Potential Image Load with a Spoofed Creation Time

[rule]
description = """
Identifies the load of a library with a modified file creation time. Adversaries may modify file time attributes to
blend malicious content with existing files. Timestomping is a technique that modifies the timestamps of a file often to
mimic files that are in trusted directories.
"""
id = "69b2dd59-13ba-4bda-8d0d-cf0e28eb1323"
license = "Elastic License v2"
name = "Potential Image Load with a Spoofed Creation Time"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1070/006/",
    "https://posts.specterops.io/revisiting-ttps-timestomper-622d4c28a655",
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.32"

query = '''
sequence with maxspan=5m
 [file where event.action == "creation" and file.Ext.header_bytes : "4d5a*" and

  not user.id : "S-1-5-18" and

  file.path : ("?:\\Windows\\system32\\*", "?:\\Windows\\SysWOW64\\*", "?:\\Program Files\\Microsoft\\*",
               "?:\\Program Files (x86)\\Microsoft\\*", "?:\\Users\\Public\\*", "?:\\ProgramData\\*",
               "?:\\Program Files\\Google\\Chrome\\*.dll", "?:\\Program Files\\Internet Explorer\\*.dll",
               "?:\\Program Files\\Mozilla Firefox\\*.dll") and

  not process.executable :
             ("?:\\Windows\\system32\\msiexec.exe",
              "?:\\Windows\\SysWOW64\\msiexec.exe",
              "?:\\windows\\system32\\drvinst.exe",
              "?:\\windows\\SysWOW64\\drvinst.exe",
              "C:\\Windows\\System32\\Robocopy.exe",
              "?:\\Program Files (x86)\\*.exe",
              "?:\\Program Files\\*.exe",
              "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe") and

  not (process.code_signature.subject_name : ("Mozilla Corporation", "Google LLC", "JACK HENRY & ASSOCIATES, INC.") and 
       process.code_signature.trusted == true) and
  not file.path : ("?:\\ProgramData\\chocolatey\\tools\\detector\\*.dll",
                    "?:\\ProgramData\\chocolatey\\tools\\*.dll",
                    "?:\\ProgramData\\chocolatey\\lib\\*") and
  not (process.name : "xcopy.exe" and file.extension == "pyd")
  ] by file.path as event0
 [library where

  /* set to 6months, malwares often spoof creation times to at least 1 years */
  dll.Ext.relative_file_creation_time >= 15778476 and

  /* 5m */
  dll.Ext.relative_file_name_modify_time <= 300 and

  not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and

  dll.path : ("?:\\Windows\\system32\\*", "?:\\Windows\\SysWOW64\\*", "?:\\Program Files\\Microsoft\\*",
               "?:\\Program Files (x86)\\Microsoft\\*", "?:\\Users\\Public\\*", "?:\\ProgramData\\*",
               "?:\\Program Files\\Google\\Chrome\\*.dll", "?:\\Program Files\\Internet Explorer\\*.dll",
               "?:\\Program Files\\Mozilla Firefox\\*.dll") and

  not startswith~(dll.name, process.name) and

  event0.process.executable != process.executable and

  not (process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
       not process.executable : ("?:\\Program Files*\\Microsoft\\*.exe", "?:\\Program Files*\\Google\\Chrome\\*.exe",
                                 "?:\\Program Files*\\Internet Explorer\\*.exe", "?:\\Program Files*\\Mozilla Firefox\\*.exe")) and

  not dll.hash.sha256 :
             ("9ac63dcf5a2437ed43cb143479ec4a810915017d8eb138a7fede88867e2a8121",
              "8bbe5898caa826ac1cb99d6c01c8a5ee9bb660493d2a48c9294d837390f7bae2",
              "42a0d4dca77d4ce7077c18e08b1d49715d6b1038e147611106388aec3e422c82",
              "6e12069312e286307a12ba71228e720e890d242191eb07d0e769630b600098b3",
              "0ae555e24450606fe86938be0450310e8d0da7cd8b661ed79c6f4dc6747cfd95",
              "8180f736781f2af47059a83c73c2c8b9f4423fc764c8897ac7c4f6dd8837a804",
              "c3823447efb2fe8690861541f23890bf5b7a36f40a9c282f4cb33cc3bb3d4689",
              "6324bf7d034935c2781fcef00a9c7b414ffdba4578f5368e09dc892cd49e3ecd",
              "6948e30a0d0eac9584071430d93f4e49645cbaf73ef821d723de6bc00ff13f79",
              "a11c83a10cdcfec7eea0a81ebbcb057513549897c1bdf559dcfb108ace06277f",
              "cd125611cdb5f3a74ee952951a692ee598daa5a7491e87676a4f68930117bb2a",
              "f9032348386637e55788348dc8ed5879daee978be8ab77cd42b0316427d6fbc8",
              "1a45f5985273d2372a352c07db6a15382780d6fce47d36195c6d1c5822c169b7",
              "53b7f8c0e4cb7bc41535985b114a04e7ad95c272a89e193119606e6160974ad5",
              "81c3bfbac5b40c20b4f6408de6b4afc5559517f100d8cb01f9a8f6805026ecf0",
              "e0d2c341e9c16d31e60ffdcbb5f84d49212f5fe695b41c9982eee3e9be5d07d8",
              "19112c6eef7ffc162245d7e19c8601fa49ccd239076ac32d3fe0ad9d0afb3e0b",
              "3430b3680415b494ba7eb41f7bc83933da68d364a94287b9c07384b2fe3dcb54",
              "aa106076e82a3acc62184d51817ae6619da0772cc964530fd843302d29ffb97d",
              "3016d572ea5e695b52b1759432dd30b7a9cbc2b53ac42e8c7735854b464e7d34",
              "b49f071ff276262190c6cc86dceab4936a4786428a834151a17b6845911748e8",
              "4a8fac0d6b09cc3fb57fd063af8b1a332080df5b0e2ff3710a82c109a4eee07c",
              "1ec927f25e4fcd1b5863fe3a0a60c2e8800467d5ed5148a917503b9cb6e9acf8",
              "9a75fd5816a220ab15248f0f337dfe5385fd053617c17742005cb63f126a11b0",
              "51075af59f6696d5dc5446ba39fabfd0022628cdcfa41c80e7cb66e3bf4ee55d",
              "585e2e465bf77e3daa25de7dcba5fac0606ae4a0e029903158d85ae0b1805f34",
              "a575175338706d1473e2bebe1cd811283c63c697a17c0865de85ede345898af6",
              "8dd93adc6e06cb7a404d259e59b644ad49b69a5d4215de607baf659fabfb2c4c") and
  not (process.code_signature.subject_name : ("Epicor Software Corporation", "KONICA MINOLTA, INC.", "3CX Ltd",
                                              "WZT", "Tendyron Corporation", "INTUIT INC.",
                                              "MEDENT (Community Computer Service Inc.)", "Pitney Bowes Inc.",
                                              "Bedford, Freeman & Worth Publishing Group, LLC",
                                              "PFU Limited",
                                              "Watchdata Technologies Pte. Ltd.",
                                              "WINMAN SOFTWARE INDIA LLP",
                                              "Voicebrook Inc",
                                              "CHENGDU YIWO Tech Development Co., Ltd.",
                                              "Benner Sistemas S/A",
                                              "Daybreak Game Company LLC",
                                              "CANON INC.",
                                              "Halliburton Company",
                                              "Mozilla Corporation") and
       process.code_signature.trusted == true) and
  not (dll.code_signature.subject_name : ("Mozilla Corporation", "Google LLC") and dll.code_signature.trusted == true) and
  not process.executable : "?:\\Windows\\SysWOW64\\regsvr32.exe"
  ] by dll.path
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"
[[threat.technique.subtechnique]]
id = "T1070.006"
name = "Timestomp"
reference = "https://attack.mitre.org/techniques/T1070/006/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"