Potential Evasion via Oversized Image Load

[rule]
description = """
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done
without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some
security tools are capable of handling due to file size limitations
"""
id = "65a402ff-904b-4d14-b7aa-fa0c5ae575f8"
license = "Elastic License v2"
name = "Potential Evasion via Oversized Image Load"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1027/001/",
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.27"

query = '''
sequence with maxspan=1m
 [file where event.action != "deletion" and
   /* over 100MB in size */
   file.size >= 100000000 and file.Ext.header_bytes : "4d5a*" and not file.extension : "exe" and
   not user.id : "S-1-5-18" and
  not (process.code_signature.subject_name in ("Trend Micro, Inc.",  "Azul Systems, Inc.", "Wargaming Group Limited",
      "Avigilon Corporation", "Duck Duck Go, Inc.", "Wargaming Group Limited", "Griff Gate Pte. Ltd.", "Corsair Memory, Inc.",
      "Anaconda, Inc.") and
       process.code_signature.status == "trusted") and
  not process.executable : ("C:\\ProgramData\\slicer.org\\Slicer *\\bin\\python-real.exe", "C:\\Program Files\\burpsuite_enterprise\\jres\\*\\bin\\java.exe") and
  not file.path : "C:\\ProgramData\\*\\PyQt5\\Qt5\\bin\\Qt5WebEngineCore.dll"
  ] by file.path
 [library where
    (
     process.name : ("rundll32.exe", "regsvr32.exe", "svchost.exe") or
     process.executable :
               ("?:\\Users\\Public\\*",
                "?:\\ProgramData\\*",
                "?:\\Windows\\Temp\\*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\Rar*",
                "?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*")
     )
    and not dll.code_signature.trusted == true and
    not dll.code_signature.status : "errorExpired" and
    not user.id : "S-1-5-18" and
    not (process.name : "regsvr32.exe" and dll.path : "C:\\Oracle\\*.dll") and
    not (dll.name : "Qt5WebEngineCore.dll" and process.code_signature.subject_name == "Pitney Bowes Inc.")] by dll.path
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"
[[threat.technique.subtechnique]]
id = "T1027.001"
name = "Binary Padding"
reference = "https://attack.mitre.org/techniques/T1027/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"