Suspicious Image Load from a Stomped Module

[rule]
description = "Identifies potential traces of module stomping where a Windows library is loaded from a suspicious call stack."
id = "27cb2961-ddd1-4f4c-89bd-715de642e71a"
license = "Elastic License v2"
name = "Suspicious Image Load from a Stomped Module"
os_list = ["windows"]
version = "1.0.3"

query = '''
library where dll.code_signature.subject_name == "Microsoft Windows" and
 process.thread.Ext.call_stack_summary regex """.*\|(wininet.dll|ws2_32.dll)\|[a-z]+\.dll""" and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : ("C:\\Windows\\System32\\wininet.dll!InternetOpen*", "C:\\Windows\\System32\\ws2_32.dll!WSASocket*")) and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "?*" and not $entry.symbol_info : ("C:\\Windows\\System32\\ntdll.dll*", "C:\\Windows\\System32\\kernelbase.dll*", "C:\\Windows\\System32\\wininet.dll*", "C:\\Windows\\System32\\ws2_32.dll*", "Unbacked*")) and
 not process.thread.Ext.call_stack_summary like "ntdll.dll|*|kernelbase.dll|ws2_32.dll|libcef.dll" and
 not (process.name : ("msedge.exe", "msedgewebview2.exe") and process.thread.Ext.call_stack_summary like "ntdll.dll|*|ws2_32.dll|msedge.dll") and
 not dll.name in ("mswsock.dll", "bcrypt.dll") and
 not (dll.name : "FWPUCLNT.DLL" and process.thread.Ext.call_stack_summary like "ntdll.dll|*|wininet.dll|adal.dll") and
 not (dll.name : "dnsapi.dll" and process.thread.Ext.call_stack_summary like ("ntdll.dll|*|ws2_32.dll|wininet.dll", "ntdll.dll|*|wininet.dll|ntdll.dll"))
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"