Native API Call from Unsigned Module

[rule]
description = """
Identifies suspicious calls to Windows Native APIs from a unsigned module. This may indicate an attempt to bypass
Kernelbase APIs hooking.
"""
id = "27202cd8-c5a6-4b82-9bb8-f3da69a4d5d3"
license = "Elastic License v2"
name = "Native API Call from Unsigned Module"
os_list = ["windows"]
version = "1.0.14"

query = '''
api where
process.Ext.api.behaviors == "native_api" and process.Ext.api.behaviors != "hidden_code" and
process.Ext.api.metadata.target_address_name in ("Unbacked", "Unknown") and
process.Ext.api.name in ("VirtualProtect", "VirtualProtectEx", "WriteProcessMemory", "MapViewOfFile", "MapViewOfFile2", "VirtualAllocEx", "VirtualAlloc", "SetThreadContext") and
process.thread.Ext.call_stack_final_user_module.name != "Unbacked" and process.thread.Ext.call_stack_final_user_module.name != null and
_arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) and
not process.thread.Ext.call_stack_final_user_module.protection_provenance like "Kernel*" and
not (process.executable : "C:\\Windows\\explorer.exe" and process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\dxgi.dll") and
process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and 
not process.thread.Ext.call_stack_summary like "ntdll.dll|*|Unknown" and 
not (process.Ext.api.name == "MapViewOfFile" and process.thread.Ext.call_stack_final_user_module.name in ("cygwin1.dll", "msys-2.0.dll")) and 
not process.thread.Ext.call_stack_final_user_module.path like ("c:\\windows\\assembly\\nativeimages_*.ni.dll",
                                                               "c:\\windows\\microsoft.net\\framework*.dll",
                                                               "?:\\program files (x86)\\*",
                                                               "?:\\program files\\*",
                                                               "c:\\windows\\winsxs\\*.dll",
                                                               "c:\\windows\\systemapps\\microsoft.windows.*.dll",
                                                               "c:\\windows\\system32\\ntdll.dll",
                                                               "c:\\windows\\syswow64\\ntdll.dll",
                                                               "c:\\windows\\syswow64\\apphelp.dll",
                                                               "c:\\windows\\syswow64\\cyinjct.dll",
                                                               "c:\\windows\\system32\\cyvrtrap.dll",
                                                               "c:\\windows\\system32\\edrpm64.dll",
                                                               "c:\\windows\\system32\\esensordbi.dll",
                                                               "c:\\windows\\system32\\hmpalert.dll", 
                                                               "?:\\windows\\system32\\spool\\drivers\\x64\\*\\ricoh_*.dll", 
                                                               "c:\\windows\\systemapps\\shellexperiencehost_*\\dxgi.dll",
                                                               "c:\\windows\\system32\\sophosed\\sophosed.dll",
                                                               "c:\\windows\\system32\\xtajit64.dll",
                                                               "c:\\windows\\system32\\microsoftaccounttokenprovider.dll", 
                                                               "c:\\windows\\system32\\appxsip.dll") and
not process.thread.Ext.call_stack_final_user_module.protection_provenance_path : ("c:\\program files (x86)\\*", "c:\\program files\\*") and
not (process.executable : "C:\\Windows\\System32\\lsass.exe" and process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\lsasrv.dll") and
not (process.executable : "C:\\Windows\\System32\\csrss.exe" and process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\sxssrv.dll") and
not (process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\syswow64\\wrusr.dll" and process.thread.Ext.call_stack_summary like "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|wrusr.dll|kernelbase.dll|*") and
not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                ("20623b2da7f3a2c1773f044921d2a99ce6b719f232796d88f164c41dc40b941a",
                                 "8a0e3caa3ee18379d63b9bd709ac6a87fb0dd8c31c833cb48bc4c9bc10017486",
                                 "0f3ed1563ab2ec7dbbf8e9db14e6ff649fcb3bfd607dd81ce4fc91a211559a4b",
                                 "b2d86212afab00e7b9bf19b7931277130b653c9258ac419a7a24d749471ea5ac",
                                 "8526104317a63fbdb2d126e737f822a03a2cf05046d712a136545a428320443d",
                                 "ecf5054d7f1ad0da4b1c9295b23389645780bb20855b6c727762163170d38d48",
                                 "6a2bf3ad9caeec71ff5fbd187f5db3337e4c99fa51e36ee039183b0aa610b22c",
                                 "65b2be41a8c2456dc69fd216000c2400d8fc48f37a40d21f94318a77d7459441",
                                 "f7c78dba07128af325d8da99138ebf78be163ecfb5da5b01fa6b65b96efecef1",
                                 "6778b8d1eabffe78447ec4aa6d793e776a9db351c202c955dda196e90df19fa2",
                                 "31fb9c74183eaa737317fd0260c218e38ae5b243988108c7e5e60e416fe54a84",
                                 "f239c27b50cef792fea5b34378fbac83bcc06b8442d508bd9add7ddf8ca5c632",
                                 "685774f56983b22fbd1f84880fe60f149ccf0322abe8dd09b7a0d81f4a5dd1f1",
                                 "c8f242570144ac4ba77967a1dc59d6681ca2d8a6a85c4db2a30e1e4629db843a",
                                 "16e40b77295687c45e7c9eefce8336aa69c08ac6648ba3a919bc5497b6ed7f83",
                                 "ab77212a71c2e2e8b870452d2c32bc72a6708d6e963dd3ebe2ac1a946cffc242",
                                 "7a94bc02118f56e337709f1e71f730ebe1245e8c641027326e30db213169abe7",
                                 "63120cd3e9b950400bd9366c1cc543d55e7823a51fc81d4b2d021536662c85a7",
                                 "9c58c33c68c8494d8eac12c6a4ff122b1e719ebba988c7c12c597bd0f01ff1a1",
                                 "cf05e4d1b1c8d93caf36dff4b4abaec8144a0281f8cbb611d0fb6e2a7fb38385",
                                 "d32b9f057abc3dda988d443cf9866d70a3e986a57f2c6f82379e45b8b900128b",
                                 "5e09159104bf3a9036e90e35b4bb4de0123907b3d6b5c30d155f50231f98e60a", 
                                 "7d5cb5629aad0d20f2127d39f3f72112936731880678b1e86a9d2eec475301db",
                                 "f9d96115b770e86878dda0abe837a4922a67f1621c1c09a713d9e5259b7daba7",
                                 "e4aefb3e93a05959581f99378cfb034c5c4bf072063fa82572fe271a835d7c3d",
                                 "3e7873f34404c87d7b2db9f6a460f3caa22a36f093a01ad50494863b392569ce",
                                 "cd2688a74a151b03282388dadb8b6aaca309f2535c8b2b21d1243846d2b259dc",
                                 "d5006c0d9e14d5c9e96936405c4ad2a6aab4e6756dac16fcbdfffe47efb807dd",
                                 "182607dfc1170294301053ff004bbc9db5ffa68e5d36d29fe64a22a13d75aeb1",
                                 "e17249c2157e01acceb725d50ede423fb63fd75d615433276ae846742f06112c",
                                 "c0403bb03cd6860d227b6a24772d30ac511bf51cddda16414abba13567d95e66",
                                 "32954725dfc81d4d557a693f5d6901ac9d0556a6b51f00a5c2beed8a337a8e5d",
                                 "21e4c7ec5ebfc98d8322ac362e0e4719b30138df58a99aa0200fb345bb83657e",
                                 "d8bdfbd3e3d8e4991edcf69337c6a747985e2e15ca7ec971c4165d68f66eed86",
                                 "2b6c43f27f3c72652dedd07fa12131d64b4451638922361879a13e7289e552af",
                                 "644bca8e169fe2434124f528a7e2fabd45634301575890da81377d8f03636d35",
                                 "7eabaf02d37a50a3fb4aaae154f9e803f67a275e9af4b59adac4dccd733485d7",
                                 "21eb39285fcd91148385d11b77489aad84e00f15b42bbdd98c6bc2fdaca7b987",
                                 "18bc51c6c267f218e14280d7b21b48ee23968c9ea76bbab945d7456a3da05907", 
                                 "f52cf893bd4b5ed92065197bb1eecb2546cd192b603c831cef0acb2d03ab83a4", 
                                 "eb5a608211fc88588094ef613b9983f4a7744a90309375096eaf12fe29d506d9", 
                                 "cf131738f4b5fe3f42e9108e24595fc3e6573347d78e4e69ec42106c1eebe42c", 
                                 "097b30f6ef06eb2447f459a20a777190eefda55d148dd109ed3547b2338b540f", 
                                 "c4bac26cc79788539e98b99989b3d2e9e13b74974b861badc66613a5e661ba90", 
                                 "b83ca6663e8840c29790c00783bf29c8aa6d8cab6bae5cb9ca8aa7c7901462f4", 
                                 "705e4e1db0576aa2a6df0ba9ebeda9e647e2ce95d90727d6b95f559a4a95c1fe",
                                 "c70c8840b2d56de13c20fd2144784bfb955b847c83b45673352375802d14b3d5",
                                 "394ba9db0f6d26ec083decceee35ef7973a41681c522b9d400cf46fc5709015f",
                                 "28304f6396076ca10babe682950eaa06574a291e5fbee5aaeec8ac69f1dc46b3") and
not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry,
($entry.trusted == true or $entry.status == "errorExpired") and
$entry.subject_name in (
"AMD PMP-PE CB Code Signer v20140501",
"Carbon Black, Inc.",
"PC SOFT INFORMATIQUE SAS",
"Kaspersky Lab JSC",
"Kaspersky Lab",
"AO Kaspersky Lab",
"ESET, spol. s r.o.",
"MUSARUBRA US LLC",
"Microsoft Windows Hardware Compatibility Publisher"
)) and
not _arraysearch(process.thread.Ext.call_stack, $entry,
                 $entry.symbol_info like
                                     ("c:\\windows\\*\\ntdll.dll!Ldr*",
                                      "c:\\windows\\*\\ntdll.dll!RtlAllocateHeap*",
                                      "c:\\windows\\sys?????\\ntdll.dll!RtlFreeHeap*",
                                      "c:\\windows\\sys?????\\ntdll.dll!RtlReAllocateHeap*",
                                      "c:\\windows\\sys?????\\ntdll.dll!RtlUnlockHeap*",
                                      "c:\\windows\\sys?????\\ntdll.dll+0x*", 
                                      "c:\\windows\\sys*\\kernelbase.dll!VirtualAlloc*", 
                                      "c:\\windows\\system32\\kernelbase.dll!HeapCreat*")) and
not (process.executable : "\\\\?\\Volume{*}\\*.exe" and process.thread.Ext.call_stack_final_user_module.path like "?:\\*\\docker\\*\\windows\\*") and 
not process.thread.Ext.call_stack_summary like ("ntdll.dll|libpcre*.dll|libgobject-*.dll|ntdll.dll", "ntdll.dll|libffi-*.dll|libpython*.dll|ntdll.dll")
'''

min_endpoint_version = "8.16.3"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.16.3"