VirtualAlloc API Call from an Unsigned DLL

[rule]
description = """
Identifies the load of an unsigned or untrusted DLL by a trusted binary followed by calling VirtualAlloc API to allocate
executable memory. This may indicate execution via DLL sideloading to perform code injection.
"""
id = "96ffa829-b9fc-4456-be96-2b59b8facaed"
license = "Elastic License v2"
name = "VirtualAlloc API Call from an Unsigned DLL"
os_list = ["windows"]
version = "1.0.15"

query = '''
sequence by process.entity_id
[library where process.name != null and
   (dll.Ext.relative_file_creation_time <= 900 or
    dll.Ext.relative_file_name_modify_time <= 900 or
    (dll.Ext.device.product_id like ("Virtual DVD-ROM", "Virtual Disk","USB *") and not dll.path : "C:\\*") or
    dll.path : ("\\Device\\Mup\\*", "?:\\Users\\Public\\*", "?:\\Windows\\Tasks\\*", "?:\\ProgramData\\*")) and
    not dll.code_signature.status like ("trusted", "errorCode_endpoint*") and dll.hash.sha256 != null and
    not dll.path : ("?:\\Windows\\Installer\\*",
                    "?:\\Windows\\System32\\DriverStore\\FileRepository\\*",
                    "?:\\Windows\\SysWOW64\\DriverStore\\FileRepository\\*",
                    "?:\\Windows\\assembly\\*",
                    "?:\\Program Files\\*",
                    "?:\\Program Files (x86)\\*") and
  not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
  not (process.code_signature.trusted == true and
       process.code_signature.subject_name in
                         ("PFU LIMITED", "Sky UK Limited", "Genetec inc", "Sky International AG",
                          "EFI Software (Electronics for Imaging, Inc.)", "Amazon.com Services LLC",
                          "VICON INDUSTRIES, INC.", "Altium LLC")) and

  not (dll.name : "ISSetup.dll" and dll.pe.original_file_name : "iKernel.dll") and
  not dll.hash.sha256 :
               ("624bf5fbf96b6399fe0a624c8da7122cc207dba4273d6373fac7796d2dc1bed9",
                "dfa6e54b8c5659abcf7f1ac605379afcde27f713ca6a071e9da1367c5f5098ea",
                "4b3d1f4ec733afa5c593be64f251560515b91cb328e5c741ff877455aff0d453",
                "b950c9f7fb8e9b558d9caf634d7463fb4bf0aaf69a501d8f922763f8837b0ad2",
                "6eed2886728608f1b3f4a54a7a7d338ef1b1669f6f53a5d38bcd352f0ec755c9",
                "139a3fba0e2035830021d50bd24b73dc6d5b8b0520ee6d946ebef1ec2f602ff0",
                "127ebabd8e20267bdd26165cd26398bd9225d89b2977ff8de2b5f9da8a231e67",
                "4a23537d3523441a06b705bca6a7bd601c450b17a0586d669b07fd86c1dc0962",
                "3ed846264d5003acbd0dd624cbe4ca84606fe897fd8caa29350621906a3e28c0",
                "b211c61e1fa89cbaf4570ee5f9712772582b2f4bb23597549ec32ea066a20b76",
                "deaf71807722382d05244160ee35b1a14c0e621d7caf74c863475669e5c95b35",
                "7bafd0da58d427bbe8a2d34c953a53809bcbb3ff6c6f90b8acbe6c2b3ab8fa08",
                "8747dc251af9c3192bad2001786c626ad03903c3afaadb8c6a8c2627c66730bd",
                "5c45a7439d127c09b74fa16a0b300fb290ba15d316397579985464be484b8e17",
                "e51e7a2667b8b78ab32a7fe458d0fa498764721367ca4cc5d6fa7c05976f4bf0",
                "7c173cdaea8e3a3cc95b7196681cb904f3996f81289d5890b30f38c99eba45ae",
                "3dfa92d9a0ecefbb95a6b73dc15e8ae424725b2ddafe33a3e0b8d97b49a36be0",
                "0ec17d0e628cd5c9475c88164c642c6fe62322ca62facb0c3937029a39099d31",
                "ad9b9dd4f424e50bbdf126ed94fdaa75b122889766420c56ebbca1b7622af746",
                "db3477572af5b5f353e723db1e7e8de9b743a120a145c3c26851e969ac34044d",
                "864cf2c41bb85ec2e5b461ce4e04df53381a35a7f7c61a16078bee2a82bcedc4",
                "0e1c7395639deafecf99e79d394ff29f7399ccb4cde50b1e5e19861d2ea3aa70",
                "5ada6b6a5802d17c6cc599907542b231f15d9b39f79dc6693b32cee308a12e5c",
                "17ddddc4b4d3a6e902b3e84dcd4d3eb4f349efc3c207bb99cd65d71549802b63",
                "0e1c7395639deafecf99e79d394ff29f7399ccb4cde50b1e5e19861d2ea3aa70",
                "b4e472f5655222f431944c8cd6b3f5dd8e3932c99259639b35bf3b09e673a4f9",
                "8480cbc7f6f3c6be4d9e03fa14f58f1efd0dca08f660296725f212594d10a700",
                "f3b161fc18a12b0cfd8f41964b3b17577c121359ca656329a14378149f3e42de",
                "98cd02d52cd1d255cf68eaee946eff807d9d9f1ddcd01f9317f28d22f76db871",
                "f9037911ad2cb5570a61af5ec1549c33fb131eccc3d6da93de556ae7952adf9f",
                "3885dbec9db4d8a3a1f6ad12ff0055e64de63d351424b954369e7828950f7fa7",
                "2ff67993f53becab7fa167138e6f2749378afe87beb81949913c9731fc14d95e",
                "e5bb896d9e05d81b143bc517dc2d8b5f3900a6e336edac7ff79b5ac34ba6c9e0",
                "e3048d233fa257f242ccb05279898cf5490d1708cca91113bbb365b39364dcfa",
                "0c9df43d26b8e672b602aa061fec13fad1a01d2b8116042f3854712471097e0e",
                "e61c231e1c3d895f1adbce70075a79ac79a556132ac35c73849d0c19815897b2")
 ] as event0
[api where
  process.Ext.api.name in ("VirtualAlloc", "VirtualAllocEx","MapViewOfFile", "MapViewOfFile2") and
  process.Ext.api.parameters.protection like "RWX*" and
  process.Ext.api.parameters.size > 4524 and
  _arraysearch(process.thread.Ext.call_stack, $entry, stringcontains~($entry.protection_provenance, event0.dll.name)) and
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection_provenance : ("issetup.dll", "is_*.tmp", "bdhkm32.dll", "msi*.tmp")) and
  not process.thread.Ext.call_stack_summary: ("ntdll.dll|kernelbase.dll|*|ntdll.dll|kernelbase.dll|jvm.dll|java.dll|*", "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|*|ntdll.dll|kernelbase.dll|jvm.dll|java.dll*") and
  not (process.name : ("msiexec.exe", "setup.exe") and
      _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "8985271f001056e8f60300008d8dbd1d001085c00f859400000056e84003000056e85502000056e85301000090909090909090908b4e3485c90f848900000003"))
 ]
 until [process where event.action:"end"]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"