Suspicious Image Load by System Protected Process

[rule]
description = """
Identifies when a System protected process loads a library from a network file share. This may indicate an attempt to
bypass PPL protection and inject malicious code into a protected process or disable security software.
"""
id = "5007b805-0cee-44e8-b807-22c95d5d2998"
license = "Elastic License v2"
name = "Suspicious Image Load by System Protected Process"
os_list = ["windows"]
reference = [
    "https://learn.microsoft.com/en-us/windows/win32/services/protecting-anti-malware-services-",
    "https://github.com/gabriellandau/PPLFault",
    "https://www.blackhat.com/asia-23/briefings/schedule/#ppldump-is-dead-long-live-ppldump-31052",
    "https://www.elastic.co/security-labs/forget-vulnerable-drivers-admin-is-all-you-need",
]
version = "1.0.14"

query = '''
sequence by process.entity_id
 [process where event.action == "start" and process.Ext.protection : "PsProtected*" and 
  not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework\\*\\mscorsvw.exe" and 
       process.parent.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe" and 
       process.Ext.protection : "PsProtectedSignerCodeGen-Light")]
 [library where dll.path : ("\\Device\\Mup\\*", "\\\\127.*\\*")]
  until [process where event.action:"end"]
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"

[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"