Windows API via a CallBack Function

[rule]
description = """
Identifies the call of Memory Windows APIs indirectly via a callback function. This may be the result of an evasion
attempt to hide the origin of the API call from the call stack such as unbacked memory region.
"""
id = "8a8daa15-eed0-4bf0-85b5-ada73b55ab05"
license = "Elastic License v2"
name = "Windows API via a CallBack Function"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.24"

query = '''
api where process.executable != null and
 (
  (process.Ext.api.behaviors == "proxy_call" and
   process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory", "VirtualProtectEx", "VirtualAllocEx",
                            "MapViewOfFile", "MapViewOfFile2", "SuspendThread", "ReadProcessMemory") and
   process.thread.Ext.call_stack_summary in ("ntdll.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll", "ntdll.dll|kernel32.dll|ntdll.dll") and
   process.thread.Ext.call_stack_final_user_module.name in ("ntdll.dll", "Undetermined") and
   _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : ("*TpReleaseCleanupGroupMembers*", "*ntdll.dll!RtlDeregisterWaitEx*"))) or

  (process.Ext.api.name == "SetThreadContext" and process.thread.Ext.call_stack_summary in ("ntdll.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll", "ntdll.dll|kernel32.dll|ntdll.dll") and
   process.thread.Ext.call_stack_final_user_module.name in ("ntdll.dll", "Undetermined")) or

  (process.Ext.api.behaviors == "proxy_call" and
   process.Ext.api.name in ("VirtualProtect", "VirtualAlloc", "WriteProcessMemory", "VirtualProtectEx", "VirtualAllocEx", "SuspendThread") and
   process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll" and
   process.thread.Ext.call_stack_final_user_module.name == "Undetermined") and
   not _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.symbol_info : ("c:\\windows\\system32\\ntdll.dll!KiUserApcDispatcher*",
                                          "c:\\windows\\system32\\ntdll.dll!LdrShutdownThread*",
                                          "c:\\windows\\system32\\kernelbase.dll!GetFinalPathNameByHandleW*",
                                          "c:\\windows\\system32\\kernelbase.dll!LoadLibrary*"))
 ) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info : ("*\\jhooksatellite.dll!*",
                                        "*ntdll.dll!qsort*",
                                        "*kernelbase.dll!AppXLookupMoniker*",
                                        "*ntdll.dll!RtlCaptureStackContext*",
                                        "*ntdll.dll!LdrSystemDllInitBlock*",
                                        "*kernelbase.dll!CheckIsMSIXPackage*",
                                        "*rpcrt4.dll!NdrSendReceive*",
                                        "*ntdll.dll!RtlSetThreadWorkOnBehalfTicket*",
                                        "*ntdll.dll!RtlPcToFileHeader*",
                                        "?:\\program files*\\remote desktop\\rdclientax.dll!DllDeleteSavedCreds*",
                                        "c:\\windows\\system32\\ntdll.dll!NtUpdateWnfStateData+*",
                                        "*ntdll.dll!*RtlUnlockHeap*", "*ntdll.dll+0x*", "*kernelbase.dll!AppXUpdatePackageCapabilities*"))
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"