Suspicious Remote Process Thread Access

[rule]
description = """
Identifies attempt to open a remote process thread with THREAD_SET_LIMITED_INFORMATION desired access. This may indicate
an attempt to hijack the remote thread execution priority.
"""
id = "f01594de-1d8e-4995-87e5-dd9e5edb8f88"
license = "Elastic License v2"
name = "Suspicious Remote Process Thread Access"
os_list = ["windows"]
reference = ["https://github.com/Octoberfest7/ThreadCPUAssignment_POC/tree/main"]
version = "1.0.3"

query = '''
api where process.Ext.api.behaviors == "cross-process" and
 process.Ext.api.name == "OpenThread" and process.Ext.api.parameters.desired_access == "THREAD_SET_LIMITED_INFORMATION" and
 Target.process.Ext.token.integrity_level_name == "system" and Target.process.pid != 4 and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true) and
 not (process.executable :("?:\\Windows\\System32\\csrss.exe", "\\\\?\\Volume{*}\\Windows\\System32\\csrss.exe") and user.id == "S-1-5-18")
'''

min_endpoint_version = "8.18.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.18.0"