Suspicious NTDLL Memory Write

[rule]
description = """
Identifies attempts to modify the memory region of NTDLL. This may indicate an attempt to unhook or perform code
injection.
"""
id = "7a23d763-4904-40f9-8169-0c49af65ad30"
license = "Elastic License v2"
name = "Suspicious NTDLL Memory Write"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.10"

query = '''
api where process.executable != null and not process.code_signature.status : "trusted" and 
 process.Ext.api.name : "WriteProcessMemory" and process.Ext.api.summary : "*ntdll.dll*" and 
 (
  stringcontains~(process.thread.Ext.call_stack_final_user_module.protection_provenance, process.name) or 
  process.thread.Ext.call_stack_final_user_module.name : "ntdll.dll" or 
  process.thread.Ext.call_stack_final_user_module.protection_provenance : "ntdll.dll"
  )  and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                 ("e52b72e118bf40d237a39a968b5589e1c70f4b0d4f4b8eae0893aee64c1f9215",
                                  "ab93faa2f3a7e67a0489a5cc49327eb83bd5b48ed43ccc6112854fea7d20a620",
                                  "680dc9c393faad3851147bcbb3c5a1fd29b8ed61ddf1bf416f4415132d85f784",
                                  "0b9b29eca46cc2519d50bba5745cfc350f361fb8c707300b1b5c87226236a586",
                                  "c74e71221e5f7948f9f6166c9a57f3dff24c4dd70314d9642453b1fcd17bee28",
                                  "ce76b4f522db2b1c1214aecdfaa149589e81e9b6f439fa2ea6046a62fc43e135",
                                  "f6c78f7106c2382cb813b0306b735b0ed45c0fc31bad07a8b35003e3a0797efe") and
  not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "\\device\\mup\\*\\sfmcoresd41.dll"
'''

min_endpoint_version = "8.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.15.0"