Potential Shellcode Injection via a WebShell

[rule]
description = """
Identifies the call of code injection related Windows API with suspicious parameters that align with shellcode execution
and where the call stack is pointing to an IIS Web application as the source of the injection.
"""
id = "38da66fc-171f-49f6-9144-bac4abb2f47b"
license = "Elastic License v2"
name = "Potential Shellcode Injection via a WebShell"
os_list = ["windows"]
version = "1.0.7"

query = '''
api where process.name : "w3wp.exe" and
(
 (process.Ext.api.name in ("MapViewOfFile", "MapViewOfFile2", "VirtualAlloc", "VirtualAllocEx", "VirtualProtect", "VirtualProtectEx", "WriteProcessMemory") and
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection_provenance like "app_web_*.dll" and $entry.symbol_info == "Unbacked")) or

 (process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
  process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and process.Ext.api.metadata.target_address_name == "Unbacked" and
  process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and
  process.Ext.api.name in ("MapViewOfFile", "MapViewOfFile2", "VirtualAlloc", "VirtualAllocEx", "VirtualProtect", "VirtualProtectEx", "WriteProcessMemory", "connect") and
  (process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\microsoft.net\\framework*\\clr.dll" or
   process.thread.Ext.call_stack_final_user_module.protection_provenance == "clr.dll") and
   process.Ext.api.parameters.size != 5 and process.Ext.api.parameters.size != 10 and process.Ext.api.parameters.size != 40 and
   process.Ext.api.behaviors != "hook_api" and
   process.thread.Ext.call_stack_summary in
                ("ntdll.dll|kernelbase.dll|Unbacked",
                 "ntdll.dll|Unbacked",
                 "ntdll.dll|mswsock.dll|ws2_32.dll|Unbacked",
                 "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked"))
 ) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.callsite_trailing_bytes like "41c6470c01833d*88bc641c6470c01488b559049895710488d65c85b5e5f415c415d415e415f5dc3001910")
'''

min_endpoint_version = "8.14.2"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"