Remote Thread Context Manipulation

[rule]
description = """
Identifies potential remote process manipulation using SetThreadContext API. This may indicate an attempt to inject code
or debug a remote process.
"""
id = "c456266f-e920-4acb-9b32-711fa7b94ca5"
license = "Elastic License v2"
name = "Remote Thread Context Manipulation"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.30"

query = '''
api where 
  process.Ext.api.name : ("SetThreadContext", "Wow64SetThreadContext") and 
  process.executable != null and 
  ((process.Ext.api.behaviors == "cross-process" and process.Ext.api.behaviors == "execute_shellcode") or process.Ext.api.behaviors == "hardware_breakpoint_set") and
  not process.Ext.api.summary : "*OSError*" and process.thread.Ext.call_stack_final_user_module.name != null and
  (process.thread.Ext.call_stack_final_user_module.hash.sha256 like "?*" or
   process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|Unbacked") and
  not (process.code_signature.subject_name :
               ("Duncan Ogilvie", "International Business Machines Corporation", "COGNOSPHERE PTE. LTD.",
                "CAPCOM CO., LTD.", "Larian Studios Games Ltd.", "Valve Corp.", "Rockstar Games, Inc.",
                "Johannes Schindelin", "Unity Technologies ApS",
                "Paradox Interactive AB (publ)", "CD PROJEKT SPÓŁKA AKCYJNA", "JetBrains s.r.o.",
                "Open Source Developer, Maksim Moisiuk", "Take-Two Interactive Software, Inc.",
                "Facepunch Studios Ltd", "Nox Limited", "Maksim Moisiuk",
                "Activision Publishing Inc", "OpenJS Foundation", "Ubisoft Entertainment Sweden AB", 
                "Epic Games Inc.", "NEXON Korea Corporation.", "Molotov", "Agilebits", "Gaijin Network Ltd", "Open Source Developer, Duncan Ogilvie",
                "COMPUTACION EN ACCION SA DE CV", "MPTronic", "Docker Inc", "Embark Studios AB", "Piriform Software Ltd", "Unity Technologies SF") and
      process.code_signature.trusted == true) and 
 not process.thread.Ext.call_stack_final_user_module.name like ("Kernel", "Unknown", "dbgeng.dll", "Undetermined") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Kernel", "kernel|*") and
 not (process.code_signature.trusted == true and stringcontains~(process.executable, process.thread.Ext.call_stack_final_user_module.path)) and 
 not process.thread.Ext.call_stack_final_user_module.path : 
                                               ("?:\\Program Files\\*", 
                                                "?:\\Program Files (x86)\\*", 
                                                "\\Program Files\\*", 
                                                "\\Program Files (x86)\\*") and 
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                        ("31f65b7afe91e23ae88d8229fd54c5eb494ffd4594bdc3d6a91d2d69892b284b",
                         "766ac0f768c5b2acb19ecb8cf179c59d56b74d71437f5d1331408d9c827cfde8",
                         "67ca92cc7beea130c6f7e8f3982f3256f1724f22c6de869a884df47dcc0b7b95",
                         "b6a39ef455952471c935ea190a78eecf423fba2a49ffce1afdf737d58bb2c9d3",
                         "062a170de010b5be0840dd92a9ad43da1d1e09738956cffce78368305afe885b",
                         "2c5e3525840ef01510583ecc37f876791b2d6e73fbe8099c93ab0f5787ba626d",
                         "655d6df92eef4c947498456d40b7856cbe72ede8c6432072f968207817825b52",
                         "8b451b88d2cc91b079251e2347abb84d2b09712512fa9e57d9de35e93c751863",
                         "615ac4399eed0a26e5cd9bba4e7dcf661400fb0546dce067523fe275351d3b04",
                         "22a8ae4f904366c8f42d8da22df28c755cefd28ab34268c77275229964e34c66",
                         "6957d81c1fb22b7a2c88dd63f1c99a777805d13e0d0af6411a46c1f40e8b22e9",
                         "2dfa7a9d8be474447f8ea53dc864a5bb8cdcc526664636154adfa8b71386f883",
                         "e3fdcd2b4c5215e74b0cabe91ce7fe2800cbf8e2a28157342960bca61bbd6b5d",
                         "f1b668a9cca5c832ae8374c1815cfc8fcb452d05268797f0c022d74000ecd486",
                         "c0a45f327f40cf8cdc79dc9cccf858ae862a6df0a26c83141cb3c24fc604b483",
                         "8fb6e0cd1c0d01157ee1a87da9e894f7451988a5349cff5d99f2d3d9c6ffc397",
                         "4c6bbe178708b9590be27d8423261d6c1abfcdfe6cf90df1654ff60033a48bee",
                         "7eda2d6011ed2dae3f0c2ec30bdd2ae0c0146bf1baaa827dccb002b6ad793820",
                         "60ac461ca948a8a26dc3013d3b30fa615666b0d3fe8f5014dfd39a5de5440868",
                         "1165eb20cab73c780b439fdbea3fd9c6545f1d5488bf6c6194bf4dd49450f618",
                         "79ab757eaf9d745e9da693510c58b180ac45d6450d8df2260826c285bfe0f2de") and
 not process.executable : ("D:\\laragon\\bin\\php\\php-8.0.25-nts-Win32-vs16-x64\\php.exe", 
                           "D:\\laragon\\bin\\php\\php-8.2.4-nts-Win32-vs16-x64\\php.exe", 
                           "Z:\\SteamLibrary\\steamapps\\common\\*.exe",
                           "D:\\SteamLibrary\\steamapps\\common\\*.exe",
                           "D:\\Steam\\steamapps\\common\\*.exe",
                           "D:\\Visual Studio\\Common7\\IDE\\devenv.exe",
                           "?:\\Program Files\\DebugDiag\\DbgHost.exe",
                           "?:\\Program Files\\Git\\usr\\bin\\env.exe",
                           "?:\\Program Files\\Microsoft Visual Studio*\\Common?\\IDE\\*.exe",
                           "?:\\Program Files (x86)\\Microsoft Visual Studio*\\Common?\\IDE\\*.exe",
                           "?:\\Program Files (x86)\\Steam\\steamapps\\common\\*.exe",
                           "?:\\Program Files\\Microsoft Visual Studio\\2022\\Professional\\Common7\\IDE\\devenv.exe",
                           "?:\\Program Files (x86)\\WinHex 19.6 Portable\\WinHex64.exe",
                           "?:\\Program Files\\JetBrains\\*\\plugins\\go\\lib\\dlv\\windows\\dlv.exe") and
 not process.parent.executable :
                     ("?:\\Program Files\\cmder\\vendor\\conemu-maximus?\\ConEmu\\ConEmuC64.exe",
                      "C:\\Program Files (x86)\\GitExtensions\\ConEmu\\ConEmuC64.exe",
                      "C:\\Program Files\\Git\\mingw64\\libexec\\git-core\\git-remote-https.exe",
                      "C:\\Program Files\\Git\\usr\\bin\\bash.exe") and
 not (process.name : ("cmd.exe", "powershell.exe", "csc.exe") and
      _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection_provenance : "conemuhk64.dll*")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info : ("?:\\program files (x86)\\steam\\gameoverlayrenderer64.dll*",
                                        "?:\\program files\\windowsapps\\microsoft.windbg*\\amd64\\dbgeng.dll!DebugCreateEx*",
                                        "*\\vsdebugeng.impl.dll!ImplDllCreateInstance*",
                                        "?:\\program files\\windowsapps\\dolbylaboratories.dolbyaccess_*\\dlls\\x64\\dolbyaudioprocessing.dll*",
                                        "?:\\program files\\windowsapps\\pythonsoftwarefoundation.python.*\\dlls\\sqlite3.dll!sqlite?_enable_shared_cache*",
                                        "?:\\windows\\systemapps\\microsoft.windows.contentdeliverymanager_*\\contentdeliverymanager.background.dll!*")) and
 not process.thread.Ext.call_stack_summary : ("ntdll.dll|kernelbase.dll|gdb.exe|kernel32.dll|ntdll.dll", "ntdll.dll|bcrypt.dll") and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
                                          "Microsoft Windows Software Compatibility Publisher",
                                          "Valve Corp."))
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"