Potential Shellcode Injection via CLR

[rule]
description = """
Identifies attempts to allocate or execute shellcode from unbacked memory and where the protection provenance of the
unbacked region is coming from the Microsoft Common Language Runtime DLL.
"""
id = "1370f164-1809-4668-ad6c-dbf5bd278120"
license = "Elastic License v2"
name = "Potential Shellcode Injection via CLR"
os_list = ["windows"]
version = "1.0.12"

query = '''
api where
    process.executable != null and process.parent.executable != null and
    process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
    process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory", "VirtualProtectEx", "VirtualAllocEx",
                             "MapViewOfFile", "MapViewOfFile2", "SetThreadContext", "SuspendThread", "ReadProcessMemory", "connect") and
    process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
    process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Unbacked*", "clr.dll", "mscorwks.dll", "coreclr.dll", "*.exe*") and
    (
      process.thread.Ext.call_stack_final_user_module.protection_provenance in ("clr.dll", "mscorwks.dll", "coreclr.dll")  or
      process.thread.Ext.call_stack_final_user_module.protection_provenance_path like 
                                         ("c:\\windows\\microsoft.net\\framework*\\clr.dll", 
                                          "c:\\program files*\\dotnet\\shared\\microsoft.netcore.app\\*\\coreclr.dll", 
                                          "c:\\windows\\microsoft.net\\framework*\\mscorwks.dll")
    ) and 
    _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry,
                  $entry.trusted == true and $entry.subject_name in ("Microsoft Corporation", "Microsoft Windows", ".NET")) and 
    process.thread.Ext.call_stack_summary :
                        ("ntdll.dll|Unbacked",
                         "ntdll.dll|kernelbase.dll|Unbacked",
                         "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
                         "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
                         "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                         "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|kernel32.dll|ntdll.dll",
                         "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
                         "ntdll.dll|mswsock.dll|ws2_32.dll|Unbacked",
                         "wow64cpu.dll|wow64.dll|ntdll.dll|mswsock.dll|ws2_32.dll|Unbacked|kernel32.dll|ntdll.dll") and
    not process.Ext.api.parameters.size < 1000 and
    /* trailing bytes are not null */
    _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and $entry.callsite_trailing_bytes : "?*") and
    /* EOIM FPs */
    not _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.callsite_trailing_bytes : ("85c07472ff15942c*3d33270000747989c76a02e84a4359ff*",
                                                      "c9c3558bec51894dfc8b4dfce8b9ffffff8*",
                                                      "c9c20400558bec51894dfc8b45f*",
                                                      "e9fefdffffb001c9c20800558bec81e*",
                                                      "e9e8fdffffb0018be55dc20400*",
                                                      "85c00f95c05e5dc3cccccc5589e5535*",
                                                      "85c0740533c040eb3b837d10047516*",
                                                      "41c6470c01833*5f007406ff15*49895710488d65c85b5e5f415c415d415e415f5dc*",
                                                      "41c6470c01*41c6470c01488b55*",
                                                      "41c64*f007406ff15*",
                                                      "*10488d65c85b5e5f415c415d415e415f5dc3*",
                                                      "488b5560c6420c*48894570488b4d00e84300000090488b4570488b5560c642*",
                                                      "488b558*c6420c*007406ff15*",
                                                      "c6470c01*007406ff15*",
                                                      "85c00f95c05*",
                                                      "8be55dc3cccccccccccc558bec*",
                                                      "41c6470c01833d*",
                                                      "c6470c0148ba*7f0000ff11488bf0e8*",
                                                      "41c6460c0148ba4810*7f0000833a00740c48b9d819*",
                                                      "*48894e104883c4785b5e5f415c415d415e415f5dc*",
                                                      "488b5560c6420c01833d*7406ff15*",
                                                      "41c6460c0148ba*7f0000833a00740c48b9*",
                                                      "c6470c0148ba48*833a00740c48b9*",
                                                      "c6470c0148ba*833a00740c48b9*",
                                                      "488b957*ffffffc6420c01833d*",
                                                      "488b5560c6420c01*833a00740c*",
                                                      "488b55*7f0000833a00740c48b928f2*",
                                                      "41c6460c01833d*",
                                                      "c2140090b851000000ba*",
                                                      "c2140090b851000000ba5091*77ffd2c2140090b852000700ba509*",
                                                      "883c438c3cccccc8954241048894c24084883ec28488b4c24*",
                                                      "4883c438c3cccccc44884c24204489*",
                                                      "488b4c246048894108488b44246048837808007529*",
                                                      "41c644240c0148ba48202f12f87f0000833a00740c48b9f8292f12f87f0000ff118bf0e816b4ed5e85f60f95c00fb6c00fb6c041c644240c01488b5588498954",
                                                      "41c644240c01*85f60f95c00fb6c00fb6c041c644240c01488b55884989542410488d65c85b5e5f415c41",
                                                      "8bf04785f674a48bc65f5e5b8be55dc385f675f353ff75f8ff75f46a00ff150c07840a5f5e5b8be55dc3558beca11c45290b83ec2456578bfa85c075368d45dc",
                                                      "8d4c2410e8ba2cb2ff8b8c240c0100008bc75f5e33cce824b020028be55dc3cccccccc558bec83ec18a1fc55310b33c58945f8538b5d18568b7508578bf983fa",
                                                      "85c00f848f000000ff15f2a3cc0a3d332700000f859f000000488bb698000000488d7e78488d15d8264f0a4c8d059a284f0a488d5c24304889d941b9d2000000",
                                                      "85c07407b801000000eb4e837c2440047520e8960000004c8b4c244841b808000000488b542438488b4c2430ffd0eb29eb25837c244040751ee86f0000004c8b",
                                                      "488b55??c6420c0148ba14d536dbf97f0000833a00740c48b928f235dbf97f0000ff114*", 
                                                      "488b9570ffffffc6420c01833d*488b458048894590488b45904889459890909090909090488b*",
                                                      "85c0746bff1528c2900f3d33270000747289c76a02e86d3378ff83c40484c0743a8d5c240489d96a0268600300006838a6320fe82f3478ff8d4424086a106838",
                                                      "488b9570ffffffc6420c01833de9835d5a007406ff15718d5d5a48894580e8a0ddb45990488b458048894590488b45904889459890909090909090488b459848",
                                                      "8985271f001056e8f60300008d8dbd1d001085c00f859400000056e84003000056e85502000056e85301000090909090909090908b4e3485c90f848900000003",
                                                      "488b5560c6420c01833d6a70c85f007406ff15768dc75f488bf0e8165a4a5f48897570488b4d00e84300000090488b4570488b5560c6420c01488b5560488b4d",
                                                      "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
                                                      "488b454833c9394804742a48894c24284533c94c8bc3894c242033d2ff97900000004885c0741083caff488bc8ff9788000000eb02ffd3488b4d504c8d4d4041",
                                                      "488b4d50458bc433d2e82019000041807d00007429488d46ff4883f8fd771fff97b8000000488b5550488bc8ff9750020000488b4df8ff97f8000000eb0f488b",
                                                      "0fb747064503f44883c628443bf00f826bffffff448badb80000004533c033d24883c9ffff55084439bfd400000074248b87d0000000488b741818eb0f4533c0",
                                                      "85c074*33270000747*89c76a02e8*ff83c40484c074*",
                                                      "85c074508b45146a0168001000000500f0ffff680010000003c650ffd785c08b4510741c8b4dfc050010000003c65056e8e8e6ffff5f5eb0015b8be55dc21000")) and
    not (process.thread.Ext.call_stack_final_user_module.protection_provenance in ("tiptsf.dll", "mscms.dll") and 
         process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\microsoft.net\\framework*\\mscorwks.dll") and 
    not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like 
                                                            ("c:\\windows\\assembly\\nativeimages_*\\smdiagnostics.ni.dll", 
                                                             "c:\\program files (x86)\\ibm\\client access\\*\\cwbsomri.dll", 
                                                             "c:\\program files (x86)\\panasonic\\idrengine\\idrjchar.dll",
                                                             "c:\\windows\\assembly\\nativeimages_*\\newtonsoft.json\\*\\newtonsoft.json.ni.dll") and
    not (process.Ext.api.name == "VirtualProtect" and
         _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*", "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*"))) and
    not process.Ext.api.metadata.target_address_path :
                             ("?:\\program files\\sap businessobjects\\office addin\\plugins\\analysisoffice\\bixllfunctions.dll",
                              "?:\\program files (x86)\\viewplus\\tss?\\lib64\\htbrl.dll",
                              "?:\\program files (x86)\\vyaire\\sentrysuite\\vasservicedataclient.dll") and
    not process.executable : ("?:\\Program Files (x86)\\CrystalScheduler\\crexport.exe", 
                              "?:\\Program Files (x86)\\Bus\\Buscube64.exe", 
                              "?:\\Program Files (x86)\\ETS5\\ETS5N.exe",
                              "?:\\Program Files (x86)\\ATAS Platform\\OFT.Platform.exe", 
                              "?:\\Program Files\\Aseproda\\VirtusTPV Net\\VirtusTPVNet.exe",
                              "?:\\Program Files (x86)\\VisualCron\\VisualCronClient.exe",
                              "?:\\Program Files (x86)\\Citrix\\ICA Client\\Receiver\\Receiver.exe",
                              "C:\\Program Files\\Magnet Forensics\\Magnet AXIOM\\AXIOM Process\\AXIOMProcess.exe",
                              "?:\\Program Files (x86)\\SquareEnix\\FINAL FANTASY XIV - A Realm Reborn\\game\\ffxiv_dx11.exe",
                              "C:\\Program Files (x86)\\Mitel\\MiContact Center\\Applications\\Ignite\\Ignite.exe",
                              "C:\\Program Files (x86)\\SolarWinds\\Orion\\ExportToPdfCmd.exe",
                              "C:\\Program Files (x86)\\SolarWinds\\Orion\\WebsiteMaintenance.exe",
                              "C:\\Program Files (x86)\\QSR Automations\\ConnectSmart\\KitchenReportViewer\\Bin\\ReportViewer.exe") and
    not (process.code_signature.trusted == true and 
         process.code_signature.subject_name in ("Ro-ot Service AG", "Connectwise, LLC", "SQUARE ENIX CO., LTD.", "Bluebeam, Inc.", "ANSYS Inc.", "Trimble Solutions Corporation", "Environmental Systems Research Institute, Inc.", "Acuant, Inc", "GB Group plc", "FUJIFILM Healthcare Americas Corporation", "Anego Studios SIA")) and
    not (process.parent.executable : "C:\\Windows\\SysWOW64\\rundll32.exe" and process.executable : "C:\\Windows\\SysWOW64\\rundll32.exe" and
         process.command_line : "* --enable-speech-input *")
'''

min_endpoint_version = "8.14.2"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"