Network Activity from a Reflected Process

[rule]
description = """
Identifies the creation of process clone via the Windows API RtlCreateProcessReflection followed by network activity.
This may indicate an attempt to create a process as a target for process injection.
"""
id = "80294c8d-0ef5-4708-a6ef-45d30064b149"
license = "Elastic License v2"
name = "Network Activity from a Reflected Process"
os_list = ["windows"]
reference = ["https://www.deepinstinct.com/blog/dirty-vanity-a-new-approach-to-code-injection-edr-bypass"]
version = "1.0.7"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*ntdll.dll!RtlCreateProcessReflection*", "*ntdll.dll!RtlCloneUserProcess*")) and
  not process.hash.sha256 : ("a2f3e8a8486d23662da129cd8c8fa9eb0ac0e2471ade3924aaac5c20d153fabb",
                             "8c78b7a71ac20369a5bcd4fb462aee1d514f10afe87408bed3c2d786dd479b4d")]
 [any where
  (event.category : ("network", "dns") or (event.category == "library" and dll.name : ("ws2_32.dll", "winhttp.dll", "wininet.dll")))]
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"