Potential Exploitation via ComDotNet Exploit

[rule]
description = """
Identifies the start of the WaaSMedicSvc service followed by loading the CLR module. This may indicate a successful
exploitation of Windows Protected Process Light (PPL) using COM-to-.NET redirection and reflection techniques for code
injection.
"""
id = "061bb372-9c37-4bc2-ae91-a34a00f85793"
license = "Elastic License v2"
name = "Potential Exploitation via ComDotNet Exploit"
os_list = ["windows"]
reference = [
    "https://mohamed-fakroud.gitbook.io/red-teamings-dojo/abusing-idispatch-for-trapped-com-object-access-and-injecting-into-ppl-processes",
    "https://github.com/T3nb3w/ComDotNetExploit",
]
version = "1.0.2"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and process.name == "svchost.exe" and process.args == "WaaSMedicSvc"]
 [library where process.name == "svchost.exe" and dll.name == "clr.dll"]
'''

min_endpoint_version = "8.14.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.0"