Potential Shellcode Injection via Node.js

[rule]
description = "Identifies shellcode injection from a Node.js application. This may indicate an attempt to evade defenses."
id = "c73a1b0d-bd00-4574-8e98-79c75e918eff"
license = "Elastic License v2"
name = "Potential Shellcode Injection via Node.js"
os_list = ["windows"]
version = "1.0.12"

query = '''
api where process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode", "unbacked_rwx") and
 process.Ext.api.name in ("VirtualProtect", "VirtualProtectEx", "WriteProcessMemory", "VirtualAlloc", "VirtualAllocEx", "MapViewOfFile", "MapViewOfFile2") and
 process.executable != null and process.parent.executable != null and
 process.thread.Ext.call_stack_final_user_module.name like ("ffi_bindings.node",  "node.napi.*.node") and
 not (process.code_signature.trusted == true and
      process.code_signature.subject_name in ("Reolink Innovation Inc.", "Sky International AG", "Ferox Games B.V.", "Tobii AB", "Unify Software and Solutions GmbH & Co. KG", "8x8, Inc.", "Aruba S.p.A.")) and
  not process.executable : ("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe", "D:\\BioStar 2(x64)\\ta\\nodejs-win64\\node.exe") and
  not process.thread.Ext.call_stack_final_user_module.path like ("c:\\program files\\*", "C:\\program files (x86)\\*") and
  process.thread.Ext.call_stack_final_user_module.hash.sha256 != "ca19f3872ed38d98218cf696e477386d27ef1924547ba7aed61eacff32411092" and
  not (process.executable : "C:\\Windows\\Sys*\\cmd.exe" and
       process.parent.executable : ("C:\\ProgramData\\afesta\\GoSign-Desktop\\app-2.3.3\\GoSignDesktop.exe", "C:\\Program Files (x86)\\Bit4Id\\UKC\\UKC\\bin\\kchain.exe"))
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"