Microsoft Common Language Runtime Loaded from Modified Memory

[rule]
description = """
Identifies the load of the Microsoft Common Language Runtime DLL CLR.dll from modified memory region with suspicious
memory allocation properties. This could be the result of attempts to load an assembly from an already injected process.
"""
id = "6b114ab8-ae99-47d5-a2d7-145fb531a7f3"
license = "Elastic License v2"
name = "Microsoft Common Language Runtime Loaded from Modified Memory"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.3"

query = '''
library where dll.name : "clr.dll" and
 (
   (process.thread.Ext.call_stack_summary regex """ntdll.dll\|kernelbase.dll\|mscoreei.dll\|[a-z0-9]+\.(dll|exe)""" and
    _arraysearch(process.thread.Ext.call_stack, $entry,
                 stringcontains~($entry.symbol_info, substring(process.thread.Ext.call_stack_summary, 38, length(process.thread.Ext.call_stack_summary))) and ($entry.callsite_trailing_bytes : "?*" or $entry.allocation_private_bytes >= 100000))) or

   (process.thread.Ext.call_stack_summary regex """ntdll.dll\|wow64.dll\|wow64cpu.dll\|wow64.dll\|ntdll.dll\|kernelbase.dll\|mscoreei.dll\|[a-z0-9]+\.(dll|exe)""" and
    _arraysearch(process.thread.Ext.call_stack, $entry,
                 stringcontains~($entry.symbol_info, substring(process.thread.Ext.call_stack_summary, 81, length(process.thread.Ext.call_stack_summary))) and ($entry.callsite_trailing_bytes : "?*" or $entry.allocation_private_bytes >= 100000)))
  ) and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "C:\\Windows\\Microsoft.NET\\Framework*\\mscoreei.dll!CreateInterface*") and

 not process.thread.Ext.call_stack_summary like
                        ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|mscoreei.dll|adxloader.dll",
                         "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|mscoreei.dll|cdlli??.dll") and
 not process.executable :
                ("C:\\Program Files\\Locklizard Safeguard PDF Viewer\\PDCViewer64.exe",
                 "C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\URL Filtering\\bin\\TIF.exe",
                 "C:\\Program Files (x86)\\Microsoft Visual Studio\\*\\devenv.exe",
                 "C:\\Program Files (x86)\\Corel\\CorelDRAW Home & Student Suite X7\\Programs\\DrawHome.exe")
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.16.0"