Windows System Module Remote Hooking

[rule]
description = """
Identifies attempts to write to a remote process memory to modify NTDLL or Kernelbase modules. This may indicate an
attempt to evade endpoint security solutions or perform code injection.
"""
id = "4c10ee1d-8373-4450-bf5c-81ce138739a1"
license = "Elastic License v2"
name = "Windows System Module Remote Hooking"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.12"

query = '''
api where process.Ext.api.name == "WriteProcessMemory" and process.executable != null and
  process.thread.Ext.call_stack_final_user_module.name != null and 
  process.Ext.api.behaviors == "cross-process" and process.Ext.api.summary like ("*ntdll.dll*", "*kernelbase.dll*") and
   process.thread.Ext.call_stack_summary like
             ("Unbacked", "*kernelbase.dll|Unbacked*", "ntdll.dll|Unknown", "*kernel32.dll|Unbacked*", "*ntdll.dll|Unbacked*") and 
   not stringcontains~(process.Ext.api.summary, process.name) and 
   (process.code_signature.trusted == false or process.code_signature.exists == false or process.name : "rundll32.exe") and 
   not (process.name : "rundll32.exe" and process.command_line : "\"?:\\WINDOWS\\System32\\RUNDLL32\" tsworkspace,WorkspaceStatusNotify2" and 
        process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and 
   not process.thread.Ext.call_stack_final_user_module.name == "kernel" and
   not process.parent.executable : ("C:\\Program Files (x86)\\Xoreax\\IncrediBuild\\BuildSystem.exe", "C:\\Program Files (x86)\\Incredibuild\\BuildSystem.exe") and
   not process.thread.Ext.call_stack_final_user_module.path like
                               ("?:\\program files\\*",
                                "?:\\program files (x86)\\*",
                                "?:\\windows\\system32\\*.dll",
                                "?:\\windows\\syswow64\\*.dll",
                                "\\program files\\*",
                                "\\program files (x86)\\*",
                                "\\windows\\system32\\*.dll",
                                "\\windows\\syswow64\\*.dll",
                                "?:\\windows\\apppatch\\appPatch64\\exploitblocker.dll",
                                "?:\\windows\\FireEye\\AppMonitorDll.dll") and
   not (process.thread.Ext.call_stack_final_user_module.protection_provenance  in ("clr.dll", "mscorwks.dll", "coreclr.dll", "teams.exe") and
      _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and $entry.subject_name in ("Microsoft Corporation", "Microsoft Corporation", ".NET"))) and
      not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
                                          "Microsoft Windows Software Compatibility Publisher"))
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"