System Utility Execution from Unbacked Memory

[rule]
description = """
Identifies execution of common Windows system utilities (reg, schtasks, sc, PowerShell, or cmd) where the parent process
is unsigned or untrusted, runs from a user-writable location, and the creating thread call stack ends in unbacked
memory. This may indicate process injection or shellcode invoking built-in tools for persistence or defense evasion.
"""
id = "f4a8c2e1-6b3d-4f9a-8e2c-1d5a7b9e0f43"
license = "Elastic License v2"
name = "System Utility Execution from Unbacked Memory"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.1"

query = '''
process where event.action == "start" and process.name : ("reg.exe", "schtasks.exe", "sc.exe", "powershell.exe", "cmd.exe") and
 (process.parent.code_signature.exists == false or process.parent.code_signature.trusted == false) and
 process.parent.thread.Ext.call_stack_summary in 
                                ("ntdll.dll|Unbacked", 
                                 "ntdll.dll|kernelbase.dll|Unbacked", 
                                 "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked", 
                                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",  
                                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked", 
                                 "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll") and
 process.parent.executable : ("?:\\Users\\*", "?:\\ProgramData\\*") and 
 not (process.parent.executable : ("?:\\ProgramData\\CentraStage*.exe", "?:\\ProgramData\\NinjaRMMAgent\\*.exe") and 
      process.parent.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked")
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"