Detection rules › Elastic

Unbacked Shellcode from Unsigned Module

Source
github.com/elastic/protections-artifacts

Identifies attempt to allocate or execute Shellcode from a module with low or unknown reputation.

MITRE ATT&CK coverage

TacticTechniques
Stealth

Rule body

[rule]
description = "Identifies attempt to allocate or execute Shellcode from a module with low or unknown reputation."
id = "99d3049e-f4af-46a7-9406-33482955bec9"
license = "Elastic License v2"
name = "Unbacked Shellcode from Unsigned Module"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/pikabot-i-choose-you",
    "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
]
version = "1.0.14"

query = '''
api where
 process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
 process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
 process.thread.Ext.call_stack_final_user_module.protection_provenance_path != null and
 process.thread.Ext.call_stack_summary in
                    ("ntdll.dll|Unbacked",
                     "ntdll.dll|kernelbase.dll|Unbacked",
                     "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
                     "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
                     "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                     "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "Unbacked*" and $entry.callsite_trailing_bytes like "?*") and
 _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.status == "errorBadDigest" or $entry.exists == false) and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like
                                                ("c:\\windows\\microsoft.net\\framework*\\clr.dll",
                                                 "c:\\program files (x86)\\adobe\\acrobat*\\acrobat\\acrobat.dll") and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                 ("a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021",
                                  "c434208894f07f604b852f29b8edc3a58c4de63de783373733e72b2b73f33be9",
                                  "cb79e99da5b41d61302c941ed1dbe8c5d354dc789b10d9ec69892b27900b7279",
                                  "fdad52e85048040319faaa2cd1546346957f86343c4b89d30153edb7a8fd0b90",
                                  "69310b1df649a25d78941704536805393e6b17e011e763e0e80e023baaccccd6",
                                  "b5480453a6e4cac87a9ac05459dfe57f0a72e591afc19c0b5686a2de02c7c346",
                                  "5d20266760e95e56b12705e69e58d09625b9c5e2e94b2f706cebaa275598446a",
                                  "ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
                                  "4077289062777cf8e60bd81a2efe1350eeb60301679b3c236863cae7b4d8cc5a",
                                  "616217f667bd2dc9e27d066239f83b3f5554b0ff10edc002ee63e3fcf62cc5d8",
                                  "60ebc86c2dd03056ad48adc6d2468fd54c548a55d2d305577eb7e079d90ac13f",
                                  "3cd00f456f51829eda119e0e133acc1e45a5930d61fc335a2e9aa688a836a24d",
                                  "97d97c37d51be172951ed8a98f6fa0c2b7a2c9df14a44d0abf971d73e46e9373",
                                  "891113b49c9876f9e46d445ff0534e48573e0e518d53b7161a381664df32ba77",
                                  "a3b4a357f5b068add25ea0b2ed8e566ab2e6f4359df83b18f525b54490ec3f28",
                                  "2ffc321b0cb1f6b89fe09c597c94cd30e82f405cb982234d6383061b8ea6b12e",
                                  "93f53280052d0f700259b42a62f8658d9b2a741b54063f277e9b83264448fb21",
                                  "bd0e0a6f9e5e73cbd5637c6efada0efcc030ebb86a3a00df9dd03db1e7a533b7",
                                  "fc48fcbdb74be72b6222883f11b59ab9f2e6019a6c6565d7de183a08e77df47f",
                                  "430cb452335968804d57225c0e887bd2194ee1c55d160a6df2f62d0c326b47ee",
                                  "898e78d91da372f9f5039601581b3aadf9e62a06dd005a2851ce20275780e4b1",
                                  "0f7c82d426b124fb9a21cda05184e0860bc400dc354f9aaafb1c9af84b7363e2", 
                                  "67445d47d7e70e7b0f94b752f027e04a5453b5b14ea56c433660b27d016a734d", 
                                  "fdf036edcd2fc6997a6eeaac4b58e4b533cd6abdf15d18a53621832bff038be0", 
                                  "e3868e9daf4d9e34bf5b2f48bf5cab45e9b88e39cea578edb01cd96607eecf09", 
                                  "c5473c258cc2619ff88c16c9062f7feb29e66b3ecf205cf640b5abcaf316a487", 
                                  "27bb524de82dbab7461e09329afebb0361127494abb3782bbafdb9d9986df9c2", 
                                  "8f63c4fee17990a9988a6fc0a32635095226588e79cfcbbcbcb89afc021b7f71", 
                                  "38d155e2cac8c63774e1706307b29b1058c2479871c9331157370d67c53f0cbb", 
                                  "0738dc614d751b3b08125c03a920fc243a3e5eea4f16d3374d8d94a6e2454477", 
                                  "86699ebbcdbee712a4b798391b178a19ec18e0631bbc74875eda70af21b1da7e", 
                                  "3b283e5b05e232abab6e8144e3eb58ad456ad496d284e88f749cb8d6df2c0f62", 
                                  "a0d9f666f5e253031b5364c955c120b6b917749645b9e97bd8cc324597d450d4", 
                                  "4fd048ceaf8dff00bfb27851ea00d31d713ae72367e91bbf95607fac82fb8b38", 
                                  "de38e935cf249af5669d57ef9670ba4b9f324774fae9fd9cceb37b238305a155", 
                                  "11a970455d4536e4c4cdd655b864f5b01e7e8421b329196e0d878be2430cd20d", 
                                  "1b5d9cec668335295c8e575bcedf4afcedbc445d8ccf8374c9380188965e78e3", 
                                  "9becd39f90077a5ab064681c0a1be139d15be9ce434bacd48cd1dc894d3911cb", 
                                  "5438c19007ad96da0a969c0c0caaf00aa06375f1a6e85073f91a1392af94d059",
                                  "86ccc87140479b5631c2e9c66b54739db1761d82449eba225064d91e99dcab16",
                                  "462ddeb363a05574fc5e670a5f6e040ecdf6eaf3de6f5b495b1e11e105b1913b",
                                  "152f3801c03c08bdbad67bab16d14c0fb118bf335e1ba215b096cc75a299f84f",
                                  "aba42c861e070696ee85392586e5d6d7d7abcf8bba798ee6a571cc49c22201b6",
                                  "00fe581520c7a22a461b3ce78cd5e48bcf05e2bb1c60f4e9e2b4cd81d0e07760",
                                  "288bd8098f36110c8cc10c1508f1f23e0916bd36fad592f74518b7f3b06f3788",
                                  "de15024667157e9d84dda0785332c22d69a87199798373ec3c9c2d1f3df650f5",
                                  "59cc348f9711525abd54e88df810150e3a9a20910387427e208e4d74d5362027",
                                  "1d1cfd19249c06adefa0ff104d3f5db7f48568993c540576ef1930210793c975",
                                  "812b8169afda1309e677e8f1f1a7cca6a6bc7dd498d92167e157fc989fecc94b",
                                  "04ab613c895b35044af8a9a98a372a5769c80245cc9d6bf710a94c5bc42fa1b3",
                                  "2071a9a74867609405b218e98de8c3a7286c43b059932301516515ce887f7e35",
                                  "16073f3361e91126909aab4ba7c50443d7b8ef070f523b7af2901d6385e99438",
                                  "61ebd26043bfb155950d0d4b829f34e1ad6151b51bf9581e42acf621da1c1d86",
                                  "67766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3",
                                  "a088cda2df4f3cc371c5aaa5e40d5ce771b07e3e0b9c6fe51aa3af797dc7cddb",
                                  "fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85",
                                  "f079a18c0abc9569429d402357e2daa4fe2af4cdbe3c002a5f05a70d33e7bffb",
                                  "3a4ea2314b41a7720de2343602ef6268fa6bb660f3ee3633adc284e69ff1d83a",
                                  "64fe90e25526f5b819b170c9ddcc593a7e65950f8e37c7da45d265cced3f2e73",
                                  "a932fdd6f3a209a64eed1fa14d7b183850125b4840c9c227df390f5947dbda71",
                                  "5c2a95e195f77fe20eb57e0a117835ea378aa0da2f4b4cc7cd73fe2722d69c47",
                                  "16264a04dae64a04df2c049193d6d1811377b30aa02de69e186a791039eac36d",
                                  "b152de9afc373bba831dc9c1b137668462ae6d46ccd46815f2ffcc7f1bfc7056",
                                  "a87b3f02042de4d655f72af65ed5242fae5c675bebd19e962978c13e6d99ba00",
                                  "2ea11e8b009bed581a6502d64d4d1a67c6046806c6c79a5195fa2d337b0d96b0",
                                  "690c0be983bf27eb62428c93a534b66f3d11a8d6b30cb629425bd5a6f7232762",
                                  "7acaa0e07d37cdd814408145b1d0f2137eaf068ff716eee09f39c8e4625550fb",
                                  "18d1bae077da62bb5cf5bfa6a6c5c38ac9ade57f098ea2b357fab477e85f1c25",
                                  "9ac13f9bc5564fd8a1eab5f7c945dce1c27940dd63a913108eac64481ddde6af",
                                  "965162abde211f72c80062b1799eb4385d3e9322c4b38b8da9dc718a769570b7",
                                  "d355b62cc7dc5b8f3ee5e95a8ddddc818f6f84c5a16799d78b1cb3d786e2bb80",
                                  "765bf93c500ca73d73a5ba790f7c1675ff6ffdc7c54ee03dafca69ee701f5cfe",
                                  "eee4d4620d56c8c0212437b184444e1fe74e29d6d018d69750e52b27e9eba46b",
                                  "f939f09133e4a6a050e085adcdebadc92a45bd8696d75895ea520cfbd0167ebe",
                                  "9d0a822bf161b9b2daf06d515ec1bb202150e87f6d938510d2f4bfcf9d06e14f",
                                  "aa0e85beff0697474d0419349e9c1afb3bf711ffcd26a696dd2a1d192a90da36",
                                  "d2cd65a4e6eb99acaf2f168bd650e6b3c91144d08f01b0b772de13dce28c7ce9",
                                  /* Benign self-modifying commercial software (self-provenance, telemetry FP triage) */
                                  "996129f8229e532dcbb93fcd5a704b707e97796fd55ad6382306ee03f58c8f95",
                                  "6f2ee6f8f3240112ff6a861657228ba29144be11a281ad0517eab0f2a421eeb3",
                                  "4a632d7a938585502452bc3afd328a7d598934bd56dcb13042ecd76f10743510",
                                  "04f967d77dba69d8369218a2ae316c210749f0b1279ac563d8d281dea7b8c6e4") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance in ("isrt.dll", "issetup.dll", "dbexpida.dll", "cyinjct.dll", "_isres.dll", "bass.dll") and
 not (process.executable : "C:\\Windows\\SysWOW64\\msiexec.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance like ("msi*.tmp", "_isres.dll", "itcombo6.ocx")) and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like
                                                                 ("c:\\windows\\installer\\msi*.tmp",
                                                                  "c:\\windows\\assembly\\*",
                                                                  "c:\\windows\\systemtemp\\msi*.tmp",
                                                                  "c:\\program files\\*",
                                                                  "c:\\program files (x86)\\*",
                                                                  "c:\\windows\\microsoft.net\\*.dll") and
 not (process.parent.executable : "D:\\nvt\\NvtServ.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance_path : "d:\\nvc\\bin\\*") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and
                  $entry.callsite_trailing_bytes like ("5a8bf850528b338b432003c28b08894b208b431c03c28b08894b1c03f28b4b0c03ca8d431c505756ffd15a580343088bf8528bf08b46fc83c0042bf08956088b",
                   "89035e5bc39068008000006a008b0050a1dc6*", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
                   "8985271f*56e85301000090909090909090908b4e3485c90f848900000003")) and
 not (process.Ext.api.name == "VirtualProtect" and _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "*kernelbase.dll!LoadLibraryA*")) and
 not (process.Ext.api.name == "VirtualAlloc" and process.Ext.api.parameters.size < 30 and
      process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked") and
 not (process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked" and
       _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes like "8985*90909090909090908b4e3485c90f848900000003"))
'''

min_endpoint_version = "8.14.2"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"

Stages and Predicates

Stage 1: api

api where
 process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
 process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
 process.thread.Ext.call_stack_final_user_module.protection_provenance_path != null and
 process.thread.Ext.call_stack_summary in
                    ("ntdll.dll|Unbacked",
                     "ntdll.dll|kernelbase.dll|Unbacked",
                     "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
                     "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
                     "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                     "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "Unbacked*" and $entry.callsite_trailing_bytes like "?*") and
 _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.status == "errorBadDigest" or $entry.exists == false) and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like
                                                ("c:\\windows\\microsoft.net\\framework*\\clr.dll",
                                                 "c:\\program files (x86)\\adobe\\acrobat*\\acrobat\\acrobat.dll") and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                 ("a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021",
                                  "c434208894f07f604b852f29b8edc3a58c4de63de783373733e72b2b73f33be9",
                                  "cb79e99da5b41d61302c941ed1dbe8c5d354dc789b10d9ec69892b27900b7279",
                                  "fdad52e85048040319faaa2cd1546346957f86343c4b89d30153edb7a8fd0b90",
                                  "69310b1df649a25d78941704536805393e6b17e011e763e0e80e023baaccccd6",
                                  "b5480453a6e4cac87a9ac05459dfe57f0a72e591afc19c0b5686a2de02c7c346",
                                  "5d20266760e95e56b12705e69e58d09625b9c5e2e94b2f706cebaa275598446a",
                                  "ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
                                  "4077289062777cf8e60bd81a2efe1350eeb60301679b3c236863cae7b4d8cc5a",
                                  "616217f667bd2dc9e27d066239f83b3f5554b0ff10edc002ee63e3fcf62cc5d8",
                                  "60ebc86c2dd03056ad48adc6d2468fd54c548a55d2d305577eb7e079d90ac13f",
                                  "3cd00f456f51829eda119e0e133acc1e45a5930d61fc335a2e9aa688a836a24d",
                                  "97d97c37d51be172951ed8a98f6fa0c2b7a2c9df14a44d0abf971d73e46e9373",
                                  "891113b49c9876f9e46d445ff0534e48573e0e518d53b7161a381664df32ba77",
                                  "a3b4a357f5b068add25ea0b2ed8e566ab2e6f4359df83b18f525b54490ec3f28",
                                  "2ffc321b0cb1f6b89fe09c597c94cd30e82f405cb982234d6383061b8ea6b12e",
                                  "93f53280052d0f700259b42a62f8658d9b2a741b54063f277e9b83264448fb21",
                                  "bd0e0a6f9e5e73cbd5637c6efada0efcc030ebb86a3a00df9dd03db1e7a533b7",
                                  "fc48fcbdb74be72b6222883f11b59ab9f2e6019a6c6565d7de183a08e77df47f",
                                  "430cb452335968804d57225c0e887bd2194ee1c55d160a6df2f62d0c326b47ee",
                                  "898e78d91da372f9f5039601581b3aadf9e62a06dd005a2851ce20275780e4b1",
                                  "0f7c82d426b124fb9a21cda05184e0860bc400dc354f9aaafb1c9af84b7363e2",
                                  "67445d47d7e70e7b0f94b752f027e04a5453b5b14ea56c433660b27d016a734d",
                                  "fdf036edcd2fc6997a6eeaac4b58e4b533cd6abdf15d18a53621832bff038be0",
                                  "e3868e9daf4d9e34bf5b2f48bf5cab45e9b88e39cea578edb01cd96607eecf09",
                                  "c5473c258cc2619ff88c16c9062f7feb29e66b3ecf205cf640b5abcaf316a487",
                                  "27bb524de82dbab7461e09329afebb0361127494abb3782bbafdb9d9986df9c2",
                                  "8f63c4fee17990a9988a6fc0a32635095226588e79cfcbbcbcb89afc021b7f71",
                                  "38d155e2cac8c63774e1706307b29b1058c2479871c9331157370d67c53f0cbb",
                                  "0738dc614d751b3b08125c03a920fc243a3e5eea4f16d3374d8d94a6e2454477",
                                  "86699ebbcdbee712a4b798391b178a19ec18e0631bbc74875eda70af21b1da7e",
                                  "3b283e5b05e232abab6e8144e3eb58ad456ad496d284e88f749cb8d6df2c0f62",
                                  "a0d9f666f5e253031b5364c955c120b6b917749645b9e97bd8cc324597d450d4",
                                  "4fd048ceaf8dff00bfb27851ea00d31d713ae72367e91bbf95607fac82fb8b38",
                                  "de38e935cf249af5669d57ef9670ba4b9f324774fae9fd9cceb37b238305a155",
                                  "11a970455d4536e4c4cdd655b864f5b01e7e8421b329196e0d878be2430cd20d",
                                  "1b5d9cec668335295c8e575bcedf4afcedbc445d8ccf8374c9380188965e78e3",
                                  "9becd39f90077a5ab064681c0a1be139d15be9ce434bacd48cd1dc894d3911cb",
                                  "5438c19007ad96da0a969c0c0caaf00aa06375f1a6e85073f91a1392af94d059",
                                  "86ccc87140479b5631c2e9c66b54739db1761d82449eba225064d91e99dcab16",
                                  "462ddeb363a05574fc5e670a5f6e040ecdf6eaf3de6f5b495b1e11e105b1913b",
                                  "152f3801c03c08bdbad67bab16d14c0fb118bf335e1ba215b096cc75a299f84f",
                                  "aba42c861e070696ee85392586e5d6d7d7abcf8bba798ee6a571cc49c22201b6",
                                  "00fe581520c7a22a461b3ce78cd5e48bcf05e2bb1c60f4e9e2b4cd81d0e07760",
                                  "288bd8098f36110c8cc10c1508f1f23e0916bd36fad592f74518b7f3b06f3788",
                                  "de15024667157e9d84dda0785332c22d69a87199798373ec3c9c2d1f3df650f5",
                                  "59cc348f9711525abd54e88df810150e3a9a20910387427e208e4d74d5362027",
                                  "1d1cfd19249c06adefa0ff104d3f5db7f48568993c540576ef1930210793c975",
                                  "812b8169afda1309e677e8f1f1a7cca6a6bc7dd498d92167e157fc989fecc94b",
                                  "04ab613c895b35044af8a9a98a372a5769c80245cc9d6bf710a94c5bc42fa1b3",
                                  "2071a9a74867609405b218e98de8c3a7286c43b059932301516515ce887f7e35",
                                  "16073f3361e91126909aab4ba7c50443d7b8ef070f523b7af2901d6385e99438",
                                  "61ebd26043bfb155950d0d4b829f34e1ad6151b51bf9581e42acf621da1c1d86",
                                  "67766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3",
                                  "a088cda2df4f3cc371c5aaa5e40d5ce771b07e3e0b9c6fe51aa3af797dc7cddb",
                                  "fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85",
                                  "f079a18c0abc9569429d402357e2daa4fe2af4cdbe3c002a5f05a70d33e7bffb",
                                  "3a4ea2314b41a7720de2343602ef6268fa6bb660f3ee3633adc284e69ff1d83a",
                                  "64fe90e25526f5b819b170c9ddcc593a7e65950f8e37c7da45d265cced3f2e73",
                                  "a932fdd6f3a209a64eed1fa14d7b183850125b4840c9c227df390f5947dbda71",
                                  "5c2a95e195f77fe20eb57e0a117835ea378aa0da2f4b4cc7cd73fe2722d69c47",
                                  "16264a04dae64a04df2c049193d6d1811377b30aa02de69e186a791039eac36d",
                                  "b152de9afc373bba831dc9c1b137668462ae6d46ccd46815f2ffcc7f1bfc7056",
                                  "a87b3f02042de4d655f72af65ed5242fae5c675bebd19e962978c13e6d99ba00",
                                  "2ea11e8b009bed581a6502d64d4d1a67c6046806c6c79a5195fa2d337b0d96b0",
                                  "690c0be983bf27eb62428c93a534b66f3d11a8d6b30cb629425bd5a6f7232762",
                                  "7acaa0e07d37cdd814408145b1d0f2137eaf068ff716eee09f39c8e4625550fb",
                                  "18d1bae077da62bb5cf5bfa6a6c5c38ac9ade57f098ea2b357fab477e85f1c25",
                                  "9ac13f9bc5564fd8a1eab5f7c945dce1c27940dd63a913108eac64481ddde6af",
                                  "965162abde211f72c80062b1799eb4385d3e9322c4b38b8da9dc718a769570b7",
                                  "d355b62cc7dc5b8f3ee5e95a8ddddc818f6f84c5a16799d78b1cb3d786e2bb80",
                                  "765bf93c500ca73d73a5ba790f7c1675ff6ffdc7c54ee03dafca69ee701f5cfe",
                                  "eee4d4620d56c8c0212437b184444e1fe74e29d6d018d69750e52b27e9eba46b",
                                  "f939f09133e4a6a050e085adcdebadc92a45bd8696d75895ea520cfbd0167ebe",
                                  "9d0a822bf161b9b2daf06d515ec1bb202150e87f6d938510d2f4bfcf9d06e14f",
                                  "aa0e85beff0697474d0419349e9c1afb3bf711ffcd26a696dd2a1d192a90da36",
                                  "d2cd65a4e6eb99acaf2f168bd650e6b3c91144d08f01b0b772de13dce28c7ce9",
                                  "996129f8229e532dcbb93fcd5a704b707e97796fd55ad6382306ee03f58c8f95",
                                  "6f2ee6f8f3240112ff6a861657228ba29144be11a281ad0517eab0f2a421eeb3",
                                  "4a632d7a938585502452bc3afd328a7d598934bd56dcb13042ecd76f10743510",
                                  "04f967d77dba69d8369218a2ae316c210749f0b1279ac563d8d281dea7b8c6e4") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance in ("isrt.dll", "issetup.dll", "dbexpida.dll", "cyinjct.dll", "_isres.dll", "bass.dll") and
 not (process.executable : "C:\\Windows\\SysWOW64\\msiexec.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance like ("msi*.tmp", "_isres.dll", "itcombo6.ocx")) and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like
                                                                 ("c:\\windows\\installer\\msi*.tmp",
                                                                  "c:\\windows\\assembly\\*",
                                                                  "c:\\windows\\systemtemp\\msi*.tmp",
                                                                  "c:\\program files\\*",
                                                                  "c:\\program files (x86)\\*",
                                                                  "c:\\windows\\microsoft.net\\*.dll") and
 not (process.parent.executable : "D:\\nvt\\NvtServ.exe" and process.thread.Ext.call_stack_final_user_module.protection_provenance_path : "d:\\nvc\\bin\\*") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and
                  $entry.callsite_trailing_bytes like ("5a8bf850528b338b432003c28b08894b208b431c03c28b08894b1c03f28b4b0c03ca8d431c505756ffd15a580343088bf8528bf08b46fc83c0042bf08956088b",
                   "89035e5bc39068008000006a008b0050a1dc6*", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
                   "8985271f*56e85301000090909090909090908b4e3485c90f848900000003")) and
 not (process.Ext.api.name == "VirtualProtect" and _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "*kernelbase.dll!LoadLibraryA*")) and
 not (process.Ext.api.name == "VirtualAlloc" and process.Ext.api.parameters.size < 30 and
      process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked") and
 not (process.thread.Ext.call_stack_summary == "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked" and
       _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes like "8985*90909090909090908b4e3485c90f848900000003"))

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
process.thread.Ext.call_stackarray_any(no value, null check)excludes:process.thread.Ext.call_stack
process.thread.Ext.call_stack_summaryeqntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbackedexcludes:process.thread.Ext.call_stack_summary field:"process.thread.Ext.call_stack_summary" value:"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked"
process.Ext.api.nameeqVirtualProtectexcludes:process.Ext.api.name field:"process.Ext.api.name" value:"VirtualProtect"
process.Ext.api.nameeqVirtualAllocexcludes:process.Ext.api.name field:"process.Ext.api.name" value:"VirtualAlloc"
process.Ext.api.parameters.sizelt30excludes:process.Ext.api.parameters.size field:"process.Ext.api.parameters.size" value:"30"
process.executableeqC:\Windows\SysWOW64\msiexec.exeexcludes:process.executable field:"process.executable" value:"C:\Windows\SysWOW64\msiexec.exe"
process.thread.Ext.call_stack_final_user_module.protection_provenancewildcardmsi*.tmp, _isres.dll, itcombo6.ocxexcludes:process.thread.Ext.call_stack_final_user_module.protection_provenance field:"process.thread.Ext.call_stack_final_user_module.protection_provenance" value:"msi*.tmp" field:"process.thread.Ext.call_stack_final_user_module.protection_provenance" value:"_isres.dll" field:"process.thread.Ext.call_stack_final_user_module.protection_provenance" value:"itcombo6.ocx"
process.parent.executableeqD:\nvt\NvtServ.exeexcludes:process.parent.executable field:"process.parent.executable" value:"D:\nvt\NvtServ.exe"
process.thread.Ext.call_stack_final_user_module.protection_provenance_pathstarts_withd:\nvc\bin\excludes:process.thread.Ext.call_stack_final_user_module.protection_provenance_path field:"process.thread.Ext.call_stack_final_user_module.protection_provenance_path" value:"d:\nvc\bin\"
process.thread.Ext.call_stack_final_user_module.hash.sha256in00fe581520c7a22a461b3ce78cd5e48bcf05e2bb1c60f4e9e2b4cd81d0e07760, 04ab613c895b35044af8a9a98a372a5769c80245cc9d6bf710a94c5bc42fa1b3, 04f967d77dba69d8369218a2ae316c210749f0b1279ac563d8d281dea7b8c6e4, 0738dc614d751b3b08125c03a920fc243a3e5eea4f16d3374d8d94a6e2454477, 0f7c82d426b124fb9a21cda05184e0860bc400dc354f9aaafb1c9af84b7363e2, 11a970455d4536e4c4cdd655b864f5b01e7e8421b329196e0d878be2430cd20d, 152f3801c03c08bdbad67bab16d14c0fb118bf335e1ba215b096cc75a299f84f, 16073f3361e91126909aab4ba7c50443d7b8ef070f523b7af2901d6385e99438, 16264a04dae64a04df2c049193d6d1811377b30aa02de69e186a791039eac36d, 18d1bae077da62bb5cf5bfa6a6c5c38ac9ade57f098ea2b357fab477e85f1c25, 1b5d9cec668335295c8e575bcedf4afcedbc445d8ccf8374c9380188965e78e3, 1d1cfd19249c06adefa0ff104d3f5db7f48568993c540576ef1930210793c975, 2071a9a74867609405b218e98de8c3a7286c43b059932301516515ce887f7e35, 27bb524de82dbab7461e09329afebb0361127494abb3782bbafdb9d9986df9c2, 288bd8098f36110c8cc10c1508f1f23e0916bd36fad592f74518b7f3b06f3788, 2ea11e8b009bed581a6502d64d4d1a67c6046806c6c79a5195fa2d337b0d96b0, 2ffc321b0cb1f6b89fe09c597c94cd30e82f405cb982234d6383061b8ea6b12e, 38d155e2cac8c63774e1706307b29b1058c2479871c9331157370d67c53f0cbb, 3a4ea2314b41a7720de2343602ef6268fa6bb660f3ee3633adc284e69ff1d83a, 3b283e5b05e232abab6e8144e3eb58ad456ad496d284e88f749cb8d6df2c0f62, 3cd00f456f51829eda119e0e133acc1e45a5930d61fc335a2e9aa688a836a24d, 4077289062777cf8e60bd81a2efe1350eeb60301679b3c236863cae7b4d8cc5a, 430cb452335968804d57225c0e887bd2194ee1c55d160a6df2f62d0c326b47ee, 462ddeb363a05574fc5e670a5f6e040ecdf6eaf3de6f5b495b1e11e105b1913b, 4a632d7a938585502452bc3afd328a7d598934bd56dcb13042ecd76f10743510, 4fd048ceaf8dff00bfb27851ea00d31d713ae72367e91bbf95607fac82fb8b38, 5438c19007ad96da0a969c0c0caaf00aa06375f1a6e85073f91a1392af94d059, 59cc348f9711525abd54e88df810150e3a9a20910387427e208e4d74d5362027, 5c2a95e195f77fe20eb57e0a117835ea378aa0da2f4b4cc7cd73fe2722d69c47, 5d20266760e95e56b12705e69e58d09625b9c5e2e94b2f706cebaa275598446a, 60ebc86c2dd03056ad48adc6d2468fd54c548a55d2d305577eb7e079d90ac13f, 616217f667bd2dc9e27d066239f83b3f5554b0ff10edc002ee63e3fcf62cc5d8, 61ebd26043bfb155950d0d4b829f34e1ad6151b51bf9581e42acf621da1c1d86, 64fe90e25526f5b819b170c9ddcc593a7e65950f8e37c7da45d265cced3f2e73, 67445d47d7e70e7b0f94b752f027e04a5453b5b14ea56c433660b27d016a734d, 67766e574baa86eb8317623acc2957e8e28944bb801a8c10a0fa9d29fdb4cfd3, 690c0be983bf27eb62428c93a534b66f3d11a8d6b30cb629425bd5a6f7232762, 69310b1df649a25d78941704536805393e6b17e011e763e0e80e023baaccccd6, 6f2ee6f8f3240112ff6a861657228ba29144be11a281ad0517eab0f2a421eeb3, 765bf93c500ca73d73a5ba790f7c1675ff6ffdc7c54ee03dafca69ee701f5cfe, 7acaa0e07d37cdd814408145b1d0f2137eaf068ff716eee09f39c8e4625550fb, 812b8169afda1309e677e8f1f1a7cca6a6bc7dd498d92167e157fc989fecc94b, 86699ebbcdbee712a4b798391b178a19ec18e0631bbc74875eda70af21b1da7e, 86ccc87140479b5631c2e9c66b54739db1761d82449eba225064d91e99dcab16, 891113b49c9876f9e46d445ff0534e48573e0e518d53b7161a381664df32ba77, 898e78d91da372f9f5039601581b3aadf9e62a06dd005a2851ce20275780e4b1, 8f63c4fee17990a9988a6fc0a32635095226588e79cfcbbcbcb89afc021b7f71, 93f53280052d0f700259b42a62f8658d9b2a741b54063f277e9b83264448fb21, 965162abde211f72c80062b1799eb4385d3e9322c4b38b8da9dc718a769570b7, 97d97c37d51be172951ed8a98f6fa0c2b7a2c9df14a44d0abf971d73e46e9373, 996129f8229e532dcbb93fcd5a704b707e97796fd55ad6382306ee03f58c8f95, 9ac13f9bc5564fd8a1eab5f7c945dce1c27940dd63a913108eac64481ddde6af, 9becd39f90077a5ab064681c0a1be139d15be9ce434bacd48cd1dc894d3911cb, 9d0a822bf161b9b2daf06d515ec1bb202150e87f6d938510d2f4bfcf9d06e14f, a088cda2df4f3cc371c5aaa5e40d5ce771b07e3e0b9c6fe51aa3af797dc7cddb, a0d9f666f5e253031b5364c955c120b6b917749645b9e97bd8cc324597d450d4, a3b4a357f5b068add25ea0b2ed8e566ab2e6f4359df83b18f525b54490ec3f28, a87b3f02042de4d655f72af65ed5242fae5c675bebd19e962978c13e6d99ba00, a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021, a932fdd6f3a209a64eed1fa14d7b183850125b4840c9c227df390f5947dbda71, aa0e85beff0697474d0419349e9c1afb3bf711ffcd26a696dd2a1d192a90da36, aba42c861e070696ee85392586e5d6d7d7abcf8bba798ee6a571cc49c22201b6, b152de9afc373bba831dc9c1b137668462ae6d46ccd46815f2ffcc7f1bfc7056, b5480453a6e4cac87a9ac05459dfe57f0a72e591afc19c0b5686a2de02c7c346, bd0e0a6f9e5e73cbd5637c6efada0efcc030ebb86a3a00df9dd03db1e7a533b7, c434208894f07f604b852f29b8edc3a58c4de63de783373733e72b2b73f33be9, c5473c258cc2619ff88c16c9062f7feb29e66b3ecf205cf640b5abcaf316a487, cb79e99da5b41d61302c941ed1dbe8c5d354dc789b10d9ec69892b27900b7279, d2cd65a4e6eb99acaf2f168bd650e6b3c91144d08f01b0b772de13dce28c7ce9, d355b62cc7dc5b8f3ee5e95a8ddddc818f6f84c5a16799d78b1cb3d786e2bb80, de15024667157e9d84dda0785332c22d69a87199798373ec3c9c2d1f3df650f5, de38e935cf249af5669d57ef9670ba4b9f324774fae9fd9cceb37b238305a155, e3868e9daf4d9e34bf5b2f48bf5cab45e9b88e39cea578edb01cd96607eecf09, ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9, eee4d4620d56c8c0212437b184444e1fe74e29d6d018d69750e52b27e9eba46b, f079a18c0abc9569429d402357e2daa4fe2af4cdbe3c002a5f05a70d33e7bffb, f939f09133e4a6a050e085adcdebadc92a45bd8696d75895ea520cfbd0167ebe, fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85, fc48fcbdb74be72b6222883f11b59ab9f2e6019a6c6565d7de183a08e77df47f, fdad52e85048040319faaa2cd1546346957f86343c4b89d30153edb7a8fd0b90, fdf036edcd2fc6997a6eeaac4b58e4b533cd6abdf15d18a53621832bff038be0excludes:process.thread.Ext.call_stack_final_user_module.hash.sha256
process.thread.Ext.call_stack_final_user_module.protection_provenancein_isres.dll, bass.dll, cyinjct.dll, dbexpida.dll, isrt.dll, issetup.dllexcludes:process.thread.Ext.call_stack_final_user_module.protection_provenance
process.thread.Ext.call_stack_final_user_module.protection_provenance_pathwildcardc:\windows\installer\msi*.tmp, c:\windows\assembly\*, c:\windows\systemtemp\msi*.tmp, c:\program files\*, c:\program files (x86)\*, c:\windows\microsoft.net\*.dllexcludes:process.thread.Ext.call_stack_final_user_module.protection_provenance_path
process.thread.Ext.call_stack_final_user_module.protection_provenance_pathwildcardc:\windows\microsoft.net\framework*\clr.dll, c:\program files (x86)\adobe\acrobat*\acrobat\acrobat.dllexcludes:process.thread.Ext.call_stack_final_user_module.protection_provenance_path field:"process.thread.Ext.call_stack_final_user_module.protection_provenance_path" value:"c:\windows\microsoft.net\framework*\clr.dll" field:"process.thread.Ext.call_stack_final_user_module.protection_provenance_path" value:"c:\program files (x86)\adobe\acrobat*\acrobat\acrobat.dll"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
process.Ext.api.behaviorsin
  • allocate_shellcode corpus 9 (elastic 9)
  • execute_shellcode corpus 3 (elastic 3)
  • shellcode corpus 2 (elastic 2)
field:"process.Ext.api.behaviors" kind:in
process.thread.Ext.call_stack_final_user_module.hash.sha256is_not_null
  • (no value, null check)
field:"process.thread.Ext.call_stack_final_user_module.hash.sha256" kind:is_not_null
process.thread.Ext.call_stack_final_user_module.nameeq
  • Unbacked corpus 21 (elastic 21)
field:"process.thread.Ext.call_stack_final_user_module.name" kind:eq value:"Unbacked"
process.thread.Ext.call_stack_final_user_module.protection_provenance_pathis_not_null
  • (no value, null check)
field:"process.thread.Ext.call_stack_final_user_module.protection_provenance_path" kind:is_not_null
process.thread.Ext.call_stack_summaryin
  • ntdll.dll|Unbacked
  • ntdll.dll|kernelbase.dll|Unbacked corpus 3 (elastic 3)
  • ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked
  • ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked
  • ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked
  • ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll
field:"process.thread.Ext.call_stack_summary" kind:in