Potential Browser Exploit via Fake RPC Messages

[rule]
description = """
Identifies attempt to call memory manipulation APIs or load a library where call stack is pointing to the RPC function
NdrServerCall, this may indicate an attempt to exploit a vulnerability using fake RPC messages to bypass CFG mitigation.
A known example of vulnerability using this primitive is CVE-2021-26411.
"""
id = "e0114670-7598-4f1a-90ce-157ade6932b9"
license = "Elastic License v2"
name = "Potential Browser Exploit via Fake RPC Messages"
os_list = ["windows"]
reference = [
    "https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html",
    "https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-26411.html",
]
version = "1.0.15"

query = '''
any where event.category in ("api", "library") and
 process.name in~ ("chrome.exe", "msedge.exe", "iexplore.exe", "brave.exe", "whale.exe", "browser.exe", "dragon.exe", "vivaldi.exe",
                 "opera.exe", "seamonkey.exe", "safari.exe", "waterfox.exe") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*NdrServerCall2*") and 
 not process.Ext.api.summary :  ("VirtualProtect( koaxoj_?.dll,*)", "WriteProcessMemory( onedrive*") and 
 not dll.code_signature.trusted == true and 
 not dll.path : ("?:\\Windows\\System32\\jscript9.dll",
                 "?:\\Windows\\System32\\vaultcli.dll",
                 "?:\\Windows\\SysWOW64\\jscript9.dll",
                 "?:\\Windows\\SysWOW64\\vaultcli.dll",
                 "?:\\Windows\\System32\\wbem\\fastprox.dll") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("?:\\windows\\system32\\rpcrt4.dll!RpcBindingFromStringBindingW*", "c:\\windows\\system32\\rpcrt4.dll!I_RpcExceptionFilter+*"))
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1189"
name = "Drive-by Compromise"
reference = "https://attack.mitre.org/techniques/T1189/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.8.0"