Potential Process Creation via ShellCode

[rule]
description = """
Identifies the creation of a process where the creating thread's stack contains frames pointing outside any known
executable image and using commonly used Windows APIs like WinExec. This is a common pattern for code injection using
default offensive shellcode templates.
"""
id = "58b996a5-634c-4205-9ffa-a6f2b8ebc1ad"
license = "Elastic License v2"
name = "Potential Process Creation via ShellCode"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.20"

query = '''
process where event.action == "start" and

process.parent.thread.Ext.call_stack_contains_unbacked == true and

 (process.parent.thread.Ext.call_stack_summary : "*kernel32.dll|Unbacked*" and
  _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info : "*kernel32.dll!WinExec*")) and

not (process.code_signature.trusted == true and
     process.code_signature.subject_name : ("GIGA-BYTE TECHNOLOGY CO., LTD.", "Intuit Inc", "Ramsauer und Stuermer Software GmbH",
     "Aptean, Inc.", "MICRO-STAR INTERNATIONAL CO., LTD.")) and

not (process.executable : "C:\\Windows\\System32\\sc.exe" and process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and
     process.command_line : "sc start LenovoPcManagerService") and
not process.executable :
                ("C:\\Program Files (x86)\\Ponds33\\Refined Method\\Main.exe",
                 "C:\\Program Files (x86)\\Ponds33\\Underdrain\\UDMain.exe",
                 "C:\\Program Files (x86)\\Ponds33\\NPCalc\\NPCalcMain.exe")
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"