VirtualProtect via Vectored Exception Handling

[rule]
description = """
Identifies suspicious memory intrusion events originating from an exception handler. This may be the result of an
evasion attempt to evade memory scanners while performing malicious code injection.
"""
id = "20b374bd-2288-48f1-ad70-fa498e69e164"
license = "Elastic License v2"
name = "VirtualProtect via Vectored Exception Handling"
os_list = ["windows"]
reference = ["https://github.com/lem0nSec/ShellGhost"]
version = "1.0.5"

query = '''
api where process.Ext.api.behaviors : ("execute_fluctuation", "hollow_unbacked") and

 process.Ext.api.name == "VirtualProtect" and
 
 /* an exception call stack pattern to match before the full arraysearch  */
 process.thread.Ext.call_stack_summary: "ntdll.dll|*|ntdll.dll|*" and 

 /* provenance metadata exists */
 process.thread.Ext.call_stack_final_user_module.code_signature != null and

 /* abusing exception handlers for proxying memory manip */
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*ntdll.dll!KiUserExceptionDispatcher*") and

 /* final user module is unsigned or signed with an untrusted code signature */
 _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) and

 not process.thread.Ext.call_stack_final_user_module.hash.sha256 :
                                        ("fdb0c7af2ab2e821787222517531068ad01e333fe91e54d59bb80a8f49eb0bec",
                                         "e4a0aa2bb7e9003d1f436e1fcc783c4949f38e24d0d9b960ae9411609fe9c0a6",
                                         "03a8cfcb10a61492b540734147888867f43e501322e17202bca8bfb4065197a7",
                                         "db1bb8b11da98f97a9dcd58d4c204d82c0c059a45e54c13f59ef8a6cc84549fc",
                                         "417f8e95cffbb97dba4ebc9f0c8dd226bc915314738431caeec0dc879a704794",
                                         "ff9fbf4db360272b8350b5f1e3a827c7fbd12ce07b1728ad9407a61440f15d96",
                                         "d55b376190b15b61f4c74a3cad999b1e8f083201306d0258053a00c30d29990c",
                                         "6bb9e06812826df9539a9300e96c8b2c0281c7c3d566f5ce332d2dcfa6f1808f")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"