Suspicious Kernel32 Memory Protection

[rule]
description = """
Detects multiple Windows Memory API calls to modify the protection of the same memory address from Kernel32 module and
in a short time window.
"""
id = "c53dfced-feba-4527-bb8a-f181bcac59bc"
license = "Elastic License v2"
name = "Suspicious Kernel32 Memory Protection"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.8"

query = '''
api where process.Ext.api.name : "VirtualProtect" and process.executable != null and 
  process.Ext.api.summary : "*kernel32.dll*" and process.Ext.api.behaviors : "write_fluctuation" and 
  process.Ext.api.parameters.size == 16 and 
  process.thread.Ext.call_stack_final_user_module.name != null and not process.thread.Ext.call_stack_final_user_module.name : "Kernel" and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in ("91bade6d0e01a3b0abe7f98f97e4eff2a04dbaa475c4a90e3ee97024f488606d", "ca4459a331c7dbb8440fa7eb3f0a2636b4685b762d94f16e2452a627faf9197b") and
  not process.thread.Ext.call_stack_final_user_module.path :
                                         ("?:\\Program Files\\*",
                                          "?:\\Program Files (x86)\\*", 
                                          "\\program files\\*", 
                                          "\\program files (x86)\\*",
                                          "?:\\windows\\microsoft.net\\framework*.dll", 
                                          "\\windows\\microsoft.net\\framework*.dll", 
                                          "?:\\programdata\\dell\\drivers\\*\\installer.exe", 
                                          "?:\\windows\\system32\\driverstore\\filerepository\\*", 
                                          "\\windows\\system32\\driverstore\\filerepository\\*", 
                                          "?:\\windows\\winsxs\\*", 
                                          "\\windows\\winsxs\\*", 
                                          "?:\\windows\\system32\\atiumd64.dll", 
                                          "\\windows\\system32\\atiumd64.dll")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"