Windows Socket Creation from Unbacked Memory

[rule]
description = "Identifies the creation of a Windows network socket from unbacked memory, this may indicate process code injection."
id = "59a55372-5b1a-4a72-bd6e-9a55cf9298b4"
license = "Elastic License v2"
name = "Windows Socket Creation from Unbacked Memory"
os_list = ["windows"]
version = "1.0.3"

query = '''
api where process.Ext.api.name == "VirtualProtect" and
 process.Ext.api.metadata.target_address_name == "mswsock.dll" and
 process.thread.Ext.call_stack_summary in ("ntdll.dll|apphelp.dll|ntdll.dll|kernelbase.dll|ws2_32.dll|Unbacked",
                                           "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|apphelp.dll|ntdll.dll|kernelbase.dll|ws2_32.dll|Unbacked") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "Unbacked*" and $entry.callsite_trailing_bytes : "?*") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "c:\\windows\\sys?????\\ws2_32.dll!WSASocket*") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like ("c:\\windows\\microsoft.net\\framework64\\v*\\clr.dll", "c:\\program files\\dotnet\\shared\\microsoft.netcore.app\\*\\coreclr.dll")
'''

min_endpoint_version = "8.14.2"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"