Potential Masquerading as Windows Error Manager

[rule]
description = """
Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching a
suspicious parent call stack. This may be indicative of a masquerading attempt to evade suspicious child process
behavior detections.
"""
id = "ace0bb76-290f-4f5f-a21f-c3b13ee415a9"
license = "Elastic License v2"
name = "Potential Masquerading as Windows Error Manager"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
    "https://www.elastic.co/security-labs/revisiting-blister-new-developments-of-the-blister-loader",
    "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
]
version = "1.0.30"

query = '''
process where event.action == "start" and
 process.name : ("WerFault.exe", "wermgr.exe", "WerFaultSecure.exe") and
 process.parent.thread.Ext.call_stack_summary : "*|*" and
 not process.parent.thread.Ext.call_stack_summary : ("*faultrep.dll*", "*wersvc.dll*", "*|wer.dll|*", "*|ubpm.dll|*", "*|cbscore.dll|rpcrt4.dll*") and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry,
                  $entry.symbol_info: ("*kernel32.dll*!Wer*",
                                       "*KernelBase.dll*!UnhandledExceptionFilter*",
                                       "*kernel32.dll*!BasepReportFault*",
                                       "*combase.dll!CoSetErrorInfo*",
                                       "?:\\Program Files\\*.dll*", 
                                       "?:\\Program Files (x86)\\*.dll*",
                                       "?:\\Windows\\System32\\dataclen.dll*Purge*",
                                       "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\*!WerpLaunchAeDebug*",
                                       "?:\\Windows\\System32\\tmumh\\*.dll*",
                                       "*kernel32.dll*!WerpLaunchAeDebug*",
                                       "?:\\Windows\\System32\\SettingsHandlers_StorageSense.dll!GetSettingForUser*",
                                       "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\*!UbpmTriggerConsumerQueryStatus*",
                                       "?:\\Windows\\System32\\SettingsHandlers_StorageSense.dll!DllGetActivationFactory*",
                                       "?:\\Windows\\System32\\dataclen.dll!DllCanUnloadNow+*", 
                                       "?:\\Windows\\System32\\CsXumd64_*.dll+*", 
                                       "*Acrobat.exe!IsSandboxedProcess*", 
                                       "*AcroRd32.exe!IsSandboxedProcess*", 
                                       "C:\\Temp\\tmmon64.dll+*", 
                                       "*\\PendingDeletes\\$$DeleteMe*", 
                                       "*ntdll.dll+0*", 
                                       "*KernelBase.dll+0x*",
                                       "*ntdll.dll!RtlCreateProcessReflection*", 
                                       "*ntdll.dll!RtlInitializeExceptionChain*", 
                                       "*dataclen.dll!?Purge*", 
                                       "*dataclen.dll!DllCanUnloadNow*", 
                                       "*shell32.dll!AssocCreateForClasses*")) and
 not process.parent.thread.Ext.call_stack_summary in
                                ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|wow64win.dll|ntdll.dll",
                                 "ntdll.dll|kernelbase.dll|kernel32.dll|Unknown|ntdll.dll|kernel32.dll|ntdll.dll",
                                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|dtframe32.dll",
                                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|acrord32.exe|ntdll.dll|kernel32.dll|ntdll.dll",
                                 "ntdll.dll|kernelbase.dll|kernel32.dll|werfault.exe|kernel32.dll|ntdll.dll",
                                 "ntdll.dll|kernelbase.dll|Unknown|ntdll.dll|kernel32.dll|ntdll.dll",
                                 "ntdll.dll|kernelbase.dll|hmpalert.dll|kernelbase.dll|kernel32.dll|werfault.exe|kernel32.dll|ntdll.dll",
                                 "ntdll.dll|kernelbase.dll|kernel32.dll|appxdeploymentserver.dll|svchost.exe|sechost.dll|kernel32.dll|ntdll.dll",
                                 "sysfer.dll|kernelbase.dll|kernel32.dll|appxupgrademigrationplugin.dll|kernel32.dll|ntdll.dll",
                                 "ntdll.dll|kernelbase.dll|kernel32.dll|appxdeploymentserver.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                                 "ntdll.dll|kernelbase.dll|kernel32.dll|Unknown|cbscore.dll|wcp.dll|ucrtbase.dll|wcp.dll|ntdll.dll|wcp.dll|cbscore.dll|tiworker.exe|rpcrt4.dll|combase.dll|rpcrt4.dll|combase.dll|rpcrt4.dll") and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "488945???88b4d*") and
 /* Trellix */
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "488945*48894810488b4500ff50*")
'''

min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"