Suspicious Suspended Process Creation

[rule]
description = """
Identifies suspicious attempts to create a process in suspended state by an unsigned or untrusted binary. This behavior
is consistent with remote code injection attacks.
"""
id = "391f1e23-9ee0-4fa4-82b7-a54bebfa077d"
license = "Elastic License v2"
name = "Suspicious Suspended Process Creation"
os_list = ["windows"]
version = "1.0.8"

query = '''
process where event.action == "start" and

 process.Ext.created_suspended == true and process.parent.executable != null and

 process.parent.thread.Ext.call_stack_contains_unbacked == true and

 process.parent.thread.Ext.call_stack_summary : ("*ntdll.dll|kernelbase.dll|Unbacked*", "*kernel32.dll|Unbacked*", "ntdll.dll|Unbacked*") and

 (process.parent.code_signature.status != "trusted" or process.parent.name : "rundll32.exe") and
 (
  /* process starts a signed MS binary in suspended state */
  process.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation") or

  /* process starts a suspended instance of itself */
  (startswith~(process.executable, process.parent.executable) and
   (
    (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*") or
    process.Ext.relative_file_creation_time <= 500)
    )
    and not process.parent.thread.Ext.call_stack_summary : "*system.ni.dll|Unbacked*"
  ) and

  not (process.name : "rundll32.exe" and process.args :  "C:\\Program Files\\Rapid7\\Insight Agent\\components\\armor\\common\\Armor\\mvarmor32.dll,#1") and

  not process.parent.executable :
              ("?:\\Program Files\\rs2\\rs2Client\\rs2ClientService.exe",
               "?:\\Program Files (x86)\\Steam\\steamapps\\common\\*.exe",
               "?:\\Program Files (x86)\\MEDITECH\\EIH.Universe\\EIH.LIVEF.Ring\\System\\Magic.exe",
               "?:\\SWATCUP-Premium\\SwatCup.exe") and
  not (process.command_line : "rundll32.exe \"C:\\Program Files\\Rapid7\\Insight Agent\\components\\armor\\common\\Armor\\mvarmor32.dll\",#1" and
    process.parent.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|mvarmor64dynamic.dll|kernel32.dll|Unbacked") and
  not process.executable : ("?:\\Program Files (x86)\\Microsoft Visual Studio\\*.exe",
                            "?:\\Program Files\\Microsoft Visual Studio\\*.exe",
                            "?:\\Program Files (x86)\\Windows Kits\\*\\x64\\rc.exe") and
  not (process.executable : "C:\\Windows\\SysWOW64\\rundll32.exe" and
       process.parent.executable : "C:\\Windows\\SysWOW64\\rundll32.exe" and process.parent.args == "--enable-speech-input") and
  not (process.executable : "C:\\Windows\\System32\\msiexec.exe" and process.parent.executable : "C:\\ProgramData\\CentraStage*\\AEMAgent\\RMM.AdvancedSoftwareManagement\\*\\smclient\\SmClient.exe") and
  not _arraysearch(process.parent.thread.Ext.call_stack, $entry,
                    $entry.callsite_trailing_bytes :
                            ("8945d08b45d08945f4837df400741a8b45fc8b80*",
                             "8944246c8b44246c89442460488b8424b0050000*",
                             "488b5560c6420c01*", 
                             "488b9588000000c6420c01833d*", 
                             "488b9580000000c6420c01*",
                             "*85f60f95c10fb6c9898d940000004883bdd8000000007420*",
                             "*85ff0f95c00fb6c0488b9540ffffff488956104881c4e80000005b5e5f415c415d415e415f5d*", 
                             "c22c0090b8c4000000bac06c8077ffd2*", 
                             "8945e48b55f48b45e48942088b4df88b5130ffd2*",
                             "c6430c01833d*33c085f60f95c00fb6c0488b8d38ffffff48894b104881c4f80000005b5e5f415c415d415e41",
                             "c22000cccccccccccccccccccccccccccc8b4c2424518b4c2424528b542424518b4c2424528b542424518b4c2424528b542424518b4c2424528b542424518b48"))
'''

min_endpoint_version = "8.13.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.13.0"