NTDLL Loaded from an Unusual Path

[rule]
description = """
Identifies when a process loads the Windows NTDLL image from an unusual path. This may be indicative of adversarial
attempt to evade NTDLL syscall hooking by loading a clean (unhooked) copy of the same image.
"""
id = "3205274e-7eb0-4765-a712-5783361091ae"
license = "Elastic License v2"
name = "NTDLL Loaded from an Unusual Path"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.39"

query = '''
library where dll.pe.original_file_name : "ntdll.dll" and
 dll.name != null and process.pid != 4 and process.executable != null and
 not dll.path : ("?:\\Windows\\SysWOW64\\ntdll.dll",
                 "?:\\Windows\\System32\\ntdll.dll",
                 "?:\\Windows\\System32\\ntdll.dll.???",
                 "?:\\Windows\\SyChpe32\\ntdll.dll",
                 "?:\\Windows\\WinSxS\\amd64_microsoft-windows-ntdll_*\\ntdll.dll",
                 "?:\\Windows\\WinSxS\\wow64_microsoft-windows-ntdll_*\\ntdll.dll",
                 "?:\\Windows\\WinSxS\\Temp\\InFlight\\*\\amd64_microsoft-windows-ntdll_*\\ntdll.dll",
                 "C:\\Windows\\SMSS-*.tmp",
                 "C:\\$Windows.~BT\\NewOS\\Windows\\SysWOW64\\ntdll.dll",
                 /* vsmbSharePrefix */
                 "\\Device\\vmsmb\\VSMB-{*}\\os\\windows\\*\\ntdll.dll",
                 "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\$$DeleteMe*",
                 "?:\\ProgramData\\Microsoft\\Windows\\Containers\\BaseImages\\*\\Files\\Windows\\System32\\ntdll.dll",
                 "?:\\Windows\\WinSxS\\Temp\\InFlight\\*\\ntdll.dll",
                 "?:\\$Windows.~BT\\NewOS\\Windows\\WinSxS\\amd64_microsoft-windows-ntdll_*\\ntdll.dll",
                 "C:\\ProgramData\\SecureWorks\\TaegisAgent\\{*}\\ntdll.x64.dll",
                 "C:\\$Windows.~BT\\NewOS\\Windows\\System32\\ntdll.dll") and
 not (process.code_signature.subject_name : ("INCA Internet Co.,Ltd.", "NEXON Korea Corporation.", "Acronis International GmbH", "Pearl abyss Corp") and
      process.code_signature.trusted == true) and
 not (process.executable : "C:\\Windows\\System32\\smss.exe" and dll.path : "?:\\ProgramData\\docker\\windowsfilter\\*\\Files\\Windows\\System32\\ntdll.dll")
'''

min_endpoint_version = "8.0.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.0.0"