Shellcode Execution via Python Script

[rule]
description = "Identifies attempt to allocate or execute shellcode from a Python script."
id = "1d0a1b39-a29e-4370-a712-546ed047f5f5"
license = "Elastic License v2"
name = "Shellcode Execution via Python Script"
os_list = ["windows"]
version = "1.0.8"

query = '''
api where process.code_signature.subject_name == "Python Software Foundation" and
 not process.Ext.api.name in ("TpAllocWork", "TpCallbackStart") and
 process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Kernel", "Kernel|*", "Unknown", "Unknown|*", "clr.dll") and
 not process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Kernel") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection_provenance like "conemuhk64.dll*") and
 not (process.Ext.api.name == "VirtualProtect" and _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "c:\\windows\\system32\\ntdll.dll!LdrLoadDll*")) and
 not (process.parent.executable : "C:\\Program Files\\pgAdmin ?\\runtime\\pgAdmin?.exe" and process.executable : "C:\\Program Files\\pgAdmin ?\\python\\python.exe") and
 not process.Ext.api.metadata.target_address_path : "c:\\windows\\system32\\tmumh\\20019\\tmmon\\2.9.0.1181\\tmmon64.dll" and
 not (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and process.thread.Ext.call_stack_final_user_module.protection_provenance == "Unbacked") and
 not (process.Ext.api.name in ("NtQueueApcThread", "SetThreadContext") and process.Ext.api.behaviors == "execute_shellcode" and
      _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("c:\\windows\\sys*\\kernelbase.dll!CreateProcess*", "c:\\program files\\eset\\eset security\\ebehmoni.dll*"))) and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher", "Microsoft Windows Software Compatibility Publisher", "Bromium UK Limited"))
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"