Suspicious NtOSKrnl Image Load

[rule]
description = """
Identifies an unsigned process loading the ntoskrnl image. Some exploits map the Windows kernel file in memory to
calculate the offset for certain structures and objects needed for exploitation that may vary per target Operating
System.
"""
id = "13ec82e1-324f-4dcf-b58d-cac18faead77"
license = "Elastic License v2"
name = "Suspicious NtOSKrnl Image Load"
os_list = ["windows"]
version = "1.0.4"

query = '''
library where (dll.name : "ntoskrnl.exe" or dll.pe.original_file_name : "ntkrnlmp.exe") and 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 process.thread.Ext.call_stack_summary : "?*" and 
 not process.thread.Ext.call_stack_summary : "*libfacter.so|x64-msvcrt-ruby*" and 
 not process.executable : 
             ("?:\\Program Files\\Puppet Labs\\Puppet\\sys\\ruby\\bin\\ruby.exe", 
              "?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\ruby.exe", 
              "?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\facter.exe",
              "?:\\Windows\\SystemApps\\MicrosoftWindows.Client.*\\SearchHost.exe", 
              "?:\\Users\\*\\AppData\\Local\\Programs\\STAR\\resources\\BISPrint\\pr.exe")
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1068"
name = "Exploitation for Privilege Escalation"
reference = "https://attack.mitre.org/techniques/T1068/"


[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.7.0"