Suspicious Call Stack Trailing Bytes

[rule]
description = "Identifies API or library events with suspicious call stack trailing bytes often related to shellcode execution."
id = "0c5fe593-39c8-436a-a5ec-7003267f9e0e"
license = "Elastic License v2"
name = "Suspicious Call Stack Trailing Bytes"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.11"

query = '''
any where process.executable != null and 
 /* add esp, 0xab; ret; nop; nop; nop; */
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : ("4883????c3909090909090*", "4883C4485B415CC390909090*")) and 
 (
  (event.category == "api" and process.Ext.api.name like ("VirtualProtect*", "WriteProcessMemory")) or 
  (event.category == "library" and dll.name in~ ("ws2_32.dll", "wininet.dll", "winhttp.dll"))
  ) and 
 not _arraysearch(process.thread.Ext.call_stack, $entry, 
                  $entry.callsite_trailing_bytes :
                           ("4883c428c390909090909090904c8bdc574883ec6049c743b8feffffff49895b1849897320488b05c9a024004833c44889442450488bfa488bd9488b521849c7",
                            "4883c4205bc3488b8180000000c390909090909090904883ec2833c08b123b15261b3601751d83797c007417488b05f3d43101488b008b517c4889c1e8c5a406",
                            "4883c428c3909090909090909090909044894c242044894424188954241048894c24084883ec28*")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.callsite_leading_bytes :"3b4208750b498908488b01ff5008eb05bb024000808bc34883c4205bc34883ec3848c7442420feffffff488bc1488b094885c9740b48832000488b01ff501090")
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"