Potential CVE-2024-21338 Exploitation

[rule]
description = """
Identifies unsigned code calling a vulnerable IOCTL in the appid.sys AppLocker driver. Adversaries may exploit this
vulnerability to execute code in kernel mode and tamper with security solutions.
"""
id = "87cf026c-b242-4fbb-9343-1bdc62136586"
license = "Elastic License v2"
name = "Potential CVE-2024-21338 Exploitation"
os_list = ["windows"]
reference = [
    "https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/",
]
version = "1.0.8"

query = '''
api where

 process.Ext.api.name == "DeviceIoControl" and user.id != "S-1-5-18" and

 (process.Ext.api.parameters.device : "\\Device\\AppId" or
  (user.id : "S-1-5-19" and process.Ext.api.parameters.device == "Unknown")) and

 /* IOCTL 0x22A018 & 0x22A014 */
 (process.Ext.api.parameters.io_control_code == 2269208 or process.Ext.api.parameters.io_control_code == 2269204) and

 /* exclude expected callers */
 not (process.name == "svchost.exe" and 
      (process.thread.Ext.call_stack_final_user_module.protection_provenance == "appidsvc.dll" or 
       process.thread.Ext.call_stack_final_user_module.name == "appidsvc.dll" or
       process.thread.Ext.call_stack_final_user_module.path like "c:\\windows\\system32\\esent.dll") and
      _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $caller, $caller.trusted == true)) and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != "20fae5e8376514a6e500af5a84d08f0f6c58b3302f5c8da48aa74e815a0e78de" and
 not process.thread.Ext.call_stack_final_user_module.path like ("c:\\windows\\system32\\mpssvc.dll", "c:\\windows\\system32\\wevtsvc.dll", "c:\\windows\\assembly\\nativeimages_*\\mscorlib.ni.dll") and
 not (process.executable : "C:\\Program Files\\Windows Defender Advanced Threat Protection\\Classification\\SenseCE.exe" and
      process.parent.executable : "C:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe") and
 not (process.executable : "C:\\Windows\\System32\\WUDFHost.exe" and process.parent.executable : "C:\\Windows\\System32\\services.exe" and
      process.thread.Ext.call_stack_final_user_module.name == "ipf_umdf2.dll") and
 not (process.executable : "C:\\Windows\\System32\\svchost.exe" and process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\cdp.dll")
'''

min_endpoint_version = "8.14.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.0"