Potential Evasion via Inline Execute Assembly

[rule]
description = """
Identifies attempts to load the Microsoft Common Language Runtime from a suspicious memory followed by an egress network
connection.
"""
id = "ad65d579-b904-48e0-9408-f4c4e8e685a0"
license = "Elastic License v2"
name = "Potential Evasion via Inline Execute Assembly"
os_list = ["windows"]
reference = ["https://github.com/anthemtotheego/InlineExecute-Assembly"]
version = "1.0.22"

query = '''
sequence by process.entity_id with maxspan=5s 
 [library where dll.name : "mscorwks.dll" and 
  process.thread.Ext.call_stack_summary : 
                   ("ntdll.dll|kernelbase.dll|mscoreei.dll|Unbacked",
                    "ntdll.dll|kernelbase.dll|mscoreei.dll|mscoree.dll|Unbacked",
                    "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|mscoreei.dll|Unbacked") and
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "*mscoreei.dll!CreateInterface*") and 
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and $entry.callsite_trailing_bytes : "?*") and 
  not (process.executable : "?:\\Program Files\\Dell\\DTP\\DiagnosticsSubAgent\\Dell.TechHub.Diagnostics.SubAgent.exe" and
       process.code_signature.trusted == true and process.code_signature.subject_name : "Dell Inc") and
  not (process.code_signature.trusted == true and 
       process.code_signature.subject_name : ("Azul Systems, Inc.", "JetBrains s.r.o.", "Milsoft Utility Solutions, Inc.")) and 
  not (process.executable : "C:\\ManageEngine\\ADManager Plus\\jre\\bin\\java.exe" and 
      process.code_signature.subject_name : "Oracle America, Inc." and process.code_signature.trusted == true) and 
  not (process.executable : "?:\\Program Files*\\Amazon Corretto\\jdk*\\bin\\java.exe" and 
       process.code_signature.subject_name : "Amazon.com Services LLC" and process.code_signature.trusted == true) and
  not process.executable : ("?:\\Program Files\\Hexagon\\Cipher *\\Cipher.exe",
                            "?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe",
                            "?:\\Program Files (x86)\\XMPie\\Circle Agent\\Service\\XMCircleAgent.exe")
  ]
 [network where network.direction == "egress" and network.transport == "tcp"]
'''

min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"