Process Creation from a Stomped Module

[rule]
description = """
Identifies the creation of process where the parent process call stack contains a DLL with suspicious memory properties.
This may be the result of a code injection using module stomping or DLL hollowing via overwriting the content of legit
DLL with malicious code.
"""
id = "b444173e-ef79-4e76-b329-f0926aa249ee"
license = "Elastic License v2"
name = "Process Creation from a Stomped Module"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
    "https://www.ired.team/offensive-security/code-injection-process-injection/modulestomping-dll-hollowing-shellcode-injection",
]
version = "1.0.19"

query = '''
process where event.action == "start" and
 length(process.parent.thread.Ext.call_stack_summary) <= 60 and
 _arraysearch(process.parent.thread.Ext.call_stack, $entry,
             $entry.allocation_private_bytes >= 100000 and $entry.symbol_info: ("?:\\windows\\SysWOW64\\*.dll*", "?:\\Windows\\system32\\*.dll*")) and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info:
                                                                ("?:\\Program Files (x86)\\*.dll*",
                                                                 "?:\\Program Files\\*.dll*",
                                                                 "?:\\Windows\\Sys*\\hmpalert.dll*",
                                                                 "?:\\Windows\\System32\\umppc*.dll*")) and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.allocation_private_bytes >= 100000 and
                  $entry.symbol_info:
                        ("?:\\Windows\\SysWOW64\\KernelBase.dll*",
                         "?:\\Windows\\System32\\KernelBase.dll*",
                         "?:\\Windows\\System32\\ntdll.dll*",
                         "?:\\Windows\\SysWOW64\\ScriptControl32_*.dll!*",
                         "?:\\Windows\\SysWOW64\\rpcrt4.dll!*",
                         "?:\\Windows\\System32\\rpcrt4.dll!",
                         "?:\\Windows\\SysWOW64\\combase.dll!*",
                         "?:\\Windows\\System32\\combase.dll!*",
                         "?:\\Windows\\SysWOW64\\webio.dll*",
                         "?:\\Windows\\SysWOW64\\TWAINDSM.dll*",
                         "?:\\Windows\\Sys*\\ws2_32.dll*",
                         "?:\\Windows\\Sys*\\user32.dll*",
                         "?:\\Windows\\Sys*\\cyinjct.dll*",
                         "?:\\Windows\\SysWOW64\\twpix32.dll*",
                         "?:\\Windows\\SysWOW64\\IMCRCMN3.DLL*",
                         "?:\\Windows\\SysWOW64\\Windows.Security.Authentication.Web.Core.dll*",
                         "?:\\Windows\\assembly\\NativeImages_*",
                         "?:\\Windows\\System32\\DriverStore\\FileRepository\\*",
                         "?:\\Windows\\Sys*\\spool\\drivers\\*"))
'''

min_endpoint_version = "8.7.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"