Suspicious Windows NT API Hooking

[rule]
description = """
Identifies attempts to hook certain memory section mapping related APIs with suspicious properties. This may indicate an
attempt to evade defense leveraging API hooking.
"""
id = "63f3d1c5-7e19-48db-965d-cc2a52e96650"
license = "Elastic License v2"
name = "Suspicious Windows NT API Hooking"
os_list = ["windows"]
version = "1.0.5"

query = '''
api where process.Ext.api.name == "WriteProcessMemory" and process.Ext.api.behaviors == "hook_api" and
 process.Ext.api.summary : "* Self,*" and
 process.Ext.api.summary like
                           ("*ntdll.dll!??CreateSection*", "*ntdll.dll!??OpenSection*", "*ntdll.dll!??Close*", "*ntdll.dll!??MapViewOfSection*", "*ntdll.dll!??UnmapViewOfSection*") and
 process.Ext.api.parameters.size == 21  and
 not process.Ext.api.behaviors in ("cross-process", "parent-child") and process.thread.Ext.call_stack_final_user_module.name != "Kernel" and
 not (process.code_signature.status == "trusted" and startswith~(process.thread.Ext.call_stack_final_user_module.name, process.name)) and
 not process.thread.Ext.call_stack_final_user_module.path like
                              ("?:\\program files\\*.dll",
                               "?:\\program files (x86)\\*.dll",
                               "\\program files\\*.dll",
                               "\\program files (x86)\\*.dll",
                               "?:\\windows\\sys?????\\hmpalert.dll",
                               "?:\\windows\\system32\\*\\tmmon*.dll*",
                               "?:\\windows\\sys?????\\esensordbi.dll*",
                               "?:\\windows\\system32\\umppc*.dll*",
                               "?:\\windows\\fireeye\\appmonitordll*.dll*",
                               "?:\\windows\\apppatch\\apppatch*\\exploitblocker.dll*")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"