Potential DLL Hijack via Directory Spoofing

[rule]
description = """
Identifies attempt to perform DLL hijacking using System32 executables or others in non-user-writable folders by
spoofing the the directory from which the application is loaded to an arbitrary user-specified one.
"""
id = "4c0b962c-b46c-4ac3-9f20-a1cf44ec8fdc"
license = "Elastic License v2"
name = "Potential DLL Hijack via Directory Spoofing"
os_list = ["windows"]
reference = ["https://github.com/Octoberfest7/DropSpawn_BOF"]
version = "1.0.5"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: "*RtlCreateUserProcessEx*") and 
  process.parent.thread.Ext.call_stack_summary : "ntdll.dll*" and 
  not process.parent.thread.Ext.call_stack_summary : ("*kernel32*", "*kernelbase*", "ntdll.dll|smss.exe|ntdll.dll") and 
  not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: "*RtlCloneUserProcess*")]
 [library where not dll.code_signature.status : "trusted" and not startswith~(dll.name, process.name) and 
  process.thread.Ext.call_stack_summary : "ntdll.dll|kernel32.dll|ntdll.dll" and 
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*LdrLoadDll*", "*LoadLibrary*")) and 
  not dll.path : 
          ("?:\\Windows\\System32\\*", 
           "?:\\Windows\\SysWOW64\\*", 
           "?:\\Windows\\WinSxS\\*", 
           "?:\\Windows\\assembly\\*", 
           "?:\\Windows\\assembly\\NativeImages_v*", 
           "?:\\Windows\\SoftwareDistribution\\Download\\*", 
           "?:\\Program Files\\*", 
           "?:\\Program Files (x86)\\*") and 
  /* DLL not loaded from the process.executable current directory */
	not endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))]
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"