Suspicious Okta Agent Cross Process Activity

[rule]
description = "Identifies attempt to perform code injection targeting OKTA related agent and service processes."
id = "137c9bcd-6be7-4a60-9a06-4e22eb70eded"
license = "Elastic License v2"
name = "Suspicious Okta Agent Cross Process Activity"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security",
    "https://www.elastic.co/security-labs/okta-and-lapsus-what-you-need-to-know",
]
version = "1.0.5"

query = '''
api where
 process.Ext.api.behaviors : "cross-process" and process.Ext.api.name : ("WriteProcessMemory", "VirtualProtectEx", "ReadProcessMemory") and
 process.Ext.api.summary : ("*OktaVerify.exe*", "*OktaAgentService.exe*") and not process.Ext.api.behaviors : "parent-child" and
 process.Ext.api.metadata.target_address_name : "?*" and
 not process.Ext.api.metadata.target_address_name in ("PEB", "PEB32", "ProcessStartupInfo") and
 not process.thread.Ext.call_stack_final_user_module.name : ("Kernel", "Unknown", "Undetermined") and
 not (process.code_signature.status : "trusted" and startswith~(process.thread.Ext.call_stack_final_user_module.name, process.name)) and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "?:\\windows\\sys*\\kernelbase.dll!CreateProcess*") and
 not process.thread.Ext.call_stack_final_user_module.path :
                              ("?:\\Program Files\\*.dll",
                               "?:\\Program Files (x86)\\*.dll",
                               "\\Program Files\\*.dll",
                               "\\Program Files (x86)\\*.dll",
                               "\\windows\\system32\\*.dll",
                               "\\windows\\syswow64\\*.dll",
                               "?:\\windows\\system32\\*.dll",
                               "?:\\Windows\\SysWOW64\\*.dll",
                               "?:\\Windows\\FireEye\\AppMonitorDll*.dll*",
                               "?:\\Windows\\apppatch\\AppPatch*\\exploitblocker.dll*")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"