Suspicious Unsigned DLL Loaded by a Trusted Process

[rule]
description = """
Identifies the load of an unsigned or untrusted DLL by a trusted binary followed by loading a networking DLL from
unbacked memory region. This may indicate execution via DLL sideloading.
"""
id = "14fbbd38-b858-45fa-8bc5-02a7bfd295e6"
license = "Elastic License v2"
name = "Suspicious Unsigned DLL Loaded by a Trusted Process"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.21"

query = '''
sequence by process.entity_id with maxspan=5s
[library where
   (dll.Ext.relative_file_creation_time < 5000 or
    dll.Ext.relative_file_name_modify_time < 5000 or
    (dll.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk","USB *") and not dll.path : "C:\\*")) and
    process.code_signature.trusted == true and
    not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
    dll.hash.sha256 != null and 
    not dll.hash.sha256 in ("e99fec7f1f2fe16029b4dbe30a96325efd7265c9cc8672f60945ce943684442d", "a654a64f0fbd2c34fc2b22cb41e2bf4ac32bd15ae6620e6a4198beb5270790f6") and
    (process.thread.Ext.call_stack_summary : "ntdll.dll*" and not process.thread.Ext.call_stack_summary : "*Unbacked*") and
    not dll.path : ("?:\\Windows\\Installer\\*",
                   "?:\\Windows\\System32\\DriverStore\\FileRepository\\*",
                   "?:\\Windows\\SysWOW64\\DriverStore\\FileRepository\\*",
                   "?:\\Program Files\\*",
                   "?:\\Program Files (x86)\\*",
                   "?:\\Windows\\assembly\\*") and
   not process.executable :
             ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe", "?:\\Windows\\Explorer.exe",
              "?:\\Windows\\SysWOW64\\*", "?:\\Windows\\System32\\*", "?:\\Windows\\splwow64.exe", "?:\\Windows\\Microsoft.NET\\*") and

   /* DLL loaded from the process.executable current directory */
   endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))]
[library where
  dll.name : ("ws2_32.dll", "wininet.dll", "winhttp.dll") and
  process.thread.Ext.call_stack_summary : "ntdll.dll|kernelbase.dll|Unbacked"]
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"