Suspicious API from an Unsigned Service DLL

[rule]
description = """
Identifies the execution of a new service via unsigned ServiceDLL subsequently followed by suspicious Windows API calls.
Adversaries may use this technique to maintain persistence or run with System privileges.
"""
id = "1a16b12e-6719-4f58-8835-84880092f3a0"
license = "Elastic License v2"
name = "Suspicious API from an Unsigned Service DLL"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.12"

query = '''
sequence by process.entity_id with maxspan=2m
[library where

  (dll.Ext.relative_file_creation_time <= 900 or dll.Ext.relative_file_name_modify_time <= 900) and

  (dll.code_signature.trusted == false or dll.code_signature.exists == false or dll.path : "\\Device\\Mup*") and

  process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\SysWOW64\\svchost.exe") and

  not dll.hash.sha256 in ("c8bf101bab6d5400f892ee92f2e788a7096192a417707c4fa91f54ee2c29d394", "d615af8e012426c8847c750a0838159d6c41385d2e50388cea28a97999b81614")] as event0
[api where

 process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\SysWOW64\\svchost.exe") and
  (
    process.Ext.api.name : ("WriteProcessMemory", "VirtualProtectEx") or
   (process.Ext.api.name : ("VirtualAlloc*", "MapViewOfFile*") and
    process.Ext.api.parameters.protection : "*X*" and process.Ext.api.parameters.size >= 4000)
   ) and

 /* API stack is originating from a service DLL */
 _arraysearch(process.thread.Ext.call_stack, $entry, stringcontains~($entry.symbol_info, concat(event0.dll.name, "!ServiceMain")))]
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.003"
name = "Windows Service"
reference = "https://attack.mitre.org/techniques/T1543/003/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.8.0"