Shellcode Injection with Parent as Provenance

[rule]
description = """
Identifies when a process attempts to allocate or execute shellcode from an unbacked memory and where the protection
provenance of that memory region is coming from the parent process.
"""
id = "631df705-0636-4f83-8374-24d61307735e"
license = "Elastic License v2"
name = "Shellcode Injection with Parent as Provenance"
os_list = ["windows"]
version = "1.0.7"

query = '''
api where process.Ext.api.behaviors in ("allocate_shellcode", "shellcode") and
 process.Ext.api.behaviors != "cross-process" and process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
  _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
 process.thread.Ext.call_stack_final_user_module.protection_provenance_path != null and
 not (process.Ext.api.parameters.size <= 4096 and process.Ext.api.name == "VirtualProtect") and
 not process.Ext.api.metadata.target_address_path : ("c:\\windows\\syswow64\\user32.dll", "c:\\windows\\syswow64\\gdi32.dll") and
 startswith~(process.thread.Ext.call_stack_final_user_module.protection_provenance_path, process.parent.executable) and
 not (process.executable : "C:\\Program Files (x86)\\*.exe" and process.parent.executable : "C:\\Program Files\\*.exe") and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                             ("e9b488ad3101d386a3b2248db0c0dfe43c83fd856c55d181264da762f5352f38",
                              "4ad4ff7561647775372cafe7c52ba85d610dbc901a45f1a576764dfa11a9fa7a",
                              "10f3e16e8428f3d411f099fc4ff6e5b6f3ece29a0fc8fc606e7148e2f9bfc84b",
                              "83fecf04fc83a08c78e4f5faad39c4b4ecb806c2b777c58998bfc9ea560f17ca",
                              "6a31d5d8358cd60014233b39f33f2dda2cf6cc5c4883ba1501dc37644d2b51b4",
                              "83fecf04fc83a08c78e4f5faad39c4b4ecb806c2b777c58998bfc9ea560f17ca",
                              "33d3d3b2872d65e0584668d6d4ef1520b9fe25fe55f9e3174696274309ceb3e0",
                              "36c190fb1081298ca8ed7e9e2a46e9e535a265534a99283bd0ee2d144ddeeba4",
                              "d94ad7bcd32ec7b48fe76a4293205c6eb17191b7882a631ccb4eeabee2a96bca",
                              "f6ec8ebfe3ef1f9b74ecfadffa03de8fb23cdefead9cb7c87c59c0e036b85e2f",
                              "420efa8de496e3cfbc91910ae59f730d253280ddb2ab3daff484afc3eb0c89b6",
                              "0f7fd870dd2e7272b92ea5dfe88b2662d859818459a3d2c1e9d669aa1a7dddc2",
                              "ce4d31db584ad5ff31a8e81c735e81a42f87cd37b70cfdf3d3621a794dacf3d1",
                              "02f9581f9b917ac8535bce97462ad587608fd42227eae4d8ee54ab7a4bf742fd",
                              "b3d665fa5452b58a2238f57188aa9310a01a1e3c2b884269c2bccb0bdadabd41",
                              "6d72df875440edd9216e2e3f0fb500776064a6f2e412f8d118e410760dff3685",
                              "6a31d5d8358cd60014233b39f33f2dda2cf6cc5c4883ba1501dc37644d2b51b4",
                              "27c7d20101e03ec0850cdd58f89b8d5e8494e8c0790919c778947ca14ee68a0d",
                              "38e175cd1d4a2acd6ee0f04b2045c6260a7362a1cde2c77bca5887e0811edd2f", 
                              "3ec7799d1f23fc6c0beea6f237f801dbdd59aac6faa7a22ecf88ba54c8fc9a80", 
                              "e54d84398581083d4a4c2ca95056cbfffc1183d54fedfb4cf1b68bf1b4495839", 
                              "43e216dbaf5aaad2d0b7d63dd14a9ce5b060390271e46fedbe59c671cfb28714", 
                              "a8448fdad13341552eddecdbef4225015aa9940abe47d52d358a36f7bae57cc1", 
                              "b18aa0c98922563f5996fb0497446873f7030d0511ffb77388ea882b4f98a924", 
                              "ec673caa0c703cc3084887824b800502cd45b4a365c2f8d6cbc5175f0e938e1e", 
                              "fee37bdeecc597ad9e0f13264e9ac12df3ad41f8d76a41da6e38349ed66ab35e", 
                              "ce00bc44c975337198e7d3d353b8a1789a1221697754957752a63bbf547f1334",
                              "a87b3f02042de4d655f72af65ed5242fae5c675bebd19e962978c13e6d99ba00",
                              "85060dfab7e73f3986a4fa6148e7c14b0df55ba812c7367d85bd580837b2f7a4",
                              "a543689f34083f810e0184ec77d8ee9e57d44ebd6212af444853a3a89a3c82c0",
                              "9096bba37319bcd1b809a72cd359066788199c859a67a5d872ae1b22ed0dd842",
                              "b7b98dd681dfea2333a0136ba5788e38010730bb2e42eafa291b16931f00449d",
                              "a99cd58ec2becb2aaf2625659e42816c45e62297db468767d74f279046d98759",
                              "a2b2c7eb257e2be7100f735db3a772279c88ee913ffb6111b14d81685fd5f035",
                              "a99cd58ec2becb2aaf2625659e42816c45e62297db468767d74f279046d98759",
                              "f1b584d0871d1600528abdf4e6693360237c66e066dac2087e0e565d9d6a3d73",
                              "eb30a0075cdc0c3ddea9b22b92e4d0f275932f9fdcb10b9d4d4bd8b3c03da0be",
                              "d5fff843645ab47000738a36b7073f1d0e7c2cd4cc8612ce7325ef4da8cd7412",
                              "b6cbd6fd5caebf165ef854813a81ff800f98858a1d60cc0b6a401b21d28b622a",
                              "ea9afbb6e39625961698c86066dfe1ffc8ced0102360c5baa25493408af8c253",
                              "073453a10735f07728f0226aff69799d23aaac9a8ec9a15baee297cbd5c66cf8",
                              "36141b686ae3edc68e33bca2b4774539501df365b03c5703d4a74219e869aedb",
                              "f359110a232e73618eb0af7780d93f7b95dd269e3d12eefa9150784d95f32f91",
                              "e0af24d54621935df1b9956ed68f46cb92ef8c711101ba1683dfe7f41e7cdcae",
                              "b894515db9f9e3ad157e11c1f1e558c589c60567033880409874293cca8f8f81",
                              "8d3f6fe71b24882d9f51e4c298335dfd19c9acfb2473e5e0dcae5b5b4b447c4c",
                              "79dafa6bf1054b901448a76f7f441d4c458f5eb2b6e9ab87e39632fb313c0d84",
                              "c10ef947b23cc2ef4f339212123a4ac2c08df8ecb2c19658384a448427adf104",
                              "0cd9e13dbce7595879d9e972dc04e81da63d1cbf34c99fd3603e2aba68ccf2a5",
                              "91255773e0347a72a8e33c7d3d1f4ca89939d0bcc88c8c53c12872e2979b13cc",
                              "bf041dddc12576146b15dfe718c721901c9dfc0c041a62315058a2456a4ee854",
                              "23a1dde1e71d79ab7d4097c7f997a9f6fe3fd3ddaefeef267bf14554461c9bd7",
                              "dc2844b3ce298adf6001ce3814f43df73950aa08dda8824173c0ad158d649740",
                              "ad92c48ec5e6416b0986536236d5c771b63b98b84e5c1f172f1ab7a5779baac6",
                              "f621aa32815a28d5d1e01647522df9d9c8f5055b318cd3bd303a9cfb7eed5825",
                              "0801daddddc3bace3ae059513993d306cead3cca0652f7167e870f5a60f48779",
                              "ec53f8964b89b6e5c01df862734a97798b4eeb7b1e14c557f7c71ee72fe87779",
                              "da670f3718e4c465eb2382e4b3da25b479ac868056c4f532b526036786a703e9")
'''

min_endpoint_version = "8.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.15.0"