WriteProcessMemory to Suspicious Memory Location

[rule]
description = """
Identifies attempt to write a suspicious memory location. This behavior is consistent with remote code injection
attacks.
"""
id = "1a1c26bb-7fe5-4683-9b94-bc1d89782873"
license = "Elastic License v2"
name = "WriteProcessMemory to Suspicious Memory Location"
os_list = ["windows"]
version = "1.0.9"

query = '''
api where process.Ext.api.name == "WriteProcessMemory" and process.Ext.api.behaviors == "cross-process" and
 process.Ext.api.metadata.target_address_name == "ProcessStartupInfo" and process.Ext.api.parameters.size >= 100000 and
 process.thread.Ext.call_stack_final_user_module.name like "?*" and
 not process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Kernel", "Undetermined") and
  /* WPM triggers multiple times at process creation */
 not (_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("*\\kernelbase.dll!CreateProcess*", "*\\kernelbase.dll+0x*"))
      and process.Ext.api.summary like ("*PEB*", "*PEB32*",  "*ProcessStartupInfo*")) and
 not (process.Ext.api.summary like ("*PEB*", "*PEB32*",  "*ProcessStartupInfo*") and process.thread.Ext.call_stack_summary like "*Unknown*") and
 not process.thread.Ext.call_stack_final_user_module.path like
                              ("?:\\program files\\*.dll",
                               "?:\\program files (x86)\\*.dll",
                               "\\program files\\*.dll",
                               "\\program files (x86)\\*.dll",
                               "?:\\windows\\system32\\*.dll",
                               "?:\\windows\\syswow64\\*.dll",
                               "\\windows\\system32\\*.dll",
                               "\\windows\\syswow64\\*.dll",
                               "?:\\windows\\fireeye\\appmonitordll*.dll*",
                               "?:\\windows\\apppatch\\appPatch*\\exploitblocker.dll*") and
 not (process.name : "rundll32.exe" and process.parent.executable : "?:\\Program Files (x86)\\Astria Solutions Group\\Eclipse Client Service\\Astria.Client.Systray.exe") and
 not (process.code_signature.subject_name in ("GIE Sesam Vitale", "Epicor Software Corporation") and process.code_signature.trusted == true) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.callsite_trailing_bytes in
                       ("85c0750732c0e9de0100008b45f88b80b43e00008945f08b45f88b80b43e00008b4df003413c8945f46a0468002000008b45f4ff70508b45f4ff70348b45f8ff",
                        "41c644240c01833d15c8005f007406ff1561e5ff5e8bf0e8b2df825e85f60f95c00fb6c00fb6c041c644240c01488b55884989542410488d65c85b5e5f415c41")) and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                    ("2fec0c389dd0932c59eee19ca24c720b6521603e5ead78e3e070aa561b73be32",
                                     "f41ca285f5069e68a6ba9128338fec93412efadcc5225a5c3261e0e07c3723fd",
                                     "7c82d4fce5e9e41e5654362bcb6d0486ec39f0ff1f6df0e899d14b7c055009d6",
                                     "ec363d03afa97033dc91cbf7c9a491fc693189f7a0a19bffc631bcb7dc715b47") and
 not (process.thread.Ext.call_stack_final_user_module.protection_provenance  in ("clr.dll", "mscorwks.dll", "coreclr.dll") and
      _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and $entry.subject_name in ("Microsoft Corporation", "Microsoft Corporation", ".NET"))) and
 not (process.name : "rundll32.exe" and process.command_line : "*--enable-speech-input*" and
      process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\microsoft.net\\framework*\\clr.dll") and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
                                          "Microsoft Windows Software Compatibility Publisher",
                                          "SentinelOne Inc.",
                                          "Admin By Request ApS",
                                          "Sophos Limited",
                                          "Promon AS"))
'''

min_endpoint_version = "8.14.2"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"