Suspicious Activity from a Control Panel Applet

[rule]
description = """
Identifies an attempt to load a network library or perform API calls to manipulate memory from an unsigned Control Panel
Applet and located in unusual folders.
"""
id = "41859cf7-8a3f-48b1-8130-6bba565592a3"
license = "Elastic License v2"
name = "Suspicious Activity from a Control Panel Applet"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.12"

query = '''
sequence by process.entity_id
[library where process.executable != null and 
 (dll.Ext.relative_file_creation_time <= 900 or dll.Ext.relative_file_name_modify_time <= 900 or dll.path : "\\Device\\Mup\\*") and 
 (dll.code_signature.exists == false or 
  dll.code_signature.status : ("errorBadDigest", "errorExpired", "errorRevoked", "errorTimeStamp", "errorUntrustedRoot")) and
 not dll.path regex~ """([C-H]:\\windows\\system32\\[a-zA-Z0-9\-\_\.]+\.cpl|[C-H]:\\windows\\syswow64\\[a-zA-Z0-9\-\_\.]+\.cpl)"""] as event0
[any where
 (
  (((event.category == "api" and not process.Ext.api.name : "IoCreateDevice") or
   (event.category : "library" and dll.name : ("ws2_32.dll", "winhttp.dll", "wininet.dll"))) and
   _arraysearch(process.thread.Ext.call_stack, $entry, stringcontains~($entry.symbol_info, concat(event0.dll.name, "!CPlApplet")))) or 
   
  (event.category : "process" and event.action == "start" and 
   _arraysearch(process.parent.thread.Ext.call_stack, $entry, stringcontains~($entry.symbol_info, concat(event0.dll.name, "!CPlApplet")))) or

  (event.category == "api" and process.Ext.api.name != "IoCreateDevice" and
   _arraysearch(process.thread.Ext.call_stack, $entry, endswith~($entry.protection_provenance, "*.cpl") and stringcontains~($entry.protection_provenance, event0.dll.name)))
  )]
 until [process where event.action == "end"]
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.002"
name = "Control Panel"
reference = "https://attack.mitre.org/techniques/T1218/002/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"