Shellcode Behavior via .NET Core

[rule]
description = """
Identifies the call of code injection related Windows API with suspicious parameters that align with shellcode
allocation from a Managed .NET application.
"""
id = "d084c509-0222-49a2-b908-c9c3510f0f97"
license = "Elastic License v2"
name = "Shellcode Behavior via .NET Core"
os_list = ["windows"]
version = "1.0.3"

query = '''
api where
(
 (process.Ext.api.behaviors == "allocate_shellcode" and process.Ext.api.parameters.size >= 100000 and
  process.Ext.api.metadata.target_address_name == "Unbacked" and
  process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "MapViewOfFile", "MapViewOfFile2")) or

  (process.Ext.api.name == "SetThreadContext" and process.Ext.api.behaviors == "shellcode")
) and
process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
 (
  process.thread.Ext.call_stack_final_user_module.protection_provenance == "system.core.ni.dll" or
  process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\assembly\\nativeimages_*\\system.core.ni.dll"
  )
  and not process.thread.Ext.call_stack_summary like ("*|Unbacked|clr.dll|*", "*Unbacked|mscorlib.ni.dll|*")
'''

min_endpoint_version = "8.14.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"