Suspicious Desktop Window Manager API Call

[rule]
description = """
Identifies suspicious memory API calls by the Window Desktop Manager process. This may indicate a successful
vulnerability exploitation for privilege escalation.
"""
id = "1ddca85b-866b-4bee-96cd-ac5466f36e0a"
license = "Elastic License v2"
name = "Suspicious Desktop Window Manager API Call"
os_list = ["windows"]
reference = [
    "https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2023/CVE-2023-36033.html",
    "https://www.elastic.co/security-labs/itw-windows-lpe-0days-insights-and-detection-strategies",
    "https://nvd.nist.gov/vuln/detail/cve-2024-30051",
]
version = "1.0.1"

query = '''
api where process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "ResumeThread", "WinExec", "SetThreadContext") and
 process.executable : "?:\\Windows\\system32\\dwm.exe" and
 (
  process.thread.Ext.call_stack_summary like "*|combase.dll|user32.dll|dwmcore.dll|*" or
  process.thread.Ext.call_stack_final_user_module.name == "combase.dll" or
  (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and process.thread.Ext.call_stack_final_user_module.protection_provenance == "combase.dll")
  ) and
  not (process.Ext.api.name == "VirtualProtect" and
       _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*", "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*")))
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.10.0"