Process Anti-Debug via Memory Patching

[rule]
description = "Identifies attempts to prevent a debugger from attaching to a process via patching the NTDLL module debugging functions."
id = "4db10fd9-e219-4566-9388-8e9a0b7ac7a9"
license = "Elastic License v2"
name = "Process Anti-Debug via Memory Patching"
os_list = ["windows"]
reference = [
    "https://anti-debug.checkpoint.com/techniques/process-memory.html#patch_ntdll_dbguiremotebreakin",
    "https://anti-debug.checkpoint.com/techniques/process-memory.html#patch_ntdll_dbgbreakpoint",
]
version = "1.0.8"

query = '''
api where process.Ext.api.name == "WriteProcessMemory" and process.executable != null and
 process.Ext.api.summary like ("*DbgUiRemoteBreakin*", "*DbgBreakPoint*") and
 process.thread.Ext.call_stack_final_user_module.name != null and
 not (process.code_signature.status == "trusted" and
      process.code_signature.subject_name : ("UBISOFT ENTERTAINMENT INC.", "BattlEye Innovations e.K.", "KOBIL GmbH",
      "Epic Games Inc.", "M.E.DOC LLC", "BOHEMIA INTERACTIVE a.s.", "MetaQuotes Ltd", "Bandicam Company Corp.",
      "BATTLESTATE GAMES LIMITED", "Ubisoft Entertainment Sweden AB", "Star Finanz - Software Entwicklung und Vertriebs GmbH",
      "Environmental Systems Research Institute, Inc.", "miHoYo Co.,Ltd.", "HP Tuners LLC", "COGNOSPHERE PTE. LTD.",
      "SZ DJI Technology Co., Ltd.", "Star Finanz-Software Entwicklung und Vertriebs GmbH",
      "Sky International AG", "NetEase (Hangzhou) Network Co., Ltd", "SCRYDE TECH DMCC")) and
 not process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and
  not process.thread.Ext.call_stack_final_user_module.name : ("Kernel", "Unknown", "Undetermined") and
  not (process.code_signature.status : "trusted" and startswith~(process.thread.Ext.call_stack_final_user_module.name, process.name)) and
  not process.thread.Ext.call_stack_final_user_module.path :
                              ("?:\\Program Files\\*",
                               "?:\\Program Files (x86)\\*",
                               "\\Program Files\\*",
                               "\\Program Files (x86)\\*",
                               "?:\\windows\\system32\\*",
                               "?:\\windows\\syswow64\\*",
                               "?:\\windows\\assembly\\*",
                               "?:\\Windows\\FireEye\\AppMonitorDll*.dll*",
                               "?:\\Windows\\apppatch\\AppPatch*\\exploitblocker.dll*") and
  process.Ext.api.summary != "WriteProcessMemory( Self, ntdll.dll!DbgUiRemoteBreakin, 0x5 )" and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                         ("2a9b218ef8897b17ea485d41be9d8145ece535e8f14f44de84ea97048399f5a4",
                          "b98f6fffd39455ebb8a480be09fc020f26a2d9ce14901a39886a3c367e4dc3fe",
                          "fd55b535a38bec99a9e4eec910b5ac032ca29dbf94ca16c344c3006d77404b41",
                          "44fabd4b4aa67eedde7bebe717fd2951cc6e04c355040b4c0dca340ed5f7ff0e",
                          "c515555c4a80c611555e50ba59937e41c7fe95309cb3e531481d07a8573cf23c",
                          "a4add0c1f03c40889069b3ddf842844e2fcf3e3c475213506d1601fe2ae7a917",
                          "e7bc8d8ac6b0911435a012e2a81185edcc1eb90f765ac7ade340c2c7e82c84fe",
                          "e12c0d23bfe1a4408de6f81b98803d8714529ddd80b91f2589acd5fb6f926a65",
                          "51a73b67d379458e8b4125ce7578d80dbf4f6b3ac6d1f13bef837b346c64e1d5",
                          "d0b54d2654404f6e1ef21c9fb5808862dfc79e5ddab26afe3115134b98c0e285",
                          "2be89bd37bab3d9d7c08360cc062790450bee504ac689d1d0aa61da1ca2a7b64",
                          "c4fcf0187e7fbf6939b08e929e10eb9eb5c1e4a45849cae6a677451249db066e",
                          "b7d34366f3b7698474c1d488a412dbdc575894a7be43a8d8e01b337b57971c36",
                          "9687cc15ecf5dc95fefb25169bef03c4043c950045fb0cfe346ab9eba2acd9d5",
                          "f9f63034413b394885d6aab397e14f5b44391c81b1bcb8d9f4119b017c5ee58b")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"