Suspicious Remote Process Suspend Activity

[rule]
description = """
Identifies attempts to suspend a remote process via NtSuspendProcess or a remote thread via SuspendThread and where the
target process is not a child process. Adversaries may use this technique to suspend endpoint security processes or
hijack the execution flow of a running process.
"""
id = "9e533f20-733e-4d71-bbe5-2ab5939aaf57"
license = "Elastic License v2"
name = "Suspicious Remote Process Suspend Activity"
os_list = ["windows"]
version = "1.0.21"

query = '''
api where process.Ext.api.name in ("NtSuspendProcess", "SuspendThread") and process.executable != null and

 process.Ext.api.behaviors == "cross-process" and process.Ext.api.behaviors != "parent-child" and

 Target.process.Ext.token.integrity_level_name != "low" and

 process.Ext.api.summary != null and

 (process.thread.Ext.call_stack_final_user_module.hash.sha256 != null or process.thread.Ext.call_stack_final_user_module.name : "Unbacked") and

 /* provenance metadata exists */
 process.thread.Ext.call_stack_final_user_module.name != null and

 /* skip signed */
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true) and

 /* excluding kernel and unknown */
 not process.thread.Ext.call_stack_final_user_module.name : ("Kernel", "Unknown", "Undetermined") and

 not process.thread.Ext.call_stack_final_user_module.protection_provenance : "Unknown" and

 not process.thread.Ext.call_stack_final_user_module.path :
                                   ("c:\\program files (x86)\\*", "c:\\program files\\*",
                                    "c:\\windows\\assembly\\nativeimages_*\\system.directoryservices.ni.dll",
                                    "c:\\windows\\assembly\\nativeimages_v*\\miguicontrols\\*\\miguicontrols.ni.dll",
                                    "C:\\windows\\system32\\crashcollector.exe", "c:\\windows\\system32\\crashcollector.exe") and

 not process.thread.Ext.call_stack_final_user_module.hash.sha256 :
                        (
                         "6847711e7782729fac009ede5fc3ea5ed6ca54ff582eed3386c1f74d83e1a372",
                         "fdef73d692e2e181075bf43a05cd7ebe551f6b1be31f4d471ff709f83a549612",
                         "0e29025fd573a9d818d05a124f83b6fbe74bbb7c37b8149b43f577d5a74d2f02",
                         "3ca49b11a6b12e9efe8b12076d46f4c1c6e9b4fea44f7e572766a7845c6c24a3",
                         "921b33e55f4a7c806fc1e0547398545ae943fa341ed0e8dc29b4c71d49ecac1a",
                         "bf0a9f2845bc536de2693177e93c67a9467ba992cb08f9c66e34912f60fb910d",
                         "e3101d0ebb2656193086f9ebd53563a6cfd802226d13cdb434d4fb89b2cbab7d", 
                         "9045446fe2a4d4e2807e309e47c75c297dd766d934ca60bf0dabb45dda1857c7", 
                         "fed8a5e8e77bf2099334d7bd55b127027b1048c5039aba3825161f07fb8e0889",
                         "ca02e8e2e60491b0fdf52071bea067c3bf5f12fbddb59ef73d6aa54dc6780606",
                         "418a7dc57d5ac225d7f012fe90a1668a797fde56c9add6c3aad841ab0c1e2bc1",
                         "d74adfbaa1a63bdb0089ecaf1500bcc578118c9b4f648ed09883d76232603737",
                         "224b1025c51438d2ce9343d15d3afc32698187c81dbde28e99a80d042ac8a0b9",
                         "e65e63d51b8fe0eeee53918ddb2a8105b5e396f52341074a7997bbed43311cec",
                         "b792d1243950e98d460fb5541fffc723d097d23cfa6830d70673cbea86623afb",
                         "d7cc5804450a1be697c37440059b97e0911fb20d2ef068bfb458b54c46866151",
                         "d5685e38faccdf97ce6ffe4cf53cbfcf48bb20bf83abe316fba81d1abd093cb6",
                         "4b3e16f6df41a2600ddde4769123151cd7c9dcf88b0d30c2e14cfad81f717529",
                         "e825a252b5c5c9c2de8a6a6ade12a7f9cd0040f6a20e6ee44ba659034e6d5223",
                         "5ae5860e24c1e9604efaedb9f57b733feff2a978b23a16751ba1f31ecc62aa6f",
                         "71deb0afa24ddcb687951026e871121556cf114960833a38a00a8c07e9086357",
                         "f6268995735c5aa33dc02e696992ecb0afda879170b90d3333a7ef27165b045f",
                         "d94ad7bcd32ec7b48fe76a4293205c6eb17191b7882a631ccb4eeabee2a96bca",
                         "ec673caa0c703cc3084887824b800502cd45b4a365c2f8d6cbc5175f0e938e1e",
                         "ad76892733513d2f88eeb61ea18a9594defa52a82eab4fca0202752f651307af",
                         "4a23537d3523441a06b705bca6a7bd601c450b17a0586d669b07fd86c1dc0962",
                         "02bec18f77442249a7099ce975e81d7cb22481dd91717b5e5ae5b8fc62b95899",
                         "bc30b686e6c101b1fd4c52caca31e01227fcea8dfe683de4abcd047ec2acca38",
                         "a995140e5ee8d00e571c19654d4628a11a74b5804768da6e147c559fa3747e23",
                         "94bb9904694212c5b1fd037bf10af23557129862626e1dc45b719926be69690b",
                         "024e8872d37aa6656057abbbdc87a6d5e62f2e3d59c9d6de91fbea00e25407ae",
                         "9783d83df9cce5aa741b47495d48c62c1cb2d4521e4ba0c9d059e7f241dd0186",
                         "c6d97ee3652cfc438830ca0e18e7ea96462fa09505ae0ce4ac422950c1272e81",
                         "ccae2a12091763da594e0ceb83e3aa438bccf2449b2dc91c916232ba2117ae22",
                         "b2a99e7f7f7d0edba76da01959988b3b006b9741d1617e7e290b74866a494cdc",
                         "a41d8d34646abd09ef570b8c87a8d36f19a2cffcbe77ea5d1128d6206851c9d8",
                         "e0037ab4d9764fffad985ed44468b93c8dc9aed366a25a651c83e9c5d6f99fc7",
                         "40949e20630ce1c955f0911995de98c3772828c9a37f257c01a29ed62b5be072",
                         "928bd69d852de58f8cf42a37f79c7f4769000ba8ed1c918717d6430be531f5c7",
                         "b72ba56ae1e3f1c81904f837f98b5c7e054da66923236ce2270fd2fa501bb427",
                         "a82b08fb68efd8d93b7849b7180ad414f98c24a5ba56f431dc7a7ff572c6db72",
                         "a6992d2b1ebc09656a991a8337abefb46c9c4376088a97ddf0e3fe50dd1a80c3",
                         "8e67ae6684baca7f02857efc5463bc1da94506ea20577d9e1c0860a0c02a07a1",
                         "76d338198d607ac1432157b18f85367f402b5404983a2c9ca071062e4dcdba33",
                         "838d44c0a68c5d849a582b5f36e33db2dca89e743ce48e6af68df31c8ac93e26",
                         "2e85b02876568f7e1c9a61075373f98e7e754de6acc6ff0e6b847b598f3a66f5",
                         "27c7d20101e03ec0850cdd58f89b8d5e8494e8c0790919c778947ca14ee68a0d",
                         "c12ade1fc56f70f780e4ed0175dd74da5c8b28807b57de9ba25ee376e4f37533",
                         "a94f89d7829129fe15722723a8a41295aca9f1be4d4a531d19fd7a470c282511",
                         "3db86e281aba8818f67ae4026ec184952791896450c4505515e2bf0787aa47f6",
                         "38da0d335a49473fe31894c02aef49ae053abb7951c5307ccbbb314c7b8601b7",
                         "92c068146977d26a656c462af52dba4ce6e36b21ea5787b1fbf778414c3b6f75",
                         "ac8c1db990bd2c5612b2929c097ed5c3e4bc047158d9d7a39c57723c614dd51e",
                         "6a05773105b10471c6d1b3ee9044b5d161bc6b5d2a9fbbde5d4bc217c58c003d",
                         "9ef2eeb69dfcbfe53cae8727f7f48ec580c4da4a22f84952353159a74ebef566",
                         "6b766ffee9ee5ebeee3830a90870afca99a79e7611fd81f2e4afab009513a3dc",
                         "ca8e711eab79c01a3618039370b4434faebe32b1f0143aebef786da0a53cb031",
                         "6cb3d7575d70a9c23fd2480fa0f973ff633844b7ca4261af607e1188bdb52d10",
                         "3413cfc1180ca6948b1ddf3595148e17ef4b4552297e595cb4281b63dbd4515b",
                         "c90796c07e8febb88895c41d2efff0b31fd6b75448909222a47c42d038851e8a",
                         "d0fd1d51c6f211610768b17be7940d24c1d0c170fffb84e3683d3aa837a2ce8a",
                         "6645b5bc9db6514dd8eab204193c95fd6af4836da1b4b2814cdd703081013ece",
                         "14b052ca942fe7045ed56015a5a292d82d80fb3a88d67f15807a5b433a6c2c2c",
                         "c1bfa6b7da76de1143f8db9a53db49063b85bf1e0b26f4d5c617f1bb23f4fb9d",
                         "e3fdcd2b4c5215e74b0cabe91ce7fe2800cbf8e2a28157342960bca61bbd6b5d",
                         "c1bfa6b7da76de1143f8db9a53db49063b85bf1e0b26f4d5c617f1bb23f4fb9d",
                         "5fe0752c103820b17baa9f8a18a381701217ab1631e80800221f2b32d4c889dd",
                         "6d9bef59e10a848541c81157fa1147cce88dccdddd58a20a4e3410aaddfcb1da",
                         "bd6843726688bd7253a42180bf95671ad5b0f9e787adb4f13250f484abd9eae4",
                         "5ba254c1219707934f81b2037b9efb76716edba6e3c4c9666b615bf4cf146d25",
                         "6351a660b57d8b394c15b4e715ce1a2e0332e29f7458db1497062f55551e94d9",
                         "7300120d19b64fa3a774c7dd7a3104ec3520fa99040913522b14520069f49328",
                         "9e33a1e70193ffde452cb8b1a58044531840b2e319342c000ad0c405d94495b8",
                         "69860a487c2bddefa5951076f6112081db159026ca8ff11ab906e13cecb9d299",
                         "4e4b9bcef90731eb9b1306610fc89ba31296a5875ff5ba628f7271130aa61280",
                         "0ebf7d62158317d644c0eb9d15ba504034abd5484a7df2b10ed409bcbf95f8cf",
                         "14da1fbca85ff2b8ac19ab63f4b7019614865ce8d87bce68100c97174b786ff5",
                         "0f7fd870dd2e7272b92ea5dfe88b2662d859818459a3d2c1e9d669aa1a7dddc2",
                         "9fe9a49cfdf8e5764a264c19a11bb123d5bd9f1d11dbc469709b5a8178ec8f8b",
                         "a09f8a37fb83c759598d57fd6b7d33b1fb75f6b5855f1e74c3303df4b36529b1",
                         "6c6abf6e4c7439b853b27fbf542aba0b9c042d39cc317580fe7d55e65d4375e0",
                         "6eed2886728608f1b3f4a54a7a7d338ef1b1669f6f53a5d38bcd352f0ec755c9",
                         "73de63385d6778896e85b672e056ec10040531c83c0872329cfa1ec1e6e10cec",
                         "cea088ae798d2a4a82dc4cdc1b5c1333daf3be26f651319e2215c87e3c7c3bf3",
                         "56a5148d00c2d9e58415be2d64eca922a58063fe26d9af1c87084aa383c9058e",
                         "83ee0ff920144edb2c2f4ea10130f55443493290886985a63233fa2431e450f9",
                         "f4063507bb92ca017b3ce48cd1b2c029d9393c924af1a10c7720884c74c3cc36",
                         "8052a09fb953cd6dbd529bc0fd8313a8806efe5f4b2370d3bedc1c6edfb319f7",
                         "92f102f6bcbe7e03d8f0beac15ed4de396f09952786c8b632477dae15349ca3e",
                         "71b49d2c08f4d9b5952e44ef06846556c944c14ecff4bc2a4071e67921473e46",
                         "379952ec8113b3692872ffb9d07c242968ee1edfac9b3b888496c1480033be91",
                         "aac5bb07168d5a66e21b69dd68f630d7a06fd27be5409daace1d74af244bb60a",
                         "93b98ec9c3da8c9bc422cff03736ed92f3ed51e2b984a38bf19cca80e15b8c76",
                         "011eb5a6789080192f66cc04c2ceecf57ce867bd854a5b8d530a04f41f50a570",
                         "85ebda733d373181ad89d3b5b34d06d3bcd3003c1d7aa07da6d4dc337ff6180f",
                         "6d41389d80d5308f60b1a856dbd38172500b589acd99fb5532f16f4fc31caada",
                         "48229a57d9a45bef840ade321135cf2d0fb41412a397c0ec9c7eed918c8c967f",
                         "afb9e9f543b2e286d4967a7795d2bb3f31c0b37066494bd68eda2d1570d8ebba",
                         "7ba928d7ed3c0b3659410ed06cf8a3e0f0c875e4edfd7691ce0b646ff41489ad",
                         "afcf23763c3ee1dc16ad80fbdded635bd896b0817997273b18375ac7e0059a18",
                         "dfa736b6a8a9a7eed8e7b546c2c7f8109add4db799521b27f2ec04ddbad70d86",
                         "9d569291755f1937996aecbe32fc5d8df656d0cf4122d4c10130938dfd2229fd",
                         "e6b7e45f7a6375f51e1b675b547c48cc44ba543c7081790f102b658c7626f8e6",
                         "8cbfed45a28e410551411cdd6b6329862ed88cf4476b0aafccea5e4fc16e91e8",
                         "a40e2533a200e9e8f29ccf937b05efc92cc4b56251758d978cf73c83f265a014",
                         "fce8c609368c54a21e87dee938a5b3ee3fa910658856b8b28e8d86794c09374e",
                         "d67886a8dee423035ec807b04227aa6c8b8101a8a5e122cfd49f5901668a94ad",
                         "a587142ad5ffdbd852eed2a25f1f4e4cfd41ce82aee290aff5143093352e581e",
                         "c2101b8c881e165c2ba9a02efd3a529d86bf8825f2eefab0fe5d3c5cef736fb6",
                         "e2049b19974678e2e6cf38da5f7cec1e0199e0b3e03606a3b97bd15d796a5971",
                         "22bc08bf0cec3e84d410e114de0d653c12c20f743ed955f7fc0848f218f47a8d",
                         "7d4a6781df906d745569beb38f09f1711cde80dc69ba94083cb805adb3208f58",
                         "f97e4e8a8753608de13d7b4948aeb7f206829a3218007f5f049de151a75be22c",
                         "389b9caaef229a1d08ce4e65835438e8a0200664e547b8f16688287f82c240ce",
                         "1d403006ac76665391a294578678f23634d5699525ecc589fad808cbf8284030",
                         "70adb308b63b5f02126672cd6d89d830c47b19d1c48d55a13cb4f530a4716e6a",
                         "a3272147ae66166bc1edf8fac3e245e7ab8a2f882efaa52ba6679f96faec5545",
                         "e9b488ad3101d386a3b2248db0c0dfe43c83fd856c55d181264da762f5352f38",
                         "bd9b92d3dd1c5d6ba06d0aa3216c74a293510a8807eaecd756c01edbd650825e",
                         "d0cc0a62b6640f6284e4481dfda62ab2a6f488a483c38a54f218653fec7b47e9",
                         "3c1b985c6a707733b4a93213e8178509366d29b1f2201790b625599d0696966c",
                         "8fb6e0cd1c0d01157ee1a87da9e894f7451988a5349cff5d99f2d3d9c6ffc397",
                         "3f9845508e733e1199c623a36fd6fe235239628731fb7b2b28295dfd39680f0f",
                         "a678fc07f50186fae590d58f1538da74ad808b4ed32122e626a39994e60fe22f",
                         "6f24f59053d5500dc65aee44aeb1c3820b1cf6ff382357dc8a53f8658da5e355",
                         "0eb993c468c54ca784024a49fd60472365b9d5fa1418f4c0dcf2f98c2b899278",
                         "3c9e320785466d7c22e466aa398f90a13b297bae250994620c8170952869d6ef",
                         "153106834fb06976c587c39aaef0e8c0d1b1339a575e8d7b87f187058663a094",
                         "b75f16bcdb9317f01bd2be7ceda6b505997930428c8942390340e0e480316c2e",
                         "e432538f05f4f9616a115502251edb6d6a0c4a77a5132ca9fbcf42e6f6e26272",
                         "06d06200a7d1fd57ebc7353466ad121a450d83ee7f9bbdfd74031a7643e3f575") and

 not (process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\SysWOW64\\WerFault.exe") and 
      process.thread.Ext.call_stack_final_user_module.path : ("?:\\windows\\*", "?:\\program files (x86)\\*", "?:\\program files\\*")) and

 not (process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\SysWOW64\\WerFault.exe") and
      process.thread.Ext.call_stack_summary like "ntdll.dll|*|faultrep.dll|werfault.exe|kernel32.dll|ntdll.dll") and

 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "c:\\windows\\sys?????\\dbgcore.dll!MiniDumpWriteDump*") and
 not process.thread.Ext.call_stack_final_user_module.path like ("e:\\*\\*.exe", "f:\\*\\*.exe")
'''

min_endpoint_version = "8.14.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.0"