Microsoft Common Language Runtime Loaded from Suspicious Memory

[rule]
description = """
Identifies the load of the Microsoft Common Language Runtime DLL CLR.dll from unbacked memory region with suspicious
memory allocation properties. This could be the result of attempts to load an assembly from an already injected process.
"""
id = "ad2c6fcc-89d3-4939-85d9-d7114d6bbf14"
license = "Elastic License v2"
name = "Microsoft Common Language Runtime Loaded from Suspicious Memory"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.29"

query = '''
library where dll.name : "clr.dll" and
 process.thread.Ext.call_stack_summary : 
             ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|mscoreei.dll|Unbacked", 
              "ntdll.dll|kernelbase.dll|mscoreei.dll|Unbacked") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "*mscoreei.dll!CreateInterface*") and
 not (process.executable : "?:\\Program Files\\Dell\\DTP\\DiagnosticsSubAgent\\Dell.TechHub.Diagnostics.SubAgent.exe" and
      process.code_signature.trusted == true and process.code_signature.subject_name : "Dell Inc") and
 not (process.code_signature.trusted == true and 
      process.code_signature.subject_name : ("Azul Systems, Inc.", "JetBrains s.r.o.", "HAYLEM Technologies Inc.", "MicroStrategy, Inc.", "Oracle America, Inc.")) and
 not (process.executable : "C:\\ManageEngine\\ADManager Plus\\jre\\bin\\java.exe" and 
      process.code_signature.subject_name : "Oracle America, Inc." and process.code_signature.trusted == true) and 
 not (process.executable : "?:\\Program Files*\\Amazon Corretto\\jdk*\\bin\\java.exe" and 
      process.code_signature.subject_name : ("Amazon.com Services LLC", "Amazon Services LLC", "Adaptive Protocols, Inc.") and process.code_signature.trusted == true)  and 
 not (process.executable : "?:\\ManageEngine\\PAM360\\jre\\bin\\java.exe" and
      process.code_signature.trusted == true and
      process.code_signature.subject_name : ("Oracle America, Inc.", "Eclipse.org Foundation, Inc.")) and
 not (process.executable : "*\\EL.AudioVideoConversion.Console.exe" and
      process.code_signature.trusted == true and
      process.code_signature.subject_name : "NEXUS / E&L GmbH") and
 not process.executable :
               ("?:\\Program Files\\Microsoft Visual Studio\\*.exe",
                "?:\\Program Files (x86)\\Microsoft Visual Studio\\*.exe",
                "?:\\Program Files (x86)\\PMP\\jre\\bin\\java.exe",
                "?:\\Program Files\\ManageEngine\\PMP\\jre\\bin\\java.exe",
                "?:\\Program Files\\ManageEngine\\PAM360\\jre\\bin\\java.exe",
                "?:\\Program Files (x86)\\Adaptiva\\AdaptivaClient\\bin\\AdaptivaClientService.exe",
                "?:\\Program Files\\Adaptiva\\AdaptivaClient\\bin\\AdaptivaClientService.exe",
                "C:\\Program Files\\Siemens\\teamplay\\bin\\*\\syngo.Cloud.Receiver.Plugin.DicomTagResolver.exe",
                "?:\\Program Files\\Sql Server Extension\\SqlServerExtension.Service.exe",
                "C:\\Program Files\\Siemens\\CloudLink\\*.exe",
                "C:\\Program Files (x86)\\Razer\\Razer Cortex\\RazerCortex.exe",
                "C:\\Program Files\\Guard\\Data Vault Publisher for Citect\\*.exe",
                "C:\\Program Files\\Koios\\Koios DS\\KoiosDS-MVC-App.exe",
                "?:\\Program Files\\Commvault\\ContentStore\\DotNetCore\\dotnet.exe",
                "?:\\Program Files\\Siemens\\ABT Site\\Bin\\Siemens.BASys.ABTSite.exe") and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.callsite_trailing_bytes : ("c5f8774883ec10c5fb1104244883ec104889042449ba00000000000000004*",
                                                      "*488b8d48ffffff48894b104c8b658049894424084c896588c745c0*"))
'''

min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"