Potential NTDLL Memory Unhooking

[rule]
description = """
Identifies the load of NTDLL for the second time and followed by another activity from a call stack with a modified
NTDLL memory section. This may indicate an attempt to patch or modify the NTDLL memory region to evade endpoint security
solutions hooking Windows APIs.
"""
id = "d7bc9652-fe82-4fb3-8a48-4a9289c840f8"
license = "Elastic License v2"
name = "Potential NTDLL Memory Unhooking"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
    "https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs",
]
version = "1.0.30"

query = '''
sequence by process.entity_id with maxspan=1m
 [library where dll.name : "ntdll.dll" and

  /* ondisk copy  of NTDLL mapped in memory */
  dll.Ext.load_index >= 2 and
  _arraysearch(process.thread.Ext.call_stack, $entry,
               $entry.symbol_info: ("?:\\Windows\\Sys*\\KernelBase.dll!MapViewOfFile*", "?:\\Windows\\Sys*\\ntdll.dll!*MapViewOfSection*")) and

  /* no private bytes in ntdll memory allocation */
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.allocation_private_bytes > 0 and $entry.symbol_info: "?:\\windows\\sys*\\ntdll.dll*") and

  /* FACEIT Anti-Cheat Launcher */
  not (process.code_signature.subject_name : 
           ("FACE IT LIMITED", "Kaspersky Lab JSC", "Check Point Software Technologies Ltd.", "COGNOSPHERE PTE. LTD.", 
            "Bright Star Engineering Inc.", "Carlson Software", "Electronic Arts, Inc.", "ESL Gaming GmbH", "FunPlus International AG",
            "KURO TECHNOLOGY (HONG KONG) CO., LIMITED", "Exbo North LLC", "PROXIMA BETA PTE. LIMITED", "DVDFab Software Inc.",
            "Asseco South Eastern Europe SA", "Palo Alto Networks (Netherlands) B.V.", "Alfa Bravo Inc.",
            "UBISOFT ENTERTAINMENT INC.", "Vidus Technology Limited", "FingerTas Solutions Co.,Ltd", "KRAFTON, Inc.",
            "CyCraft Technology Corporation, TAIWAN BRANCH (CAYMAN)", "Bytedance Pte. Ltd.", "Ubisoft Entertainment Sweden AB",
            "unlocktool.net", "Qinhuangdao Yizhishu Software Development Co., Ltd.", "Sony Interactive Entertainment LLC",
            "NetEase (Hangzhou) Network Co., Ltd", "ETH Zürich", "Wilcom International Pty Limited",
            "miHoYo Co.,Ltd.", "Azul Systems, Inc.", "Shanghai Feilai Information Technology Co., Ltd.", "BattlEye Innovations e.K.",
            "NCSOFT Corporation", "Tenorshare (Hongkong) Limited", "CAPCOM CO., LTD.", "Micromine Australia Pty Ltd",
            "Zhuhai Kingsoft Office Software Co., Ltd.") and
       process.code_signature.trusted == true) and

  not process.executable : ("?:\\Program Files (x86)\\FunPlus\\Stormshot\\nGame\\3.16.100\\Stormshot.exe",
                            "?:\\Program Files (x86)\\TurboServiceMobile\\TurboServiceMobile.exe",
                            "?:\\Program Files (x86)\\Zhizhen\\Zhizhen\\zhizhen.exe") and

  not (process.executable : "?:\\Windows\\System32\\taskhostw.exe" and user.id == "S-1-5-18" and
       _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.symbol_info : ("?:\\Windows\\System32\\sysmain.dll!AgTwLoad*",
                                          "?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\*\\sysfer.dll*"))) and
  not (user.id == "S-1-5-18" and process.executable : "?:\\Program Files (x86)\\Acunetix\\*\\wvsc.exe") and
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.symbol_info: ("?:\\program files*\\avg\\antivirus\\aswhook.dll*",
                                        "?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\*\\Data\\Sysfer\\*\\sysfer.dll*",
                                        "?:\\Program Files\\ESET\\ESET Security\\ebehmoni.dll*",
                                        "?:\\Program Files\\ESET\\ESET Endpoint Antivirus\\ebehmoni.dll*",
                                        "?:\\Program Files\\Avokado\\Viruskerajs\\ebehmoni.dll*",
                                        "?:\\Windows\\System32\\sxwmon64.dll*",
                                        "?:\\Program Files\\Palo Alto Networks\\Traps\\cysvc.dll*")) and
  not process.executable :
                   ("C:\\Program Files\\Microsoft\\jdk-*-hotspot\\bin\\javaw.exe",
                    "C:\\Program Files (x86)\\FunPlus\\Stormshot\\nGame\\4.15.0\\Stormshot.exe",
                    "C:\\Program Files (x86)\\Supertone Shift\\Supertone Shift.exe",
                    "C:\\Program Files\\Synthesizer V Studio Pro\\synthv-studio.exe",
                    "C:\\Program Files (x86)\\Octoplus\\Octoplus_Samsung\\OctoplusSamsungNew.exe") and
  not process.thread.Ext.call_stack_summary in ("ntdll.dll|ace-drv64.dll")
  ]
 [any where

   /* potentially ntdll was modified in memory to unhook or patch a function */
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.allocation_private_bytes > 8000 and $entry.symbol_info: "?:\\windows\\sys*\\ntdll.dll*") and

  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.symbol_info: ("?:\\program files*\\avg\\antivirus\\aswhook.dll+*",
                                        "?:\\ProgramData\\Symantec\\Symantec Endpoint Protection\\*\\Data\\Sysfer\\*\\sysfer.dll*",
                                        "?:\\Program Files\\ESET\\ESET Security\\ebehmoni.dll*",
                                        "?:\\Windows\\System32\\sxwmon64.dll*")) and

  not (event.category == "api" and process.Ext.api.parameters.size <= 4096 and
       ((process.code_signature.subject_name == "unlocktool.net" and process.code_signature.status =="errorUntrustedRoot") or
        process.thread.Ext.call_stack_final_user_module.hash.sha256 in ("2be89bd37bab3d9d7c08360cc062790450bee504ac689d1d0aa61da1ca2a7b64",
                                                                        "c4fcf0187e7fbf6939b08e929e10eb9eb5c1e4a45849cae6a677451249db066e",
                                                                        "5eed55767870ff871513789d8bbdc3343dfe3e0aff2c28faccdfe4c2c881da07",
                                                                        "f239e80bd672e0b33e9a8a9bf8a379b8b2df799e6462d2231b4ee5aa9d66f52a",
                                                                        "492664b28b0880fafe8dcb6fff020e185f08d3615b2fbf10828f85e95c68f8a1")))
  ]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"