Remote Process Injection via Python

[rule]
description = "Identifies attempt to perform remote process code injection from a python program."
id = "634dcd98-0656-48a8-bd41-5fa025b6c812"
license = "Elastic License v2"
name = "Remote Process Injection via Python"
os_list = ["windows"]
version = "1.0.8"

query = '''
api where process.Ext.api.behaviors == "cross-process" and process.Ext.api.metadata.target_address_name like "?*" and
 process.thread.Ext.call_stack_final_user_module.name : ("libffi*.dll", "python*.dll") and
 not process.Ext.api.metadata.target_address_name in ("PEB", "PEB32", "ProcessStartupInfo") and
 not process.Ext.api.summary like ("* PEB*", "* PEB32*", "*ProcessStartupInfo*", "*Data*", "*python??.dll*", "NtQueueApcThread( cmd.exe, Unbacked, NULL, NULL, NULL )") and
 not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*.exe") and
 not (process.Ext.api.name == "WriteProcessMemory" and process.Ext.api.parameters.size == 4) and
 not process.thread.Ext.call_stack_final_user_module.path like
                                  ("c:\\program files\\*.dll",
                                   "c:\\program files (x86)\\*.dll",
                                   "c:\\programdata\\anaconda3\\python??.dll",
                                   "c:\\windows\\systemtemp\\chrome_unpacker_*\\python*.dll")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "Target.process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"