Shellcode Allocation from Free Memory

[rule]
description = "Identifies when a process attempts to allocate shellcode from a memory region marked as free."
id = "ea26cec9-aa4f-422e-b6e6-f75901c05e21"
license = "Elastic License v2"
name = "Shellcode Allocation from Free Memory"
os_list = ["windows"]
version = "1.0.3"

query = '''
api where process.Ext.api.behaviors == "allocate_shellcode" and
 process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
 process.thread.Ext.call_stack_summary in
                                ("ntdll.dll|kernelbase.dll|Unbacked",
                                 "ntdll.dll|Unbacked",
                                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes like "FREE___*" and not $entry.protection_provenance like ("Kernel", "Kernel|*")) and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true) and
 not (process.executable : "C:\\Windows\\SysWOW64\\msiexec.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\installer\\msi*.tmp")
'''

min_endpoint_version = "8.18.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.18.0"