Unusual Process Running as Antimalware Protected

[rule]
description = """
Identifies when commonly abused signed binaries are running as Antimalware Light protection level. This may indicate an
attempt to bypass PPL protection and inject malicious code into a protected process or disable security software.
"""
id = "952e978e-5326-42d4-95df-9fceae0bca70"
license = "Elastic License v2"
name = "Unusual Process Running as Antimalware Protected"
os_list = ["windows"]
reference = [
    "https://github.com/mattifestation/AntimalwareBlight",
    "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit",
]
version = "1.0.25"

query = '''
process where event.action == "start" and

(process.Ext.protection == "PsProtectedSignerAntimalware-Light" and
   process.pe.original_file_name :
     ("AddInProcess.exe",
      "AddInProcess32.exe",
      "AddInUtil.exe",
      "AppLaunch.exe",
      "aspnet_compiler.exe",
      "aspnet_regbrowsers.exe",
      "aspnet_regiis.exe",
      "aspnet_regsql.exe",
      "aspnet_state.exe",
      "aspnet_wp.exe",
      "CasPol.exe",
      "ComSvcConfig.exe",
      "csc.exe",
      "cvtres.exe",
      "DataSvcUtil.exe",
      "EdmGen.exe",
      "ilasm.exe",
      "InstallUtil.exe",
      "jsc.exe",
      "Microsoft.Workflow.Compiler.exe",
      "MSBuild.exe",
      "mscorsvw.exe",
      "ngen.exe",
      "ngentask.exe",
      "RegAsm.exe",
      "RegSvcs.exe",
      "ServiceModelReg.exe",
      "vbc.exe",
      "WsatConfig.exe",
      "dllhost.exe",
      "regsvr32.exe",
      "GPUpdate.exe",
      "SearchProtocolHost.exe",
      "msiexec.exe",
      "powershell.exe",
      "cmd.exe",
      "rundll32.exe",
      "regsvr32.exe",
      "mshta.exe")) or

descendant of
 [process where event.action == "start" and
  process.Ext.protection == "PsProtectedSignerAntimalware-Light" and
  process.pe.original_file_name :
     ("AddInProcess.exe",
      "AddInProcess32.exe",
      "AddInUtil.exe",
      "AppLaunch.exe",
      "aspnet_compiler.exe",
      "aspnet_regbrowsers.exe",
      "aspnet_regiis.exe",
      "aspnet_regsql.exe",
      "aspnet_state.exe",
      "aspnet_wp.exe",
      "CasPol.exe",
      "ComSvcConfig.exe",
      "csc.exe",
      "cvtres.exe",
      "DataSvcUtil.exe",
      "EdmGen.exe",
      "ilasm.exe",
      "InstallUtil.exe",
      "jsc.exe",
      "Microsoft.Workflow.Compiler.exe",
      "MSBuild.exe",
      "mscorsvw.exe",
      "ngen.exe",
      "ngentask.exe",
      "RegAsm.exe",
      "RegSvcs.exe",
      "ServiceModelReg.exe",
      "vbc.exe",
      "WsatConfig.exe",
      "dllhost.exe",
      "regsvr32.exe",
      "GPUpdate.exe",
      "SearchProtocolHost.exe",
      "msiexec.exe",
      "powershell.exe",
      "pwsh.exe",
      "cmd.exe",
      "rundll32.exe",
      "regsvr32.exe",
      "mshta.exe")]
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"

[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.16.0"