Potential Evasion with Hardware Breakpoints

[rule]
description = """
Identifies attempt to abuse a thread debug registers along with malicious exception handlers to hijack the normal
execution flow of a thread. This provides an adversary an advantage to inject commands to perform unexpected, unwanted,
or malicious operations.
"""
id = "a10e7b14-4b7b-4a34-b3f6-64791c1114b3"
license = "Elastic License v2"
name = "Potential Evasion with Hardware Breakpoints"
os_list = ["windows"]
reference = ["https://github.com/rad9800/hwbp4mw"]
version = "1.0.20"

query = '''
library where process.thread.Ext.hardware_breakpoint_set == true and process.executable != null and
   dll.name : ("wininet.dll", "ws2_32.dll", "dnsapi.dll", "winhttp.dll", "clr.dll", "netapi32.dll",
                "mscorwks.dll", "System.*.dll", "mscorlib*.dll", "Microsoft.PowerShell.Security*.dll", 
                "Microsoft.PowerShell.ConsoleHost*.dll", "wmiutils.dll", "fastprox.dll", "wbemprox.dll", 
                "vaultcli.dll", "taskschd.dll", "dsquery.dll", "mstscax.dll", "ntdll.dll", "wldap32.dll", 
                "wtsapi32.dll", "psapi.dll") and
 not (process.code_signature.trusted == true and 
      process.code_signature.subject_name : 
                ("Riot Games, Inc.", "Roblox Corporation", "ROBLOX CORPORATION", "Intelligent Security Systems Corporation", 
                 "Famatech Corp.", "Nuance Communications, Inc.", "Blizzard Entertainment, Inc.", "Kofax, Inc.", "KRAFTON, Inc.",
                 "Guidance Software, Inc.", "Open Text Corporation", "CUMMINS INC.", "Cockos Incorporated", "ByteSphere Technologies LLC",
                 "PROMICRA, s.r.o.", "Avid Technology, Inc.", "Avid Technology, Inc", "Krzysztof Kowalczyk",
                 "Yummy Interactive Inc", "Caliper Corporation", "Tencent Technology (Shenzhen) Company Limited",
                 "Big Fish Games, Inc.", "Big Fish Games", "GdP Software", "Tonec Inc.", "Active Database Software LLC",
                 "URSoft, Inc.", "Respondus, Inc.", "Meta Enterprises LLC", "Epic Games Inc.", "Valve Corp.",
                 "Medical Information Technology, Inc.")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info : ("?:\\Windows\\apppatch\\AppPatch64\\exploitblocker.dll!*",
                                        "?:\\Windows\\apppatch\\exploitblocker.dll*",
                                        "?:\\Windows\\AppPatch\\emet.dll!*",
                                        "?:\\Windows\\AppPatch\\apppatch64\\emet.dll!*",
                                        "?:\\Windows\\AppPatch\\emet64.dll!*",
                                        "?:\\Windows\\AppPatch\\apppatch64\\emet64.dll!*")) and
 not process.executable : ("C:\\Program Files (x86)\\Cambridge\\CEPD - 17th Edition\\cepd17.exe",
                           "C:\\Program Files (x86)\\SCRABBLE\\GHScrabble.exe",
                           "C:\\Program Files (x86)\\Kofax\\Power PDF 31\\NPDFLM.exe",
                           "C:\\Program Files (x86)\\Common Files\\ExpertGPS\\ExpertGPS.exe",
                           "C:\\Program Files (x86)\\IBH softec GmbH\\S57W\\S57W.exe",
                           "C:\\Program Files (x86)\\Microsoft Games\\Age of Empires III\\age3y.exe",
                           "C:\\Program Files (x86)\\TheLearningPit\\LogixPro\\LPovl.exe",
                           "C:\\Program Files (x86)\\iLok License Manager\\iLok License Manager.exe",
                           "C:\\Program Files (x86)\\Common Files\\PACE\\Services\\LicenseServices\\LDSvc.exe",
                           "C:\\Program Files (x86)\\NWPS\\SwitchPortMapper\\spmap.exe",
                           "C:\\Program Files (x86)\\Steam\\steamapps\\common\\Call of Duty Black Ops II\\t6zm.exe",
                           "C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSACCESS.EXE",
                           "C:\\Program Files (x86)\\Boardmaker with SD Pro\\BM_SDP.exe",
                           "C:\\Program Files (x86)\\Nuance\\Power PDF 20\\NPDFLM.exe",
                           "C:\\ProgramData\\Big Fish\\Game Manager\\Addons\\gmActivator.exe",
                           "C:\\Program Files (x86)\\Boardmaker with SD Pro\\BM_SDP.exe",
                           "C:\\Program Files (x86)\\Nuance\\PDF Professional 6\\PdfPro6Hook.exe",
                           "C:\\Program Files (x86)\\FormTool 7\\Program\\FormTool.exe",
                           "D:\\DesktopAPP\\SteamDesktop\\steamapps\\common\\VRChat\\VRChat.exe",
                           "C:\\Program Files (x86)\\Christmas Wonderland 15 Collectors Edition\\kcfjhdd.exe",
                           "C:\\Program Files (x86)\\Sea Life Explorer Collectors Edition\\fqlkpjx.exe",
                           "C:\\Program Files (x86)\\Hidden Differences - World Tour\\cgrtmwc.exe",
                           "\\Device\\HarddiskVolume4\\Program Files (x86)\\WeGame\\tenprotect\\TASLogin.exe",
                           "C:\\Program Files (x86)\\Hunter\\Aligner\\Execute\\aligner.exe",
                           "D:\\Program Files (x86)\\NWPS\\SwitchPortMapper\\spmap.exe",
                           "C:\\Program Files (x86)\\Ultra Screen Saver Maker\\ussm.exe") and
 not (process.executable : "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" and dll.name == "ws2_32.dll" and
      process.thread.Ext.call_stack_summary == "Unbacked" and
      _arraysearch(process.thread.Ext.call_stack, $entry,
       $entry.callsite_trailing_bytes == "c3cd2ec30f1f84000000000000000000000000000000000000000000000000000000000000000000000000004c8bd1b82a000000f604250803fe7f0175030f05")) and
 not (endswith~(process.thread.Ext.call_stack_summary, concat("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|", process.name)) and
      _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection : "RWX" and $entry.allocation_private_bytes >= 100000 and stringcontains~($entry.symbol_info, process.name))) and
 not (dll.name : "wininet.dll" and process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|sscprot.dll|ntdll.dll|kernelbase.dll|combase.dll|shellhelper32.dll|calipermtxf.dll")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"