Suspicious API call via a Windows Installer Module

[rule]
description = """
Identifies suspicious API calls from a Windows Installer module. This behavior is consistent with code injection
attacks.
"""
id = "43e9d254-28e9-463d-9bc3-5e51721d4b8a"
license = "Elastic License v2"
name = "Suspicious API call via a Windows Installer Module"
os_list = ["windows"]
version = "1.0.11"

query = '''
api where process.name : "msiexec.exe" and
   process.Ext.api.name in ("WriteProcessMemory", "VirtualProtectEx", "VirtualProtect", "VirtualAlloc", "VirtualAllocEx","MapViewOfFile", "MapViewOfFile2", "SetThreadContext", "SuspendThread") and
   process.thread.Ext.call_stack_final_user_module.path like "c:\\windows\\installer\\*" and
   /* unsigned or untrusted code signature */
   _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) and

   /* noisy patterns - VP and WPM due to Image Load and Process Creation */
   not (process.Ext.api.metadata.target_address_name in ("ProcessStartupInfo", "PEB", "PEB32", "Data") and process.Ext.api.parameters.size <= 4544) and
   not _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.symbol_info like ("c:\\windows\\*\\ntdll.dll!Ldr*",
                                             "c:\\windows\\*\\kernelbase.dll!LoadLibrary*",
                                             "?:\\windows\\*\\kernelbase.dll!CreateProcess*", 
                                             "c:\\windows\\system32\\ntdll.dll!wcsnlen+*", 
                                             "c:\\windows\\system32\\kernelbase.dll!GetProductInfo*")) and
   not _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.callsite_trailing_bytes in ("5a8bf850528b338b432003c28b08894b208b431c03c28b08894b1c03f28b4b0c03ca8d431c505756ffd15a580343088bf8528bf08b46fc83c0042bf08956088b")) and
   not (process.Ext.api.metadata.target_address_path like "c:\\windows\\syswow64\\*.dll" and process.Ext.api.parameters.size <= 4096) and
   not process.Ext.api.metadata.target_address_path like ("c:\\windows\\installer\\msi*.tmp",
                                                          "c:\\windows\\temp\\{*}\\isrt.dll",
                                                          "c:\\windows\\temp\\{*}\\_isres_0x*.dll") and
   not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                          ("85da69c82e3d1faff1e60e6853e30230fc5e3b64faf4245e20089fe75912d910",
                                           "09e957a1d31b9cf8666add20613bf60b6a2d294586f8887961cc6a0e24680fb8",
                                           "3c60786fddc7fb00b2dab7bd2b6c33340e07c73ea8e3d6c47754bb9d15d83166",
                                           "e10c6189c60b9bc3b0e2603930b55eda886e0de4520b0c8ba7f060fbf3b30549",
                                           /* Kaspersky  */
                                           "0c9891da5c64a519c11e7603a41e93e0ff3057cca238ee59ffb5b4a82985011a",
                                           "80f84a7b8aad0bdceba677e6a501f71b6b57878e34b6b557e1892083a32b7bd5",
                                           "0297e306edf0a868e1edffa4de158906142f131b550061a7d68cca721482a953",
                                           "7d6d4599a9347ee8ad9af3092d2a8b5b55517d609b46eef5e75a8f127ec085e5",
                                           "ed3d26467ce009c6267549b842893f9a5c40aeb9c8cc0f47d2182a65875abb07",
                                           "9437b711f5d1c8377d618eeec4d282f15c9c8029c8f3ae562df34ae53609db38",
                                           "9996cbc90d486af7107d85c1802b2c595f0c3bd515ff501fe29a6f89bdf18d6d",
                                           "14d6dbb1c27e0fef0f53720aefb391a3b4396cbf2b7d05eb1b0667a28f1f1d05")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"