Suspicious NTDLL Image Load

[rule]
description = """
Identifies when a process loads a second copy of Windows NTDLL image. This may be indicative of adversarial attempt to
evade NTDLL syscall hooking by loading a clean (unhooked) copy of the same image.
"""
id = "5eb3c0b3-8d11-439d-b26d-d7623c5b3723"
license = "Elastic License v2"
name = "Suspicious NTDLL Image Load"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.29"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  not process.Ext.token.integrity_level_name in ("system", "low") and
  (
   process.name : ("rundll32.exe", "regsvr32.exe", "mshta.exe", "wscript.exe", "notepad.exe", "msbuild.exe", "regasm.exe", "Installutil.exe") or

   process.executable : ("?:\\Users\\Public\\*",
                         "?:\\Windows\\SysWOW64\\explorer.exe",
                         "?:\\Users\\*\\AppData\\Local\\Temp\\7z*\\",
                         "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*",
                         "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*\\*",
                         "?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*") or

   (process.parent.name : ("rundll32.exe", "regsvr32.exe", "winword.exe", "excel.exe", "powerpnt.exe") and
    not process.executable : ("?:\\Program Files (x86)\\Microsoft Office\\*", "?:\\Program Files\\Microsoft Office\\*")) or

   (process.name : "powershell.exe" and (length(process.command_line) >= 100 or process.command_line : "*http*"))
  ) and
  not (process.name : ("wscript.exe", "cscript.exe") and process.args : "\\\\*\\SysVol\\*")
  ]
 [library where
  dll.path : ("?:\\Windows\\SysWOW64\\ntdll.dll", "?:\\Windows\\System32\\ntdll.dll") and
  process.thread.Ext.call_stack_summary : "?*" and 
  not process.thread.Ext.call_stack_summary : "ntdll.dll" and
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.symbol_info : ("?:\\Program Files\\ESET\\ESET Security\\ebehmoni.dll*", "?:\\Program Files (x86)\\ESET\\ESET Security\\ebehmoni.dll*"))]
 [dns where dns.question.name : "*.*"]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"