Suspicious Executable Memory Permission Modification

[rule]
description = """
Identifies suspicious memory permission modification from read and execute R-X to read only. This may indicate an
attempt to hide executable code while in sleep state.
"""
id = "c6e63ef1-e2d8-4703-80c7-a544f2aa5c6e"
license = "Elastic License v2"
name = "Suspicious Executable Memory Permission Modification"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.16"

query = '''
api where process.Ext.api.name == "VirtualProtect" and process.executable != null and
 process.Ext.api.parameters.protection == "R--" and process.Ext.api.parameters.protection_old == "R-X" and
 process.thread.Ext.call_stack_summary : "?*" and
 not (process.code_signature.subject_name : ("Electronic Arts, Inc.", "Activision Publishing Inc") and process.code_signature.trusted == true) and 
 process.thread.Ext.call_stack_final_user_module.name : "Unbacked" and
 not process.thread.Ext.call_stack_final_user_module.name : ("Kernel", "Unknown", "Undetermined") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Kernel", "Kernel|*", "hmpalert.dll", "Unknown", "Unbacked") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection_provenance : ("Kernel", "Kernel|*")) and
 not process.thread.Ext.call_stack_final_user_module.path : 
                                     ("?:\\windows\\system32\\apphelp.dll", 
                                      "?:\\windows\\syswow64\\apphelp.dll",
                                      "?:\\windows\\microsoft.net\\framework*\\clr.dll",
                                      "?:\\program files\\dotnet\\shared\\microsoft.netcore.app\\*\\coreclr.dll") and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 :
                                   ("f7c78dba07128af325d8da99138ebf78be163ecfb5da5b01fa6b65b96efecef1", 
                                    "ca6079aadef0e98ee94f59babe8d67c0412829a42581c7884659a2737833b83e", 
                                    "14ddc0fed1748f89318fbdc59c092e9891feffe5175ef22991b6a794fe539dc3", 
                                    "6ad6c03ac893bce8aeb65362c7615b7c74d457276ce6bdcde40a110178267fa3", 
                                    "f7c78dba07128af325d8da99138ebf78be163ecfb5da5b01fa6b65b96efecef1",
                                    "e0f97f4ca158dc6de279467dd469b7d9da6613de64c7e5ed34bdd9d358dd8a90",
                                    "b8962adcfb27934ff93f7fffe306e1f01b9342305e883443896204e24c68290b") and
 not (process.code_signature.trusted == true and process.code_signature.subject_name : "Roblox Corporation") and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature,
                  $entry, $entry.subject_name: ("Bitdefender SRL", "Google LLC", "Mozilla Corporation", "Adobe Inc.") and $entry.status : "trusted") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "85c00f856a010000b84d5a00006639070f855c0100004889b424a8000000488d45e84863773c4c8d45e04803f748c745e00801000041b920000000488975d848") and
 not (process.parent.executable : "C:\\Program Files (x86)\\Outline\\OutlineService.exe" and process.executable : "C:\\Windows\\SysWOW64\\netsh.exe") and
 not (process.parent.executable : ("C:\\Program Files (x86)\\CyberCNSAgentV2\\cybercnsagentv2.exe", "C:\\Program Files (x86)\\CyberCNSAgent\\cybercnsagent.exe") and
      process.executable : "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info like ("c:\\windows\\system32\\ntdll.dll!LdrResolveDelayLoadedAPI*",
                                           "c:\\windows\\system32\\ntdll.dll!LdrShutdownProcess*"))
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"