Untrusted DLL Loaded by a System Windows Process

[rule]
description = """
Identifies attempts to load an unsigned and untrusted module by a SYSTEM process. This may indicate an attempt to
elevate privileges via DLL search order hijacking.
"""
id = "39224ead-14f3-4df3-b6ed-ec69dc17db3a"
license = "Elastic License v2"
name = "Untrusted DLL Loaded by a System Windows Process"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/itw-windows-lpe-0days-insights-and-detection-strategies"]
version = "1.0.9"

query = '''
library where 
  process.code_signature.subject_name : "Microsoft *" and dll.hash.sha256 != null and 
  user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and not dll.code_signature.status : "trusted" and 
  dll.Ext.relative_file_creation_time <= 500 and 
  /* svchost covered by fce4b49f-59ff-464e-a69b-e3b38841b5fe */
  not process.name : ("rundll32.exe", "regsvr32.exe", "powershell.exe", "msiexec.exe", "svchost.exe", "w3wp.exe") and
  not dll.path : ("?:\\Windows\\system32\\*", 
                  "?:\\Windows\\syswow64\\*",
                  "?:\\Program Files (x86)\\*",
                  "?:\\Program Files\\*",
                  "?:\\Windows\\Installer\\*",
                  "?:\\Windows\\SystemTemp\\*",
                  "?:\\Windows\\SoftwareDistribution\\*",
                  "?:\\Windows\\WinSxS\\*",
                  "?:\\Windows\\assembly\\*") and
  process.executable :
               ("?:\\Windows\\system32\\*",
                "?:\\Windows\\syswow64\\*",
                "?:\\Program Files (x86)\\Microsoft\\*",
                "?:\\Program Files\\Microsoft\\*", 
                "?:\\Program Files\\Windows *", 
                "?:\\Program Files (x86)\\Windows *", 
                "?:\\Program Files\\Common Files\\Microsoft*",
                "?:\\Program Files (x86)\\Common Files\\Microsoft*") and
  not dll.hash.sha256 :
                ("bf14ce30695de66d8040cb893ba72fb205add0404091cc889e5b4d18b368303b",
                 "94c62f5a203c21b8f7e100d95454d06081fca0bfda3e9259cd300a2f3b8c92b1",
                 "82a6b0eb4c223692946120f8b821e7f60b3b7b13d94ad10a7f7413f2c3e46547",
                 "e40828a0802b3bf759978a7b68b9534c55bf57036de1f872ccbce38ad2afa20b",
                 "20c86c2897eda813fd36fff693b722928db74d5d923046f4a36b4a6066919172",
                 "27912b78125ffcbef3f7239ab394552b1c0d188a0275f691bfaa87e072795bf9",
                 "90b969f3af89ff58628f6eb454294a9a4c494109b6b1eb255ce0ab117ef2ec3b",
                 "8ccf0fea4b737acd56b328c3bbde7006df054ca5dc1dc2b978104c633d82d47c",
                 "6b0e8b8976c2c33e1a9479481e0b52967f28d18ca4b7cb4058f87ac277720930",
                 "9b1a9c33beaefa3b30176d4214430de9ccd87af7d754ac36ba0c96d31dbd2362",
                 "4fb824b88b2301635ffe41117bdb8b2b34de6b1aef1650b292f834a1536f887c", 
                 "8ccf0fea4b737acd56b328c3bbde7006df054ca5dc1dc2b978104c633d82d47c", 
                 "bb64e0a09e4a99eea783cb5063edb180e0938f4fdf6f99dd285e198218d544c9", 
                 "837cfaafe17eeb3eceabbf6260c409efedf6220e93baef34ffe09e00e53ed607", 
                 "57ec9182ffb5e1baf5c105eb531111d11de1c8bb5c46740ae3dae557e40dffe7")
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.10.0"