Potential Hardware Breakpoints Evasion

[rule]
description = """
Identifies attempt to abuse a thread debug registers along with malicious exception handlers to hijack the normal
execution flow of a thread. This provides an adversary an advantage to inject commands to perform unexpected, unwanted,
or malicious operations.
"""
id = "b5b5afc5-f322-42ba-94aa-7ffc66b29086"
license = "Elastic License v2"
name = "Potential Hardware Breakpoints Evasion"
os_list = ["windows"]
reference = ["https://github.com/rad9800/hwbp4mw"]
version = "1.0.3"

query = '''
registry where event.action == "modification" and process.executable != null and registry.value == "CachePrefix" and
 process.thread.Ext.hardware_breakpoint_set == true and
 not (process.code_signature.trusted == true and
      process.code_signature.subject_name in ("Roblox Corporation", "Kofax, Inc.", "PACE Anti-Piracy, Inc.", "CUMMINS INC.", "Nuance Communications, Inc.")) and
 not (process.executable : "C:\\Program Files (x86)\\Java\\jre*\\bin\\jp2launcher.exe" and
      process.code_signature.subject_name == "Oracle America, Inc." and process.code_signature.trusted == true) and 
 not (process.executable : "C:\\Program Files (x86)\\iLok License Manager\\iLok License Manager.exe" and 
      process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|wininet.dll|ntdll.dll|kernelbase.dll|wininet.dll|ieframe.dll|windows.storage.dll|ieframe.dll|mshtml.dll|user32.dll|winsparkle.dll|kernel32.dll|ntdll.dll") and 
 not (process.executable : ("C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSACCESS.EXE", "C:\\Program Files (x86)\\Microsoft Office\\Office16\\OUTLOOK.EXE") and 
      process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|wininet.dll|ntdll.dll|kernelbase.dll|wininet.dll|adal.dll|mso30win32client.dll|mso20win32client.dll|kernel32.dll|ntdll.dll")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"