Startup Persistence from Backed RWX Memory

[rule]
description = """
Identifies when a process is writing to commonly abused persistence locations (registry run keys and startup folder)
from a thread running from a memory section with read, write and execute permissions. This may indicate an attempt to
persist from a packed or injected program.
"""
id = "15c48f2d-e461-40a9-accd-090a0863ea10"
license = "Elastic License v2"
name = "Startup Persistence from Backed RWX Memory"
os_list = ["windows"]
version = "1.0.14"

query = '''
any where event.category in ("registry", "file") and process.executable != null and
 not event.action in ("deletion", "query") and process.thread.Ext.call_stack_summary like "?*" and
 not process.code_signature.status like ("trusted", "errorExpired", "errorCode_endpoint*") and
 not process.thread.Ext.call_stack_summary like ("*Unbacked*", "*clr.dll*", "*Unknown*", "*|kernelbase.dll|irsetup.exe*", 
                                              "*issetup.dll|isrt.dll*", "*adobepim.dll|set-up.dat*") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection : "RWX") and
   (
    (registry.data.strings != null and
     registry.path :
        ("H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*", 
	 "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*", 
         "H*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*", 
	 "H*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*")) or
    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")
   ) and
   not (process.executable : "?:\\Windows\\Sys*\\msiexec.exe" and
       _arraysearch(process.thread.Ext.call_stack, $entry,
	                $entry.protection : "RWX" and $entry.symbol_info : ("?:\\Windows\\Temp\\*", "?:\\Windows\\Installer\\*"))) and 
   not _arraysearch(process.thread.Ext.call_stack, $entry,
	                $entry.protection : "RWX" and
	                $entry.symbol_info : ("?:\\Windows\\Installer\\*",
	                                      "?:\\Users\\*\\AppData\\Local\\Temp\\*\\isrt.dll!_RegSetKeyValue+*",
	                                      "?:\\Users\\*\\AppData\\Local\\Temp\\{*}\\ISSetup.dll!InstallEngineTypelib*",
	                                      "?:\\Program Files (x86)\\Gizmo\\gdrive.dll!Remount_Startup_Images*")) and
   not registry.data.strings : ("?:\\windows\\Twain_32\\fjscan32\\FjtwMkup.exe /Station", "\"C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Webex\\Webex.lnk\" /minimized /autostartedWithWindows=true") and
   not (process.executable :  "?:\\Windows\\SysWOW64\\DWRCS.EXE" and registry.data.strings : "?:\\WINDOWS\\SysWOW64\\DWRCST.exe") and
   not process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe")
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.001"
name = "Registry Run Keys / Startup Folder"
reference = "https://attack.mitre.org/techniques/T1547/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.7.0"