Suspicious Image Load from SMB Shares

[rule]
description = """
Identifies the load of a DLL from a network file share followed by a suspicious DLL load event. Adversaries may leverage
this technique to avoid dropping to disk the malicious payload on the targeted machine.
"""
id = "c9674e88-8423-442a-9712-ba6271bcff10"
license = "Elastic License v2"
name = "Suspicious Image Load from SMB Shares"
os_list = ["windows"]
version = "1.0.23"

query = '''
sequence by process.entity_id with maxspan=1m
 [library where dll.path : "\\Device\\Mup\\*" and not startswith~(dll.name, process.name) and 
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.symbol_info : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\Sys*\\tmumh\\*\\tmmon.dll+*")) and
  not process.executable :
            ("?:\\Windows\\System32\\sdiagnhost.exe",
             "?:\\Windows\\System32\\CompPkgSrv.exe",
             "?:\\Windows\\System32\\backgroundTaskHost.exe") and 
  not process.thread.Ext.call_stack_summary : "ntdll.dll|kernelbase.dll|jvm.dll|java.dll|Unbacked"
  ]
 [library where
  process.executable != null and
  (
   (dll.name : ("ws2_32.dll", "wininet.dll", "psapi.dll") and
    process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|Unbacked") or

   dll.name : ("dsquery.dll", "System.Management.Automation.dll")
  ) and 
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
  not (dll.name : "ws2_32.dll" and process.executable : "\\Device\\Mup\\*.edu\\*\\IDTest.exe") and 
  not (dll.name : "wininet.dll" and process.executable : "\\Device\\Mup\\nf01\\Application\\*.exe") and 
  not (process.name : "UiPath.ActivityCompiler.CommandLine.exe" and process.code_signature.subject_name : "UiPath, Inc." and 
       process.code_signature.trusted == true and dll.name : "System.Management.Automation.dll") and 
       
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_leading_bytes :
                         ("ffeb1e8d4e0ce86482000083660400684c5*",
                          "8bcee8ac9affff837d10007414ff7510*",
                          "0000004d63db4a8b0c19488b0948894d9890488b4db84533db488b458048898558ffffff488d051500000048898570ffffff488b4588c6400c00488b4598ffd0",
                          "8b750cc706d3c6ca05e8cd9d2e588b4d10e855d728588b4d108b750cc706dec6ca05e884102d588b4d10e8dcf72c588b4d108b750cc706e6c6ca05e89b9d2e58",
                          "008bc3eb8933c0413bed75824488afe81c0000e976ffffffcccccc40534881eca000000033db48391d66360d000f85bb010000488d0db9580b00ff15132b0900"))
  ]
'''

min_endpoint_version = "8.8.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"
[[threat.technique.subtechnique]]
id = "T1021.002"
name = "SMB/Windows Admin Shares"
reference = "https://attack.mitre.org/techniques/T1021/002/"



[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"

[internal]
min_endpoint_version = "8.8.0"