Potential Process Creation via Direct Syscall

[rule]
description = """
Identifies the creation of a process with parent call stack not starting with Windows NT syscall DLLs such as ntdll and
win32u. This may indicate the use of direct system calls to evade endpoint security solutions hooking Windows APIs.
"""
id = "c1738eb3-e6dd-4e84-bc52-b4d48d1fca8f"
license = "Elastic License v2"
name = "Potential Process Creation via Direct Syscall"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
    "https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs",
]
version = "1.0.23"

query = '''
process where event.action == "start" and
 process.parent.thread.Ext.call_stack_summary : "Unbacked|?*" and
 not (process.parent.thread.Ext.call_stack_summary : "Unbacked|embeddedbrowserwebview.dll|Unbacked" and
      _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info : "?:\\Program Files*\\Microsoft\\EdgeWebView\\*\\EmbeddedBrowserWebView.dll*")) and 
 not (process.code_signature.subject_name in~ ("BYFRON TECHNOLOGIES LLC", "Valve Corp.", "Sony Interactive Entertainment LLC", "Roblox Corporation") and process.code_signature.trusted == true) and
 not process.parent.executable :  "?:\\Program Files\\WindowsApps\\ROBLOXCORPORATION.ROBLOX_*\\Windows10Universal.exe" and
 not (process.parent.code_signature.subject_name == "Roblox Corporation" and process.parent.code_signature.trusted == true) and
 not (process.code_signature.subject_name == "Roblox Corporation" and process.code_signature.trusted == true) and
 not (process.parent.thread.Ext.call_stack_summary like "Unbacked|cymemdef64.dll|*" and
       _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info like "C:\\Program Files\\Cylance\\Desktop\\CyMemDef64.dll*")) and
 not (process.executable : "C:\\ProgramData\\Sony Interactive Entertainment Inc\\PSPC_SDK\\*\\crashpad_handler.exe" and
      process.parent.thread.Ext.call_stack_summary == "Unbacked|kernelbase.dll|kernel32.dll|gameoverlayrenderer64.dll|Unbacked")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"