Remote Memory Write to a non Child Process

[rule]
description = """
Identifies suspicious writes to the memory space of a remote process by a process that is not a direct parent. this may
indicate a code injection attempt.
"""
id = "f5bbe671-5351-4566-b708-6e09d1de7dd2"
license = "Elastic License v2"
name = "Remote Memory Write to a non Child Process"
os_list = ["windows"]
version = "1.0.11"

query = '''
api where process.Ext.api.name == "WriteProcessMemory" and process.executable != null and
 process.Ext.api.behaviors == "cross-process" and not process.Ext.api.behaviors == "parent-child" and 
 (process.code_signature.trusted == false or process.code_signature.exists == false or 
  process.name : ("rundll32.exe", "regsvr32.exe") or process.executable : "\\Device\\Mup*") and 
 process.Ext.api.metadata.target_address_path : ("?:\\Windows\\*", "?:\\Program Files*") and 
 not process.executable :
             ("?:\\Program Files\\*.exe",
              "?:\\Program Files (x86)\\*.exe",
              "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe") and
 not stringcontains~(process.Ext.api.summary, process.name) and
 not process.thread.Ext.call_stack_final_user_module.name in ("Kernel", "Unknown", "Undetermined") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection_provenance : ("Kernel|*", "kernel")) and
 not (process.name : "rundll32.exe" and process.parent.executable : "C:\\Program Files (x86)\\Microsoft Visual Studio\\*\\MSBuild\\Current\\Bin\\Tracker.exe") and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and $entry.subject_name == "Admin By Request ApS") and
 not process.thread.Ext.call_stack_final_user_module.path :
                               ("?:\\Program Files\\*",
                                "?:\\Program Files (x86)\\*",
                                "?:\\Windows\\System32\\*.dll",
                                "?:\\Windows\\SysWOW64\\*.dll",
                                "\\Program Files\\*",
                                "\\Program Files (x86)\\*",
                                "\\Windows\\System32\\*.dll",
                                "\\Windows\\SysWOW64\\*.dll",
                                "?:\\Windows\\apppatch\\AppPatch64\\exploitblocker.dll",
                                "?:\\Windows\\FireEye\\AppMonitorDll.dll",
                                "?:\\windows\\assembly\\nativeimages_v*\\system.numerics.vectors.ni.dll",
                                "?:\\windows\\syswow64\\rundll32.exe") and
 not (process.parent.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\MSBuild\\Current\\Bin\\amd64\\Tracker.exe" and
      process.command_line : "rundll32.exe \"C:\\Program Files (x86)\\MSBuild\\*\\FileTracker\\FileTracker*.dll\",#1") and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                   ("13849cf3af6792db8ee9afd988a0185950577d7035ef27723f660276ad800dc6",
                                    "1b2ce9281d1a6396f835db683dffac3256d62153370c60b78e5b81eada0ad390",
                                    "7214d926419fe847a4795a74f9b73209990e4927bb5b56128cf30703be68cde7",
                                    "95a67fb5b474868a1d51a92c0a5217348ca461de2a5601d818415cc5fb98c778",
                                    "27d34c6032491d4dce1060eb3bf8382357a8fde4909aed3855e5c250e0789433",
                                    "82fa5000d97285b95024df5ca54d67dbc9097b27eed9089727e4d6eddc830061",
                                    "4d1db713d6a7b07c39332220bc0dc5e3f067474cfdd4006edf788a4f470e4eb0",
                                    "85dff7bdde3597606208be42bd0bede8e738253023a9fb1c03b6ffb86a0b1b02",
                                    "2ed817febe174e07e0f52acfd7731b65cb9e5bef35603ea3898a2dcb382f2a31",
                                    "843f99e90dd28e1a6e1aa5fb023670f7c6b0846a737047ae464cc32c66600c14",
                                    "8b27c7fef77ed2646b9ad74d360da1fe610e89e19e08adb7a5133e391d3fd49a",
                                    "2fec0c389dd0932c59eee19ca24c720b6521603e5ead78e3e070aa561b73be32",
                                    "ec363d03afa97033dc91cbf7c9a491fc693189f7a0a19bffc631bcb7dc715b47",
                                    "9c09a7502fa9775a76415a20948d6ef1b55b9240e71adde7a4487ecbfd038fcd",
                                    "379952ec8113b3692872ffb9d07c242968ee1edfac9b3b888496c1480033be91",
                                    "f7a6cca7a18f60cb8681eec2dd2038ce9fc8d341f1eba7ef57f69c868618850b",
                                    "61f61b7fdea578d92fa0ae6df8d9db27893bd98304c42a1b43d2e5c4c7483428",
                                    "598e3606b4da94e14a34179892974cdad91cbc8f966788b4309303624f232322",
                                    "f30518fad5e56b63c807c306b3b3ab70f043eb24956aa128e96e1482380c5e80")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"