Potential Suspended Process Code Injection

[rule]
description = """
Identifies attemtps to write to the address space of a remote process that was started in a suspended state and by an
unsigned or untrusted final user module. This behavior is consistent with remote code injection attacks.
"""
id = "47167118-ba42-48e8-8555-dd50d98d21c4"
license = "Elastic License v2"
name = "Potential Suspended Process Code Injection"
os_list = ["windows"]
version = "1.0.17"

query = '''
api where process.Ext.api.name  == "WriteProcessMemory" and
 process.Ext.api.parameters.size >= 4000 and

 /* target process created suspended */
 Target.process.Ext.created_suspended == true and process.Ext.api.behaviors == "cross-process" and

 /* WPM triggers multiple times at process creation */
 not _arraysearch(process.thread.Ext.call_stack, $entry, 
                  $entry.symbol_info like ("*\\kernelbase.dll!CreateProcess*", "*\\kernelbase.dll+0x*", "c:\\windows\\*\\advapi32.dll!CreateProcessAsUser*", "*\\kernel32.dll!CreateProcess*")) and
 not (process.Ext.api.summary like ("*PEB*", "*PEB32*",  "*ProcessStartupInfo*") and process.thread.Ext.call_stack_summary like "*Unknown*") and

 /* unsigned or untrusted code signature */
  _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) and

 /* excluding multiple unsigned third party modules from programfiles */

  not process.thread.Ext.call_stack_final_user_module.path like
                             ("?:\\windows\\assembly\\nativeimages_*.dll",
                              "?:\\program files\\*",
                              "?:\\program files (x86)\\*",
                              "c:\\windows\\apppatch\\ummon.dll",
                              "c:\\windows\\apppatch\\apppatch64\\ummon.dll",
                              "c:\\windows\\system32\\ctiuser.dll",
                              "c:\\windows\\syswow64\\ctiuser.dll",
                              "c:\\windows\\system32\\lsasrv.dll") and
  not process.thread.Ext.call_stack_final_user_module.protection_provenance == "mfehcthe.dll" and
  /* once 8.15.0 schemas are added remove mfehcthe.dll exclusion and add the following line */
  /* add the following exclusion */
  /* not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like ("?:\\program files\\*", "?:\\program files (x86)\\*") and */
  not process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Undetermined", "Kernel") and
  /* bash and gbp */
  not (process.Ext.api.metadata.target_address_name like ("Data", "msys-*", "cyg*.dll") and
       process.thread.Ext.call_stack_summary like
                                                ("ntdll.dll|kernelbase.dll|msys-?.?.dll|*Unknown",
                                                 "ntdll.dll|kernelbase.dll|cygwin?.dll|*Unknown",
                                                 "ntdll.dll|kernelbase.dll|cygwin?.dll|bash.exe",
                                                 "ntdll.dll|kernelbase.dll|cygwin?.dll",
                                                 "ntdll.dll|kernelbase.dll|msys-?.0.dll")) and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                  ("27fe00d32f773a95e6d50986e5e7499917f66ce881e46054c77652ef4bdf3512",
                                   "a59e039e1520b74254a454bf48c2bceeafe7bd7ac6e5886baa482a52f86a29bf",
                                   "f01bb9aba3f9daf4d8f5551a3b753d8011e16072a1103cf5303d617a9f866424",
                                   "16184cf6f54d6ac4eb0a31c0e9ee8ae775bae6dfdc632e283e832f3e89de595d",
                                   "c983d11ad519a851aca2d37739110b7913819bea1ddf2cc3ec69efe3ed3b609f",
                                   "c3cd2439a6175ce28192904e72b14523b02559d8083a710b5e82aee400626d1a",
                                   "7396f943823494d2ec5f2260329daa2d35b1764f01cdefd95f84ae320986a8f3",
                                   "efd03f2525e69cdc30b5736af74d9485728b8a94d5624da87f1431b3706980ab",
                                   "8eb0721092af3131a940f1e23bc2871e09362980e0b71a7ed7dab6e8accd1f30",
                                   "6edb20df25d1cf0fd1b27052f2604a05db1d7ca5a3f074e7bacc229e28d17667",
                                   "67435999749d9e6908a4029321c0c6f9e915135e98e01a7e499a1c55a960bc68",
                                   "914299dd77f4322c99f62c37df1317ea3424d9a747d4635d10c1d3f003f6abd4",
                                   "51b63860fd996d6d5b1753ba6bb7f3a4303f13187fbfecc96ba2b6bae52a7410",
                                   "0255b5bf7ad66aa090be145f0ad41a0f4e33409ff5c2970081fccd863c720779",
                                   "925a5cd982933bae1b271e1aaaa887ab469397701cd299f4397ddd8af5a351f9",
                                   "9cb1208f1747963dc57e8bf8a8fe82b3aaa856caae3d151b6a6b97b23369f5a6",
                                   "681303f5b5688075b5b504819d8b3c343c78e3240a3bccf371e03228970ffb10",
                                   "30b59303bec45b020b4878b2d33d63bd719d89820456a7ee0a920178efe089f4",
                                   "8ee5bd6fea98577bd29c15055e96ec17c62ca415f4a5d26065b25a922b19d3b1",
                                   "57854d83b50ff0a23d47c077d6da875874ea78f88f28168d8e99ffbf9f1c3153",
                                   "c4788275a5ed2c1576e69b59e6e267ce573450ff07e54b799ec4c4edef40b502",
                                   "a4637935f895de601850c6868d952977a84076a7b1719d0deb519f1fc0871be4",
                                   "a99ac2554c1e392ffe3cd53f7f72f76638948533795fc04f7e15454c386b7eec",
                                   "b031da6137f9442a6cc9f4b4546b4057b666726cb7c9224c4ca857a60f2ec1e1",
                                   "586d8eeaec3a439978836a512bf2f5a987cbe2ba72e5bb10322d04cd65fe8d09",
                                   "ebdc2c2cedd5e549ba8d5e3f474d29204e1cf073e2b26e75f60bb429d2b5a088",
                                   "80eb757f729a943ff0919df1eb980b80f8419f76648407834d95c76adfd21624",
                                   "e71eb30f24c82bc4fa1c645eecbe343f5a44526043fc3a13047183dac5f212f3",
                                   "c46f9f3c710ff2baabea480670220e0328e7bcc2aa3c598c3f982728e0b5652d",
                                   "7f1ab7572a89534366172df3ae5f0182aab1ae3ef992b684a84c5c1a10e8315f",
                                   "d7624e57820ccd1bae7881e08af40bc3522971278018fdfbe0ca98302292165c",
                                   "e0f11ad44d1c1e11f9308f9aaee4d8bcac86ff6e0b4a41d1e75879f6cfd56049",
                                   "2266a567ba921d1c2661258cd5b31150274cb781ac01413c34a471557123ba65", 
                                   "1f2e936a57994e16b457f249a64af4786877f7beaab003fb521a20e45031f408", 
                                   "e8eaf74988082b8c8222dabed68218069c8eb4e93acd3619a776bc28d39e5ce5", 
                                   "39fdb47a5f349e06bbb7dc1cedcc81a051d1dffe373956871325f8327e858afa",
                                   "f7af5eac1d34a2ddc619dd0c3172ec28334b8d79efc1f8ad758124b7e5aae0d5",
                                   "8f3d19065d0d1295bbfbf7591aa02af3a5dc70fde74bac670c18ccd8f7306008",
                                   "d6b771bedda261bcfe9dd1d1402b7d33b5cd2764cd53d941957e32920cfbeb19",
                                   "3e02857de5a59331e1f7fc7e1ddf5ae58e8680d298bb44b49bd316e0b3a1f024",
                                   "954b4385cf4faecfbf9cd04e01c059eb09113a78ee727149b63a65b495a28a6c",
                                   "8851b734602eb00da5b1cfc1e40d38f1cb32e0add2df257ff9d7dbd520b4d5da",
                                   "b2d86212afab00e7b9bf19b7931277130b653c9258ac419a7a24d749471ea5ac",
                                   "5231df995d71991ee4108937bb12e4d3f344a96fb0c4cd82c14e18061d6c4730",
                                   "4daef5be9503c580697b36b0b60a702c109e23840c0632ca00ef4a233603018e",
                                   "fd788a077e026905f1565e0d2a65dfc6c55699c098a59879d6b0b3f3b8459ae8",
                                   "dc641636d5d782b31d29ce823e951d1a2164c86ee06bf2f65a841360fb7af356",
                                   "fb4a05ce7d50721c71f66c37e0ab7e52cd46034a2e394940b3f60c9c2afb079a",
                                   "862a7e8c68f05b91ecf3a43ac5b60c6f57ee50fa98ad1b539480d541628f5c2e",
                                   "44c87532cbb511c369b38a105fc5a84b1d89dba9dfdd5a62c311d6176fe93201",
                                   "73395b6c3fa9fa73e8e3665f108b3a92c564da9c1b9ce7834832adbb5e658a87",
                                   "862b75fd4ebed41378d3af00784ef9bde4362e27d6f2aee384b99286f6beb0bd",
                                   "7214d926419fe847a4795a74f9b73209990e4927bb5b56128cf30703be68cde7",
                                   "96dca741745683eb5c2ad857e2520ccf62ab2d08eae359f6928495073925faee",
                                   "8c1ae6ac63865e603e04a3a4f0ab0178e6422615a42e011bfd8453fc78f1fd58",
                                   "ab7ba2df709c5ff7ee16a1038deaf1d795977b035a1ba08cc6d32ea9ff87bd80",
                                   "1bbd271d777f59f1233e4124991dae126ba183ffca404e74084d29dc46b65b38",
                                   "929365d4c30b1cb3f8458d3b1bd48536260942ef9e3cab33286a1540088105e4",
                                   "34b9970af6ce3fb7e81ad42fcaf852d9d7e341a624f988409a36323329222751",
                                   "ec5aa260268e7c596adc7be56792af587da44bd897ce4f38f616ebc3d2f22a88",
                                   "e0e4fd3650aa15f92aad1d1e7567f2447f03e9c009ae4ee955afb980ec991912",
                                   "379952ec8113b3692872ffb9d07c242968ee1edfac9b3b888496c1480033be91",
                                   "802de2c196b779f0c10827bc37186a4d1db3e46841d27682865c6dbaf28bba46",
                                   "2813d00f34d60d17b5b192acd3450720966fa103fb0669c3f69c36c67204a66b",
                                   "bf740678008401deeb4b017d0641fb32f5747dfca9be0b8c5228366814ee7f67",
                                   "e1e8dac7bb356121152e7d0315659c4340cacab2a46d32a736c1ad254c9274ea",
                                   "8532f5aa7eb3d492ffac5416ed618be439136e9a1c9d0514417e26a6ab9d311f",
                                   "bee38a315667379528705aaa3edb3899cbfaaaea8e19db3214d3735d00240e71",
                                   "c8f04efd583ac2649db79902e680d8476939a0663b1e8b076e391303fef074c9")
'''

min_endpoint_version = "8.14.0"
[[actions]]
action = "kill_process"
field = "Target.process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.0"