Potential Evasion via Invalid Code Signature

[rule]
description = """
Identifies an attempt to load a network module from unbacked memory or perform suspicious Windows API calls by an
executable with erroneous code signature. Malware may append malicious code to benign signed binaries or use invalid
code signature to bypass certain security controls.
"""
id = "f3f769b9-0695-49ed-ab6e-c8f199a7d2c8"
license = "Elastic License v2"
name = "Potential Evasion via Invalid Code Signature"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.20"

query = '''
any where
 process.executable != null and process.code_signature.status == "errorBadDigest" and   
 (
  (event.category == "api" and event.category == "intrusion_detection" and 
   process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
   not process.Ext.api.name in ("SetWindowsHookEx", "IoCreateDevice") and
   process.thread.Ext.call_stack_final_user_module.name != null and
   not process.thread.Ext.call_stack_final_user_module.name in ("Kernel", "Unknown", "Undetermined") and
   not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Kernel", "Kernel|*")) or

  (event.category == "library" and dll.name in~ ("ws2_32.dll", "wininet.dll", "winhttp.dll") and
   process.thread.Ext.call_stack_summary like
            ("*kernelbase.dll|Unbacked*", "*ntdll.dll|Unbacked*", "*wininet.dll|Unbacked*",
             "*dnsapi.dll|Unbacked*", "*ws2_32.dll|Unbacked*", "*iphlpapi.dll|Unbacked*",
             "*winhttp.dll|Unbacked*", "Unbacked|*"))
 ) and
 not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and 
 not (process.executable : "D:\\d3\\view\\viewapp.exe" and process.code_signature.subject_name == "d.velop AG") and
 not (process.executable : "D:\\*\\AuditExplorer.exe" and process.code_signature.subject_name == "Eclipse.org Foundation, Inc.") and
 not (dll.name == "ws2_32.dll" and process.code_signature.subject_name in ("Azul Systems, Inc.", "Ghisler Software GmbH", "Cellebrite DI LTD", "Pagebites, Inc.")) and
 not (process.Ext.api.name in ("NtQueueApcThread", "OpenProcess", "ResumeThread") and process.code_signature.subject_name in ("Azul Systems, Inc.", "Eclipse.org Foundation, Inc.")) and
 not (process.executable : "C:\\AutoVue_Client\\jre\\bin\\javaw.exe" and process.code_signature.subject_name == "Oracle America, Inc.") and
 not (process.executable : ("?:\\Users\\*\\AppData\\Local\\Turbo.net\\Sandbox\\GEARView\\*\\GEARViewBasic.exe",
                             "\\\\?\\Volume{*}\\VMS_PortableClient_x64\\local\\stubexe\\*\\VMS_Client.exe") and
      process.code_signature.subject_name == "Code Systems Corporation") and
 not process.executable : 
             ("?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe", 
              "?:\\Program Files (x86)\\Teams Installer\\Teams.exe", 
              "?:\\Program Files\\Microsoft Mouse and Keyboard Center\\CEIP.exe", 
              "?:\\Program Files (x86)\\Microsoft Mouse and Keyboard Center\\CEIP.exe",
              "C:\\Informatica\\10.5.1\\clients\\DeveloperClient\\developerCore.exe",
              "C:\\Users\\*\\AppData\\Roaming\\Spotify\\Spotify.exe") and
 not (process.executable : "D:\\SteamLibrary\\steamapps\\common\\*" and
      process.parent.executable : "C:\\Program Files (x86)\\Steam\\steam.exe") and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                     $entry.symbol_info : ("?:\\Program Files\\*.dll*",
                                           "?:\\Program Files (x86)\\*.dll*",
                                           "?:\\windows\\system32\\*\\tmmon*.dll*",
                                           "?:\\Windows\\SysWOW64\\esensordbi.dll*",
                                           "?:\\Windows\\System32\\esensordbi.dll*",
                                           "?:\\Windows\\System32\\umppc*.dll*",
                                           "?:\\Windows\\FireEye\\AppMonitorDll*.dll*",
                                           "?:\\Windows\\apppatch\\AppPatch*\\exploitblocker.dll*",
                                           "?:\\windows\\system32\\hmpalert.dll!*")) and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                               ("234360be58be376a77169fcc447cf8cbcba959f5c1db256ea2a50eeb92e65f44",
                                                "fcdde72cfb1b2ff1bf953b2ded03b74c7d7273fa7dcef282a594c2819b2c497c",
                                                "f5071fb08095973d5499e50e6ac176a1bdc33d774ea61e0e3c82605d468e0045",
                                                "0a32e883d669a5b9bbb7aecc1cee31623aa69950ca9e3fce9d5270caa6ae0f39")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"