Detection rules › Elastic
Unbacked Shellcode from Unsigned Module
Identifies attempt to allocate or execute Shellcode from a module with low or unknown reputation.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Rule body
[rule]
description = "Identifies attempt to allocate or execute Shellcode from a module with low or unknown reputation."
id = "99d3049e-f4af-46a7-9406-33482955bec9"
license = "Elastic License v2"
name = "Unbacked Shellcode from Unsigned Module"
os_list = ["windows"]
reference = [
"https://www.elastic.co/security-labs/pikabot-i-choose-you",
"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
]
version = "1.0.14"
query = '''
api where
process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
process.thread.Ext.call_stack_final_user_module.protection_provenance_path != null and
process.thread.Ext.call_stack_summary in
("ntdll.dll|Unbacked",
"ntdll.dll|kernelbase.dll|Unbacked",
"ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll") and
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "Unbacked*" and $entry.callsite_trailing_bytes like "?*") and
_arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.status == "errorBadDigest" or $entry.exists == false) and
not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like
("c:\\windows\\microsoft.net\\framework*\\clr.dll",
"c:\\program files (x86)\\adobe\\acrobat*\\acrobat\\acrobat.dll") and
not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
("a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021",
"c434208894f07f604b852f29b8edc3a58c4de63de783373733e72b2b73f33be9",
"cb79e99da5b41d61302c941ed1dbe8c5d354dc789b10d9ec69892b27900b7279",
"fdad52e85048040319faaa2cd1546346957f86343c4b89d30153edb7a8fd0b90",
"69310b1df649a25d78941704536805393e6b17e011e763e0e80e023baaccccd6",
"b5480453a6e4cac87a9ac05459dfe57f0a72e591afc19c0b5686a2de02c7c346",
"5d20266760e95e56b12705e69e58d09625b9c5e2e94b2f706cebaa275598446a",
"ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
"4077289062777cf8e60bd81a2efe1350eeb60301679b3c236863cae7b4d8cc5a",
"616217f667bd2dc9e27d066239f83b3f5554b0ff10edc002ee63e3fcf62cc5d8",
"60ebc86c2dd03056ad48adc6d2468fd54c548a55d2d305577eb7e079d90ac13f",
"3cd00f456f51829eda119e0e133acc1e45a5930d61fc335a2e9aa688a836a24d",
"97d97c37d51be172951ed8a98f6fa0c2b7a2c9df14a44d0abf971d73e46e9373",
"891113b49c9876f9e46d445ff0534e48573e0e518d53b7161a381664df32ba77",
"a3b4a357f5b068add25ea0b2ed8e566ab2e6f4359df83b18f525b54490ec3f28",
"2ffc321b0cb1f6b89fe09c597c94cd30e82f405cb982234d6383061b8ea6b12e",
"93f53280052d0f700259b42a62f8658d9b2a741b54063f277e9b83264448fb21",
"bd0e0a6f9e5e73cbd5637c6efada0efcc030ebb86a3a00df9dd03db1e7a533b7",
"fc48fcbdb74be72b6222883f11b59ab9f2e6019a6c6565d7de183a08e77df47f",
"430cb452335968804d57225c0e887bd2194ee1c55d160a6df2f62d0c326b47ee",
"898e78d91da372f9f5039601581b3aadf9e62a06dd005a2851ce20275780e4b1",
"0f7c82d426b124fb9a21cda05184e0860bc400dc354f9aaafb1c9af84b7363e2",
"67445d47d7e70e7b0f94b752f027e04a5453b5b14ea56c433660b27d016a734d",
"fdf036edcd2fc6997a6eeaac4b58e4b533cd6abdf15d18a53621832bff038be0",
"e3868e9daf4d9e34bf5b2f48bf5cab45e9b88e39cea578edb01cd96607eecf09",
"c5473c258cc2619ff88c16c9062f7feb29e66b3ecf205cf640b5abcaf316a487",
"27bb524de82dbab7461e09329afebb0361127494abb3782bbafdb9d9986df9c2",
"8f63c4fee17990a9988a6fc0a32635095226588e79cfcbbcbcb89afc021b7f71",
"38d155e2cac8c63774e1706307b29b1058c2479871c9331157370d67c53f0cbb",
"0738dc614d751b3b08125c03a920fc243a3e5eea4f16d3374d8d94a6e2454477",
"86699ebbcdbee712a4b798391b178a19ec18e0631bbc74875eda70af21b1da7e",
"3b283e5b05e232abab6e8144e3eb58ad456ad496d284e88f749cb8d6df2c0f62",
"a0d9f666f5e253031b5364c955c120b6b917749645b9e97bd8cc324597d450d4",
"4fd048ceaf8dff00bfb27851ea00d31d713ae72367e91bbf95607fac82fb8b38",
"de38e935cf249af5669d57ef9670ba4b9f324774fae9fd9cceb37b238305a155",
"11a970455d4536e4c4cdd655b864f5b01e7e8421b329196e0d878be2430cd20d",
"1b5d9cec668335295c8e575bcedf4afcedbc445d8ccf8374c9380188965e78e3",
"9becd39f90077a5ab064681c0a1be139d15be9ce434bacd48cd1dc894d3911cb",
"5438c19007ad96da0a969c0c0caaf00aa06375f1a6e85073f91a1392af94d059",
"86ccc87140479b5631c2e9c66b54739db1761d82449eba225064d91e99dcab16",
"462ddeb363a05574fc5e670a5f6e040ecdf6eaf3de6f5b495b1e11e105b1913b",
"152f3801c03c08bdbad67bab16d14c0fb118bf335e1ba215b096cc75a299f84f",
"aba42c861e070696ee85392586e5d6d7d7abcf8bba798ee6a571cc49c22201b6",
"00fe581520c7a22a461b3ce78cd5e48bcf05e2bb1c60f4e9e2b4cd81d0e07760",
"288bd8098f36110c8cc10c1508f1f23e0916bd36fad592f74518b7f3b06f3788",
"de15024667157e9d84dda0785332c22d69a87199798373ec3c9c2d1f3df650f5",
"59cc348f9711525abd54e88df810150e3a9a20910387427e208e4d74d5362027",
"1d1cfd19249c06adefa0ff104d3f5db7f48568993c540576ef1930210793c975",
"812b8169afda1309e677e8f1f1a7cca6a6bc7dd498d92167e157fc989fecc94b",
"04ab613c895b35044af8a9a98a372a5769c80245cc9d6bf710a94c5bc42fa1b3",
"2071a9a74867609405b218e98de8c3a7286c43b059932301516515ce887f7e35",
"16073f3361e91126909aab4ba7c50443d7b8ef070f523b7af2901d6385e99438",
"61ebd26043bfb155950d0d4b829f34e1ad6151b51bf9581e42acf621da1c1d86",
"67766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3",
"a088cda2df4f3cc371c5aaa5e40d5ce771b07e3e0b9c6fe51aa3af797dc7cddb",
"fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85",
"f079a18c0abc9569429d402357e2daa4fe2af4cdbe3c002a5f05a70d33e7bffb",
"3a4ea2314b41a7720de2343602ef6268fa6bb660f3ee3633adc284e69ff1d83a",
"64fe90e25526f5b819b170c9ddcc593a7e65950f8e37c7da45d265cced3f2e73",
"a932fdd6f3a209a64eed1fa14d7b183850125b4840c9c227df390f5947dbda71",
"5c2a95e195f77fe20eb57e0a117835ea378aa0da2f4b4cc7cd73fe2722d69c47",
"16264a04dae64a04df2c049193d6d1811377b30aa02de69e186a791039eac36d",
"b152de9afc373bba831dc9c1b137668462ae6d46ccd46815f2ffcc7f1bfc7056",
"a87b3f02042de4d655f72af65ed5242fae5c675bebd19e962978c13e6d99ba00",
"2ea11e8b009bed581a6502d64d4d1a67c6046806c6c79a5195fa2d337b0d96b0",
"690c0be983bf27eb62428c93a534b66f3d11a8d6b30cb629425bd5a6f7232762",
"7acaa0e07d37cdd814408145b1d0f2137eaf068ff716eee09f39c8e4625550fb",
"18d1bae077da62bb5cf5bfa6a6c5c38ac9ade57f098ea2b357fab477e85f1c25",
"9ac13f9bc5564fd8a1eab5f7c945dce1c27940dd63a913108eac64481ddde6af",
"965162abde211f72c80062b1799eb4385d3e9322c4b38b8da9dc718a769570b7",
"d355b62cc7dc5b8f3ee5e95a8ddddc818f6f84c5a16799d78b1cb3d786e2bb80",
"765bf93c500ca73d73a5ba790f7c1675ff6ffdc7c54ee03dafca69ee701f5cfe",
"eee4d4620d56c8c0212437b184444e1fe74e29d6d018d69750e52b27e9eba46b",
"f939f09133e4a6a050e085adcdebadc92a45bd8696d75895ea520cfbd0167ebe",
"9d0a822bf161b9b2daf06d515ec1bb202150e87f6d938510d2f4bfcf9d06e14f",
"aa0e85beff0697474d0419349e9c1afb3bf711ffcd26a696dd2a1d192a90da36",
"d2cd65a4e6eb99acaf2f168bd650e6b3c91144d08f01b0b772de13dce28c7ce9",
/* Benign self-modifying commercial software (self-provenance, telemetry FP triage) */
"996129f8229e532dcbb93fcd5a704b707e97796fd55ad6382306ee03f58c8f95",
"6f2ee6f8f3240112ff6a861657228ba29144be11a281ad0517eab0f2a421eeb3",
"4a632d7a938585502452bc3afd328a7d598934bd56dcb13042ecd76f10743510",
"04f967d77dba69d8369218a2ae316c210749f0b1279ac563d8d281dea7b8c6e4") and
not process.thread.Ext.call_stack_final_user_module.protection_provenance in ("isrt.dll", "issetup.dll", "dbexpida.dll", "cyinjct.dll", "_isres.dll", "bass.dll") and
not (process.executable : "C:\\Windows\\SysWOW64\\msiexec.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance like ("msi*.tmp", "_isres.dll", "itcombo6.ocx")) and
not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like
("c:\\windows\\installer\\msi*.tmp",
"c:\\windows\\assembly\\*",
"c:\\windows\\systemtemp\\msi*.tmp",
"c:\\program files\\*",
"c:\\program files (x86)\\*",
"c:\\windows\\microsoft.net\\*.dll") and
not (process.parent.executable : "D:\\nvt\\NvtServ.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance_path : "d:\\nvc\\bin\\*") and
not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and
$entry.callsite_trailing_bytes like ("5a8bf850528b338b432003c28b08894b208b431c03c28b08894b1c03f28b4b0c03ca8d431c505756ffd15a580343088bf8528bf08b46fc83c0042bf08956088b",
"89035e5bc39068008000006a008b0050a1dc6*", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
"8985271f*56e85301000090909090909090908b4e3485c90f848900000003")) and
not (process.Ext.api.name == "VirtualProtect" and _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "*kernelbase.dll!LoadLibraryA*")) and
not (process.Ext.api.name == "VirtualAlloc" and process.Ext.api.parameters.size < 30 and
process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked") and
not (process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked" and
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes like "8985*90909090909090908b4e3485c90f848900000003"))
'''
min_endpoint_version = "8.14.2"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.14.2"
Stages and Predicates
Stage 1: api
api where
process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
process.thread.Ext.call_stack_final_user_module.protection_provenance_path != null and
process.thread.Ext.call_stack_summary in
("ntdll.dll|Unbacked",
"ntdll.dll|kernelbase.dll|Unbacked",
"ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll") and
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "Unbacked*" and $entry.callsite_trailing_bytes like "?*") and
_arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.status == "errorBadDigest" or $entry.exists == false) and
not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like
("c:\\windows\\microsoft.net\\framework*\\clr.dll",
"c:\\program files (x86)\\adobe\\acrobat*\\acrobat\\acrobat.dll") and
not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
("a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021",
"c434208894f07f604b852f29b8edc3a58c4de63de783373733e72b2b73f33be9",
"cb79e99da5b41d61302c941ed1dbe8c5d354dc789b10d9ec69892b27900b7279",
"fdad52e85048040319faaa2cd1546346957f86343c4b89d30153edb7a8fd0b90",
"69310b1df649a25d78941704536805393e6b17e011e763e0e80e023baaccccd6",
"b5480453a6e4cac87a9ac05459dfe57f0a72e591afc19c0b5686a2de02c7c346",
"5d20266760e95e56b12705e69e58d09625b9c5e2e94b2f706cebaa275598446a",
"ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
"4077289062777cf8e60bd81a2efe1350eeb60301679b3c236863cae7b4d8cc5a",
"616217f667bd2dc9e27d066239f83b3f5554b0ff10edc002ee63e3fcf62cc5d8",
"60ebc86c2dd03056ad48adc6d2468fd54c548a55d2d305577eb7e079d90ac13f",
"3cd00f456f51829eda119e0e133acc1e45a5930d61fc335a2e9aa688a836a24d",
"97d97c37d51be172951ed8a98f6fa0c2b7a2c9df14a44d0abf971d73e46e9373",
"891113b49c9876f9e46d445ff0534e48573e0e518d53b7161a381664df32ba77",
"a3b4a357f5b068add25ea0b2ed8e566ab2e6f4359df83b18f525b54490ec3f28",
"2ffc321b0cb1f6b89fe09c597c94cd30e82f405cb982234d6383061b8ea6b12e",
"93f53280052d0f700259b42a62f8658d9b2a741b54063f277e9b83264448fb21",
"bd0e0a6f9e5e73cbd5637c6efada0efcc030ebb86a3a00df9dd03db1e7a533b7",
"fc48fcbdb74be72b6222883f11b59ab9f2e6019a6c6565d7de183a08e77df47f",
"430cb452335968804d57225c0e887bd2194ee1c55d160a6df2f62d0c326b47ee",
"898e78d91da372f9f5039601581b3aadf9e62a06dd005a2851ce20275780e4b1",
"0f7c82d426b124fb9a21cda05184e0860bc400dc354f9aaafb1c9af84b7363e2",
"67445d47d7e70e7b0f94b752f027e04a5453b5b14ea56c433660b27d016a734d",
"fdf036edcd2fc6997a6eeaac4b58e4b533cd6abdf15d18a53621832bff038be0",
"e3868e9daf4d9e34bf5b2f48bf5cab45e9b88e39cea578edb01cd96607eecf09",
"c5473c258cc2619ff88c16c9062f7feb29e66b3ecf205cf640b5abcaf316a487",
"27bb524de82dbab7461e09329afebb0361127494abb3782bbafdb9d9986df9c2",
"8f63c4fee17990a9988a6fc0a32635095226588e79cfcbbcbcb89afc021b7f71",
"38d155e2cac8c63774e1706307b29b1058c2479871c9331157370d67c53f0cbb",
"0738dc614d751b3b08125c03a920fc243a3e5eea4f16d3374d8d94a6e2454477",
"86699ebbcdbee712a4b798391b178a19ec18e0631bbc74875eda70af21b1da7e",
"3b283e5b05e232abab6e8144e3eb58ad456ad496d284e88f749cb8d6df2c0f62",
"a0d9f666f5e253031b5364c955c120b6b917749645b9e97bd8cc324597d450d4",
"4fd048ceaf8dff00bfb27851ea00d31d713ae72367e91bbf95607fac82fb8b38",
"de38e935cf249af5669d57ef9670ba4b9f324774fae9fd9cceb37b238305a155",
"11a970455d4536e4c4cdd655b864f5b01e7e8421b329196e0d878be2430cd20d",
"1b5d9cec668335295c8e575bcedf4afcedbc445d8ccf8374c9380188965e78e3",
"9becd39f90077a5ab064681c0a1be139d15be9ce434bacd48cd1dc894d3911cb",
"5438c19007ad96da0a969c0c0caaf00aa06375f1a6e85073f91a1392af94d059",
"86ccc87140479b5631c2e9c66b54739db1761d82449eba225064d91e99dcab16",
"462ddeb363a05574fc5e670a5f6e040ecdf6eaf3de6f5b495b1e11e105b1913b",
"152f3801c03c08bdbad67bab16d14c0fb118bf335e1ba215b096cc75a299f84f",
"aba42c861e070696ee85392586e5d6d7d7abcf8bba798ee6a571cc49c22201b6",
"00fe581520c7a22a461b3ce78cd5e48bcf05e2bb1c60f4e9e2b4cd81d0e07760",
"288bd8098f36110c8cc10c1508f1f23e0916bd36fad592f74518b7f3b06f3788",
"de15024667157e9d84dda0785332c22d69a87199798373ec3c9c2d1f3df650f5",
"59cc348f9711525abd54e88df810150e3a9a20910387427e208e4d74d5362027",
"1d1cfd19249c06adefa0ff104d3f5db7f48568993c540576ef1930210793c975",
"812b8169afda1309e677e8f1f1a7cca6a6bc7dd498d92167e157fc989fecc94b",
"04ab613c895b35044af8a9a98a372a5769c80245cc9d6bf710a94c5bc42fa1b3",
"2071a9a74867609405b218e98de8c3a7286c43b059932301516515ce887f7e35",
"16073f3361e91126909aab4ba7c50443d7b8ef070f523b7af2901d6385e99438",
"61ebd26043bfb155950d0d4b829f34e1ad6151b51bf9581e42acf621da1c1d86",
"67766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3",
"a088cda2df4f3cc371c5aaa5e40d5ce771b07e3e0b9c6fe51aa3af797dc7cddb",
"fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85",
"f079a18c0abc9569429d402357e2daa4fe2af4cdbe3c002a5f05a70d33e7bffb",
"3a4ea2314b41a7720de2343602ef6268fa6bb660f3ee3633adc284e69ff1d83a",
"64fe90e25526f5b819b170c9ddcc593a7e65950f8e37c7da45d265cced3f2e73",
"a932fdd6f3a209a64eed1fa14d7b183850125b4840c9c227df390f5947dbda71",
"5c2a95e195f77fe20eb57e0a117835ea378aa0da2f4b4cc7cd73fe2722d69c47",
"16264a04dae64a04df2c049193d6d1811377b30aa02de69e186a791039eac36d",
"b152de9afc373bba831dc9c1b137668462ae6d46ccd46815f2ffcc7f1bfc7056",
"a87b3f02042de4d655f72af65ed5242fae5c675bebd19e962978c13e6d99ba00",
"2ea11e8b009bed581a6502d64d4d1a67c6046806c6c79a5195fa2d337b0d96b0",
"690c0be983bf27eb62428c93a534b66f3d11a8d6b30cb629425bd5a6f7232762",
"7acaa0e07d37cdd814408145b1d0f2137eaf068ff716eee09f39c8e4625550fb",
"18d1bae077da62bb5cf5bfa6a6c5c38ac9ade57f098ea2b357fab477e85f1c25",
"9ac13f9bc5564fd8a1eab5f7c945dce1c27940dd63a913108eac64481ddde6af",
"965162abde211f72c80062b1799eb4385d3e9322c4b38b8da9dc718a769570b7",
"d355b62cc7dc5b8f3ee5e95a8ddddc818f6f84c5a16799d78b1cb3d786e2bb80",
"765bf93c500ca73d73a5ba790f7c1675ff6ffdc7c54ee03dafca69ee701f5cfe",
"eee4d4620d56c8c0212437b184444e1fe74e29d6d018d69750e52b27e9eba46b",
"f939f09133e4a6a050e085adcdebadc92a45bd8696d75895ea520cfbd0167ebe",
"9d0a822bf161b9b2daf06d515ec1bb202150e87f6d938510d2f4bfcf9d06e14f",
"aa0e85beff0697474d0419349e9c1afb3bf711ffcd26a696dd2a1d192a90da36",
"d2cd65a4e6eb99acaf2f168bd650e6b3c91144d08f01b0b772de13dce28c7ce9",
"996129f8229e532dcbb93fcd5a704b707e97796fd55ad6382306ee03f58c8f95",
"6f2ee6f8f3240112ff6a861657228ba29144be11a281ad0517eab0f2a421eeb3",
"4a632d7a938585502452bc3afd328a7d598934bd56dcb13042ecd76f10743510",
"04f967d77dba69d8369218a2ae316c210749f0b1279ac563d8d281dea7b8c6e4") and
not process.thread.Ext.call_stack_final_user_module.protection_provenance in ("isrt.dll", "issetup.dll", "dbexpida.dll", "cyinjct.dll", "_isres.dll", "bass.dll") and
not (process.executable : "C:\\Windows\\SysWOW64\\msiexec.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance like ("msi*.tmp", "_isres.dll", "itcombo6.ocx")) and
not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like
("c:\\windows\\installer\\msi*.tmp",
"c:\\windows\\assembly\\*",
"c:\\windows\\systemtemp\\msi*.tmp",
"c:\\program files\\*",
"c:\\program files (x86)\\*",
"c:\\windows\\microsoft.net\\*.dll") and
not (process.parent.executable : "D:\\nvt\\NvtServ.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance_path : "d:\\nvc\\bin\\*") and
not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and
$entry.callsite_trailing_bytes like ("5a8bf850528b338b432003c28b08894b208b431c03c28b08894b1c03f28b4b0c03ca8d431c505756ffd15a580343088bf8528bf08b46fc83c0042bf08956088b",
"89035e5bc39068008000006a008b0050a1dc6*", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
"8985271f*56e85301000090909090909090908b4e3485c90f848900000003")) and
not (process.Ext.api.name == "VirtualProtect" and _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "*kernelbase.dll!LoadLibraryA*")) and
not (process.Ext.api.name == "VirtualAlloc" and process.Ext.api.parameters.size < 30 and
process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked") and
not (process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked" and
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes like "8985*90909090909090908b4e3485c90f848900000003"))
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
process.thread.Ext.call_stack | array_any | excludes:process.thread.Ext.call_stack | |
process.thread.Ext.call_stack_summary | eq | ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked | excludes:process.thread.Ext.call_stack_summary field:"process.thread.Ext.call_stack_summary" value:"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked" |
process.Ext.api.name | eq | VirtualProtect | excludes:process.Ext.api.name field:"process.Ext.api.name" value:"VirtualProtect" |
process.Ext.api.name | eq | VirtualAlloc | excludes:process.Ext.api.name field:"process.Ext.api.name" value:"VirtualAlloc" |
process.Ext.api.parameters.size | lt | 30 | excludes:process.Ext.api.parameters.size field:"process.Ext.api.parameters.size" value:"30" |
process.executable | eq | C:\Windows\SysWOW64\msiexec.exe | excludes:process.executable field:"process.executable" value:"C:\Windows\SysWOW64\msiexec.exe" |
process.thread.Ext.call_stack_final_user_module.protection_provenance | wildcard | msi*.tmp, _isres.dll, itcombo6.ocx | excludes:process.thread.Ext.call_stack_final_user_module.protection_provenance field:"process.thread.Ext.call_stack_final_user_module.protection_provenance" value:"msi*.tmp" field:"process.thread.Ext.call_stack_final_user_module.protection_provenance" value:"_isres.dll" field:"process.thread.Ext.call_stack_final_user_module.protection_provenance" value:"itcombo6.ocx" |
process.parent.executable | eq | D:\nvt\NvtServ.exe | excludes:process.parent.executable field:"process.parent.executable" value:"D:\nvt\NvtServ.exe" |
process.thread.Ext.call_stack_final_user_module.protection_provenance_path | starts_with | d:\nvc\bin\ | excludes:process.thread.Ext.call_stack_final_user_module.protection_provenance_path field:"process.thread.Ext.call_stack_final_user_module.protection_provenance_path" value:"d:\nvc\bin\" |
process.thread.Ext.call_stack_final_user_module.hash.sha256 | in | 00fe581520c7a22a461b3ce78cd5e48bcf05e2bb1c60f4e9e2b4cd81d0e07760, 04ab613c895b35044af8a9a98a372a5769c80245cc9d6bf710a94c5bc42fa1b3, 04f967d77dba69d8369218a2ae316c210749f0b1279ac563d8d281dea7b8c6e4, 0738dc614d751b3b08125c03a920fc243a3e5eea4f16d3374d8d94a6e2454477, 0f7c82d426b124fb9a21cda05184e0860bc400dc354f9aaafb1c9af84b7363e2, 11a970455d4536e4c4cdd655b864f5b01e7e8421b329196e0d878be2430cd20d, 152f3801c03c08bdbad67bab16d14c0fb118bf335e1ba215b096cc75a299f84f, 16073f3361e91126909aab4ba7c50443d7b8ef070f523b7af2901d6385e99438, 16264a04dae64a04df2c049193d6d1811377b30aa02de69e186a791039eac36d, 18d1bae077da62bb5cf5bfa6a6c5c38ac9ade57f098ea2b357fab477e85f1c25, 1b5d9cec668335295c8e575bcedf4afcedbc445d8ccf8374c9380188965e78e3, 1d1cfd19249c06adefa0ff104d3f5db7f48568993c540576ef1930210793c975, 2071a9a74867609405b218e98de8c3a7286c43b059932301516515ce887f7e35, 27bb524de82dbab7461e09329afebb0361127494abb3782bbafdb9d9986df9c2, 288bd8098f36110c8cc10c1508f1f23e0916bd36fad592f74518b7f3b06f3788, 2ea11e8b009bed581a6502d64d4d1a67c6046806c6c79a5195fa2d337b0d96b0, 2ffc321b0cb1f6b89fe09c597c94cd30e82f405cb982234d6383061b8ea6b12e, 38d155e2cac8c63774e1706307b29b1058c2479871c9331157370d67c53f0cbb, 3a4ea2314b41a7720de2343602ef6268fa6bb660f3ee3633adc284e69ff1d83a, 3b283e5b05e232abab6e8144e3eb58ad456ad496d284e88f749cb8d6df2c0f62, 3cd00f456f51829eda119e0e133acc1e45a5930d61fc335a2e9aa688a836a24d, 4077289062777cf8e60bd81a2efe1350eeb60301679b3c236863cae7b4d8cc5a, 430cb452335968804d57225c0e887bd2194ee1c55d160a6df2f62d0c326b47ee, 462ddeb363a05574fc5e670a5f6e040ecdf6eaf3de6f5b495b1e11e105b1913b, 4a632d7a938585502452bc3afd328a7d598934bd56dcb13042ecd76f10743510, 4fd048ceaf8dff00bfb27851ea00d31d713ae72367e91bbf95607fac82fb8b38, 5438c19007ad96da0a969c0c0caaf00aa06375f1a6e85073f91a1392af94d059, 59cc348f9711525abd54e88df810150e3a9a20910387427e208e4d74d5362027, 5c2a95e195f77fe20eb57e0a117835ea378aa0da2f4b4cc7cd73fe2722d69c47, 5d20266760e95e56b12705e69e58d09625b9c5e2e94b2f706cebaa275598446a, 60ebc86c2dd03056ad48adc6d2468fd54c548a55d2d305577eb7e079d90ac13f, 616217f667bd2dc9e27d066239f83b3f5554b0ff10edc002ee63e3fcf62cc5d8, 61ebd26043bfb155950d0d4b829f34e1ad6151b51bf9581e42acf621da1c1d86, 64fe90e25526f5b819b170c9ddcc593a7e65950f8e37c7da45d265cced3f2e73, 67445d47d7e70e7b0f94b752f027e04a5453b5b14ea56c433660b27d016a734d, 67766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3, 690c0be983bf27eb62428c93a534b66f3d11a8d6b30cb629425bd5a6f7232762, 69310b1df649a25d78941704536805393e6b17e011e763e0e80e023baaccccd6, 6f2ee6f8f3240112ff6a861657228ba29144be11a281ad0517eab0f2a421eeb3, 765bf93c500ca73d73a5ba790f7c1675ff6ffdc7c54ee03dafca69ee701f5cfe, 7acaa0e07d37cdd814408145b1d0f2137eaf068ff716eee09f39c8e4625550fb, 812b8169afda1309e677e8f1f1a7cca6a6bc7dd498d92167e157fc989fecc94b, 86699ebbcdbee712a4b798391b178a19ec18e0631bbc74875eda70af21b1da7e, 86ccc87140479b5631c2e9c66b54739db1761d82449eba225064d91e99dcab16, 891113b49c9876f9e46d445ff0534e48573e0e518d53b7161a381664df32ba77, 898e78d91da372f9f5039601581b3aadf9e62a06dd005a2851ce20275780e4b1, 8f63c4fee17990a9988a6fc0a32635095226588e79cfcbbcbcb89afc021b7f71, 93f53280052d0f700259b42a62f8658d9b2a741b54063f277e9b83264448fb21, 965162abde211f72c80062b1799eb4385d3e9322c4b38b8da9dc718a769570b7, 97d97c37d51be172951ed8a98f6fa0c2b7a2c9df14a44d0abf971d73e46e9373, 996129f8229e532dcbb93fcd5a704b707e97796fd55ad6382306ee03f58c8f95, 9ac13f9bc5564fd8a1eab5f7c945dce1c27940dd63a913108eac64481ddde6af, 9becd39f90077a5ab064681c0a1be139d15be9ce434bacd48cd1dc894d3911cb, 9d0a822bf161b9b2daf06d515ec1bb202150e87f6d938510d2f4bfcf9d06e14f, a088cda2df4f3cc371c5aaa5e40d5ce771b07e3e0b9c6fe51aa3af797dc7cddb, a0d9f666f5e253031b5364c955c120b6b917749645b9e97bd8cc324597d450d4, a3b4a357f5b068add25ea0b2ed8e566ab2e6f4359df83b18f525b54490ec3f28, a87b3f02042de4d655f72af65ed5242fae5c675bebd19e962978c13e6d99ba00, a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021, a932fdd6f3a209a64eed1fa14d7b183850125b4840c9c227df390f5947dbda71, aa0e85beff0697474d0419349e9c1afb3bf711ffcd26a696dd2a1d192a90da36, aba42c861e070696ee85392586e5d6d7d7abcf8bba798ee6a571cc49c22201b6, b152de9afc373bba831dc9c1b137668462ae6d46ccd46815f2ffcc7f1bfc7056, b5480453a6e4cac87a9ac05459dfe57f0a72e591afc19c0b5686a2de02c7c346, bd0e0a6f9e5e73cbd5637c6efada0efcc030ebb86a3a00df9dd03db1e7a533b7, c434208894f07f604b852f29b8edc3a58c4de63de783373733e72b2b73f33be9, c5473c258cc2619ff88c16c9062f7feb29e66b3ecf205cf640b5abcaf316a487, cb79e99da5b41d61302c941ed1dbe8c5d354dc789b10d9ec69892b27900b7279, d2cd65a4e6eb99acaf2f168bd650e6b3c91144d08f01b0b772de13dce28c7ce9, d355b62cc7dc5b8f3ee5e95a8ddddc818f6f84c5a16799d78b1cb3d786e2bb80, de15024667157e9d84dda0785332c22d69a87199798373ec3c9c2d1f3df650f5, de38e935cf249af5669d57ef9670ba4b9f324774fae9fd9cceb37b238305a155, e3868e9daf4d9e34bf5b2f48bf5cab45e9b88e39cea578edb01cd96607eecf09, ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9, eee4d4620d56c8c0212437b184444e1fe74e29d6d018d69750e52b27e9eba46b, f079a18c0abc9569429d402357e2daa4fe2af4cdbe3c002a5f05a70d33e7bffb, f939f09133e4a6a050e085adcdebadc92a45bd8696d75895ea520cfbd0167ebe, fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85, fc48fcbdb74be72b6222883f11b59ab9f2e6019a6c6565d7de183a08e77df47f, fdad52e85048040319faaa2cd1546346957f86343c4b89d30153edb7a8fd0b90, fdf036edcd2fc6997a6eeaac4b58e4b533cd6abdf15d18a53621832bff038be0 | excludes:process.thread.Ext.call_stack_final_user_module.hash.sha256 |
process.thread.Ext.call_stack_final_user_module.protection_provenance | in | _isres.dll, bass.dll, cyinjct.dll, dbexpida.dll, isrt.dll, issetup.dll | excludes:process.thread.Ext.call_stack_final_user_module.protection_provenance |
process.thread.Ext.call_stack_final_user_module.protection_provenance_path | wildcard | c:\windows\installer\msi*.tmp, c:\windows\assembly\*, c:\windows\systemtemp\msi*.tmp, c:\program files\*, c:\program files (x86)\*, c:\windows\microsoft.net\*.dll | excludes:process.thread.Ext.call_stack_final_user_module.protection_provenance_path |
process.thread.Ext.call_stack_final_user_module.protection_provenance_path | wildcard | c:\windows\microsoft.net\framework*\clr.dll, c:\program files (x86)\adobe\acrobat*\acrobat\acrobat.dll | excludes:process.thread.Ext.call_stack_final_user_module.protection_provenance_path field:"process.thread.Ext.call_stack_final_user_module.protection_provenance_path" value:"c:\windows\microsoft.net\framework*\clr.dll" field:"process.thread.Ext.call_stack_final_user_module.protection_provenance_path" value:"c:\program files (x86)\adobe\acrobat*\acrobat\acrobat.dll" |
Indicators
These rows show field, operator, and value matches.