Suspicious Windows API Call from Virtual Disk or USB

[rule]
description = """
Identifies calls to Memory injection related Windows APIs from a process executing from a mounted virtual disk or a
removable device. This may indicate an attempt to get initial access via malicious ISO or USB devices.
"""
id = "9d5f965f-6f77-45df-9733-8707e40d1d71"
license = "Elastic License v2"
name = "Suspicious Windows API Call from Virtual Disk or USB"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.19"

query = '''
sequence by process.entity_id with maxspan=2m
[process where event.action == "start" and
   process.Ext.device.product_id like ("Virtual DVD-ROM", "Virtual Disk", "USB *") and
   not process.executable : "C:\\*" and not process.Ext.device.nt_name: "\\Device\\HarddiskVolume*" and 
   not process.Ext.device.vendor_id == "Citrix" and 
   not (process.code_signature.subject_name in ("Veeam Software Group GmbH", "VMware, Inc.") and process.code_signature.trusted == true) and
   not (process.executable : "?:\\FirefoxPortable\\App\\Firefox\\firefox.exe" and 
        process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)]
[api where event.category == "intrusion_detection" and
  process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
  not process.Ext.api.name in ("SetWindowsHookEx", "NtQueueApcThread") and process.Ext.api.parameters.size > 4096 and
  not process.Ext.api.summary like
                      ("VirtualProtect( user32.dll,*)",
                       "VirtualProtect( clr.dll,*",
                       "VirtualProtect( mscorwks.dll,*",
                       "VirtualProtect( pidgenx.dll,*",
                       "VirtualProtect( sop_check.dll,*",
                       "VirtualProtect( 7-zip.dll,*",
                       "VirtualProtect( umppc*",
                       "VirtualProtect( brc???.tmp,*") and
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.protection_provenance like ("Kernel", "Kernel|*", "hmpalert.dll", "bdhkm32.dll", "tmmon.dll", "ftapihook32.dll")) and
  not process.thread.Ext.call_stack_summary like
        ("ntdll.dll|Unknown|umppc*.dll|ntdll.dll",
         "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|ftapihook32.dll|ntdll.dll|kernelbase.dll|ntdll.dll")]
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"