallBack

[rule]
description = """
Identifies the load of library via a thread fiber callback function. This may be the result of an evasion attempt to
hide the origin of the LoadLibrary call from the call stack.
"""
id = "8417b39b-d00c-403a-afcb-5b04e7c60ca9"
license = "Elastic License v2"
name = "Library Loaded via Thread Fiber CallBack"
os_list = ["windows"]
version = "1.0.3"

query = '''
library where
 (
  ((dll.Ext.relative_file_creation_time <= 300 or
    (dll.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not dll.path : "C:\\*")) and
   (dll.code_signature.trusted == false or dll.code_signature.exists == false)) or

   dll.name : ("vaultcli.dll", "wmiutils.dll", "taskschd.dll", "dnsapi.dll", "dsquery.dll",
              "mstask.dll", "mstscax.dll", "sqlite3.dll", "clr.dll", "coreclr.dll", "ws2_32.dll",
              "wininet.dll", "dnsapi.dll", "winhttp.dll", "psapi.dll", "bitsproxy.dll", "softokn3.dll",
              "System.Management.Automation.dll", "Wldap32.dll", "wtsapi32.dll")
 ) and

 process.thread.Ext.call_stack_summary :
               ("ntdll.dll|kernelbase.dll|ntdll.dll",
                "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|ntdll.dll") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*RtlUserFiberStart*")
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"