Potential Unbacked Memory Content Masking

[rule]
description = "Detects multiple Windows Memory API calls to modify the protection of the same memory address in a short time window."
id = "358b23e4-ed82-454f-9351-69f5844e7da9"
license = "Elastic License v2"
name = "Potential Unbacked Memory Content Masking"
os_list = ["windows"]
version = "1.0.6"

query = '''
sequence by process.entity_id, process.Ext.api.parameters.size, process.Ext.api.parameters.address with maxspan=60s
 [api where process.Ext.api.name == "VirtualProtect" and
  process.Ext.api.summary : "*Unbacked*" and process.Ext.api.parameters.size >= 100000 and 
  process.Ext.api.behaviors == "execute_fluctuation" and process.Ext.api.behaviors == "allocate_shellcode" and
  process.thread.Ext.call_stack_final_user_module.name != "Kernel" and
  process.thread.Ext.call_stack_final_user_module.hash.sha256 != "eed60fb1abc328b156313abdc5e44389d25e59ffb3c1eb9353baf611c2c7147d" and
  not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and $entry.subject_name == "Activision Publishing Inc")]
 [api where process.Ext.api.name == "VirtualProtect" and
  process.Ext.api.summary : "*Unbacked*" and process.Ext.api.parameters.size >= 100000 and 
  process.Ext.api.behaviors == "execute_fluctuation" and process.Ext.api.behaviors == "allocate_shellcode"]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"