Shellcode from Unusual Microsoft Signed Module

[rule]
description = """
Identifies attempts to allocate or execute shellcode from unbacked memory and where the protection provenance of the
unbacked region is coming from an unusual signed Microsoft module.
"""
id = "abbb1618-6eae-459e-949d-bf628aa0abd4"
license = "Elastic License v2"
name = "Shellcode from Unusual Microsoft Signed Module"
os_list = ["windows"]
version = "1.0.7"

query = '''
api where
    process.executable != null and process.parent.executable != null and
    process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
    process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory", "VirtualProtectEx", "VirtualAllocEx",
                             "MapViewOfFile", "MapViewOfFile2", "SetThreadContext", "SuspendThread", "ReadProcessMemory", "connect") and
    process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
    process.thread.Ext.call_stack_final_user_module.protection_provenance_path != null and
    _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry,
                 $entry.trusted == true and $entry.subject_name in ("Microsoft Corporation", "Microsoft Windows")) and
    process.thread.Ext.call_stack_summary :
                        ("ntdll.dll|Unbacked",
                         "ntdll.dll|kernelbase.dll|Unbacked",
                         "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
                         "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
                         "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                         "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|kernel32.dll|ntdll.dll",
                         "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
                         "ntdll.dll|mswsock.dll|ws2_32.dll|Unbacked",
                         "wow64cpu.dll|wow64.dll|ntdll.dll|mswsock.dll|ws2_32.dll|Unbacked|kernel32.dll|ntdll.dll") and
    process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\system32\\*" and

    not (process.executable : "C:\\Program Files\\Dell\\DTP\\InstrumentationSubAgent\\Dell.TechHub.Instrumentation.SubAgent.exe" and 
         process.parent.executable : "C:\\Program Files\\Dell\\TechHub\\Dell.TechHub.exe" and 
         process.code_signature.subject_name == "Dell Technologies Inc." and process.code_signature.trusted == true) and

    not (process.parent.executable : "C:\\Program Files (x86)\\ScreenConnect Client*\\ScreenConnect.ClientService.exe" and
        process.executable : "C:\\Program Files (x86)\\ScreenConnect Client (*)\\ScreenConnect.WindowsClient.exe" and
        process.code_signature.subject_name == "ConnectWise, LLC" and process.code_signature.trusted == true) and

    not (process.name == "powershell.exe" and user.id == "S-1-5-18" and
         process.parent.executable : "C:\\Program Files (x86)\\Quest\\KACE\\KInventory.exe") and

    not process.thread.Ext.call_stack_final_user_module.protection_provenance : ("cyvrtrap.dll", "bass.dll") and

    not (process.executable : "C:\\Windows\\System32\\PrintIsolationHost.exe" and
         process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\system32\\msvcr100.dll") and

    not (process.executable : "C:\\Windows\\System32\\inetsrv\\w3wp.exe" and process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and 
         _arraysearch(process.thread.Ext.call_stack, $entry, 
                      $entry.callsite_trailing_bytes : ("41c644240c01*488b558849895424104883c4785b5e5f415c415d415e415f5dc3*", 
                                                        "41c6470c01833*488bc6488b5590498957104883c4685b5e5f415c415*",
                                                        "*85f60f95c00fb6c00fb6c041c6470c01488b558849895710488d65c85b5e5f415c415d415e*"))) and

    not (process.parent.executable : "C:\\Program Files\\ATERA Networks\\AteraAgent\\Agent\\AteraAgent.exe" and
         process.executable : "C:\\Program Files\\ATERA Networks\\AteraAgent\\Agent\\packages\\AgentPackageMonitoring\\AgentPackageMonitoring.exe")
'''

min_endpoint_version = "8.14.2"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"