Suspicious API Call from a PowerShell Script

[rule]
description = "Detects PowerShell scripts calling dual-purpose Win32 APIs."
id = "6ad0c702-ddf0-4631-ac43-37eeea444ee6"
license = "Elastic License v2"
name = "Suspicious API Call from a PowerShell Script"
os_list = ["windows"]
version = "1.0.24"

query = '''
api where
event.provider == "Microsoft-Windows-Threat-Intelligence" and process.Ext.api.parameters.size > 4096 and
process.Ext.api.name in ("VirtualProtect", "VirtualProtectEx", "WriteProcessMemory", "VirtualAlloc", "VirtualAllocEx", "MapViewOfFile", "MapViewOfFile2", "Wow64SetThreadContext", "SetThreadContext", "ReadProcessMemory", "connect") and
process.name in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and

process.Ext.api.metadata.target_address_path != "c:\\windows\\system32\\dante_dnssd.dll" and

/* PowerShell Script JIT - and incidental .NET assemblies */
process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
process.thread.Ext.call_stack_final_user_module.protection_provenance in ("clr.dll", "mscorwks.dll", "coreclr.dll") and

not (
  process.Ext.api.name == "VirtualProtect" and
    /* exclude nop operations */
    /* TBR */
    (process.Ext.api.parameters.protection in ("RWX", "RwX|CFG") and process.Ext.api.parameters.protection_old == "RWX") or
    (process.Ext.api.parameters.protection in ("R-X|CFG", "R-X") and process.Ext.api.parameters.protection_old in ("R-X", "RWX"))
) and

/* Citrix GPO Scripts */
not (process.parent.executable : "C:\\Windows\\System32\\gpscript.exe" and
     process.Ext.api.summary in ("VirtualProtect( Unbacked, 0x10, RWX, RW- )", "WriteProcessMemory( Self, Unbacked, 0x10 )", "WriteProcessMemory( Self, Data, 0x10 )")) and

/* cybersecurity and other tools */
not process.parent.executable :
                 ("C:\\Program Files (x86)\\CyberCNSAgent\\cybercnsagent.exe",
                  "C:\\Program Files\\Velociraptor\\Velociraptor.exe",
                  "C:\\Program Files (x86)\\baramundi\\BMA\\BDSRun.exe",
                  "C:\\Program Files\\Huntress\\HuntressAgent.exe",
                  "C:\\Program Files (x86)\\N-able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe",
                  "C:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe",
                  "C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
                  "C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseCM.exe",
                  "C:\\Program Files (x86)\\ITSPlatform\\plugin\\*.exe",
                  "C:\\Program Files (x86)\\ACMPClient\\ACMPClientService.exe",
                  "C:\\Program Files\\SGN Connect\\*\\sgncore.exe",
                  "C:\\Program Files (x86)\\Msp Agent\\components\\*\\generic-asset-interrogator.exe",
                  "C:\\Program Files (x86)\\CyberCNSAgentV2\\cybercnsagentv2.exe",
                  "C:\\Program Files\\RevBits EPS\\RevBitsEPS.exe",
                  "C:\\Program Files (x86)\\Quest\\KACE\\KInventory.exe",
                  "C:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\*\\x64\\BGHelper.exe",
                  "C:\\Program Files\\PDQ\\PDQConnectAgent\\pdq-connect-agent.exe",
                  "C:\\Program Files (x86)\\ossec-agent\\wazuh-agent.exe",
                  "C:\\Program Files\\SentinelOne\\Sentinel Agent *\\Addons\\SentinelAddonHost.exe",
                  "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
                  "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
                  "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer.*\\setup.exe",
                  "C:\\Windows\\CCM\\CcmExec.exe",
                  "C:\\Windows\\System32\\gpscript.exe") and

/* module listing */
not (process.Ext.api.name in ("EnumProcessModules", "GetModuleInformation", "K32GetModuleBaseNameW", "K32GetModuleFileNameExW") and
  process.parent.executable : ("*\\Lenovo\\*\\BGHelper.exe", "*\\Octopus\\*\\Calamari.exe")) and

/* WPM triggers multiple times at process creation */
not (process.Ext.api.name == "WriteProcessMemory" and
     process.Ext.api.metadata.target_address_name in ("PEB", "PEB32", "ProcessStartupInfo", "Data") and
     _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("*\\kernelbase.dll!CreateProcess*", "*\\kernel32.dll!CreateProcess*", "Unknown", "*\\kernelbase.dll+0x*", "*\\kernel32.dll+0x*"))) and

not (process.Ext.api.parameters.size == 16 and process.command_line : "*\\\\*\\Scripts\\GPO_Scripts\\*") and

not (process.parent.executable : "\\\\?\\Volume{*}\\Windows\\System32\\CExecSvc.exe" and
     process.command_line : "powershell -NoProfile -NoLogo -InputFormat text -OutputFormat text -NonInteractive -ExecutionPolicy Bypass -Command -") and
not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "41c6470c01*41c6470c01488b55*") and
not process.thread.Ext.call_stack_summary like
                           ("ntdll.dll|inprocessclient64.dll|kernelbase.dll|inprocessclient64.dll|Unbacked",
                            "ntdll.dll|bdhkm64.dll|atcuf64.dll|bdhkm64.dll|Unbacked|ntdll.dll|kernelbase.dll|bdhkm64.dll|Unbacked",
                            "ntdll.dll|bdhkm64.dll|Unbacked|ntdll.dll|kernelbase.dll|bdhkm64.dll|Unbacked",
                            "ntdll.dll|umppc*.dll|scriptcontrol64_*.dll|Unbacked",
                            "ntdll.dll|edrdotnet.unmanagedlib.???.dll|Unbacked",
                            "ntdll.dll|$$deletemekernelbase.dll*|inprocessclient64.dll|Unbacked",
                            "ntdll.dll|hmpalert.dll|advapi32.dll|Unknown",
                            "ntdll.dll|inprocessclient64.dll|kernelbase.dll|inprocessclient64.dll|Unknown",
                            "ntdll.dll|cyvrtrap.dll|edrdotnet.unmanagedlib.???.dll|Unbacked",
                            "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|protector32.dll|kernelbase.dll|protector32.dll|Unbacked",
                            "ntdll.dll|umppc*.dll|bdhkm64.dll|atcuf64.dll|bdhkm64.dll|Unbacked*",
                            "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|protector32.dll|kernelbase.dll|protector32.dll|Unbacked",
                            "ntdll.dll|minprocessclient.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|inprocessclient32.dll|kernelbase.dll|inprocessclient32.dll|Unbacked|clr.dll|*",
                            "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|psninjhookms32.dll|Unbacked|psninjhookms32.dll|Unbacked|psninjhookms32.dll|Unbacked|clr.dll|clrjit.dll|clr.dll|Unbacked*",
                            "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|dbgeng.dll|Unbacked|clr.dll|dbgeng.dll|mscorlib.ni.dll|clr.dll|powershell.exe|kernel32.dll|ntdll.dll",
                            "ntdll.dll|clr.dll|presentationcore.ni.dll|clr.dll|presentationcore.ni.dll|clr.dll|microsoft.powershell.gpowershell.ni.dll|clr.dll|mscorlib.ni.dll|Unbacked") and
not _arraysearch(process.thread.Ext.call_stack, $entry,
                 $entry.callsite_trailing_bytes like ("41c644240c01*85f60f95c00fb6c00fb6c041c644240c01488b55884989542410488d65c85b5e5f415c41*",
                                                      "c6430c01*488d65c85b5e5f415c415d415e415f5dc3*",
                                                      "418845084d8bc5488bcf8bd3e8*b8010000004883c4285b5d5e5f415c415d415e415fc3*",
                                                      "834648fab8010000004883c4685b5d5e5f415c415d415e415fc3*",
                                                      "488b95c0feffffc6420c01*",
                                                      "*41c6470c01488b459049894710488d65c85b5e5f415c415d415e415f5dc30000001910090010*",
                                                      "488bc8488bd7488b00488b4040ff5030b901000000ba7b030000*",
                                                      "488945d8488b4dd8488bd6488b45d8488b00488b4040ff5030*",
                                                      "8b65e459c6460801833d48*",
                                                      "8b0c2464890d0000000083c40c5f5e5b5d*", "34006500330035*",
                                                      "904883c428c30019040100044200*",
                                                      "*488d65e05b5e5f415e5dc35541565756534883ec30c5f877488b692048*",
                                                      "*f8488b5e30488d4f08488bd6*", "488bc8488bd7488b00488b4040ff5030b*",
                                                      "8bf0488b4c2428488bf9488bcf488bf985f67479*")) and
not (process.Ext.api.name in ("VirtualProtect", "VirtualAlloc", "MapViewOfFile", "MapViewOfFile2") and
     _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info like ("c:\\windows\\sy*\\ntdll.dll!Ldr*",
                                           "c:\\windows\\sy*\\kernelbase.dll!PackageSidFromProductId",
                                           "c:\\windows\\sys?????\\ntdll.dll!RtlAllocateHeap*",
                                           "c:\\windows\\sys?????\\dbgeng.dll!DebugCreateEx*",
                                           "c:\\windows\\system32\\ntdll.dll!LdrGetProcedureAddress*",
                                           "c:\\windows\\system32\\advapi32.dll!ReadEventLogW*"))) and
not (process.Ext.api.parameters.size <= 4096 and process.thread.Ext.call_stack_summary like ("ntdll.dll|umppc*.dll|scriptcontrol*.dll|Unbacked", "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|dbghelp.dll|Unbacked*")) and
not (process.parent.executable : "C:\\Windows\\System32\\gpscript.exe" and process.thread.Ext.call_stack_summary == "ntdll.dll|Unknown|yourphone.ypp.dll") and 
not process.thread.Ext.call_stack_summary like ("ntdll.dll|Unknown*", "ntdll.dll|kernelbase.dll|Unknown")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.10.0"