Suspicious Execution via DotNet Remoting

[rule]
description = """
Identifies suspicious execution via DotNet system runtime remoting to execute malicious assembly via named pipes. This
may indicate an attempt to bypass application control via trusted windows binaries.
"""
id = "5bc7a8f8-4de8-4af4-bea4-cba538e54a5c"
license = "Elastic License v2"
name = "Suspicious Execution via DotNet Remoting"
os_list = ["windows"]
reference = [
    "https://github.com/nettitude/Aladdin",
    "https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html",
    "https://www.netspi.com/blog/technical/adversary-simulation/re-animating-activitysurrogateselector/",
]
version = "1.0.21"

query = '''
process where event.action == "start" and process.parent.name : "?*" and
  (process.name : "AddInProcess.exe" or process.pe.original_file_name == "AddInProcess.exe") and

   /* guid point to the pipe name used to pass the malicious assembly and pid point to a running process to wait for before exit */
   process.args : "/guid*" and process.args : "/pid*" and 

   not process.parent.executable : ("?:\\Program Files\\Autodesk\\*.exe",  "?:\\Program Files\\KAPPA\\Workstation *\\Launcher\\KAPPA.exe") and

   not (process.parent.code_signature.subject_name : ("Autodesk, Inc.", "KAPPA Engineering") and process.parent.code_signature.trusted == true)
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"