WPS Office Exploit via DLL Hijack

[rule]
description = """
Identifies the load of a remote library by the WPS Office promecefpluginhost.exe executable. This may indicate the
successful exploitation of CVE-2024-7262 or CVE-2024-7263 via DLL hijack.
"""
id = "ad9f49b7-08f3-4929-b9b1-3ff2c1a3afa3"
license = "Elastic License v2"
name = "WPS Office Exploit via DLL Hijack"
os_list = ["windows"]
reference = [
    "https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/",
    "https://mp.weixin.qq.com/s/F8hNyESBdKhwXkQPgtGpew",
]
version = "1.0.3"

query = '''
library where process.name : "promecefpluginhost.exe" and
  dll.path : "?:\\Users\\*\\AppData\\Local\\Temp\\wps\\INetCache\\*"
'''

min_endpoint_version = "8.0.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1189"
name = "Drive-by Compromise"
reference = "https://attack.mitre.org/techniques/T1189/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.0.0"