Cross Process API Activity with Truncated Stack

[rule]
description = """
Identifies attempts to perform memory changes in the address space of a remote process and where the call stack is
truncated. This behavior is consistent with remote code injection attacks.
"""
id = "002d9a6d-c09e-4d3f-a1c1-05b92dbdbb67"
license = "Elastic License v2"
name = "Cross Process API Activity with Truncated Stack"
os_list = ["windows"]
version = "1.0.5"

query = '''
api where process.Ext.api.behaviors == "cross-process" and process.Ext.api.behaviors == "truncated_stack" and
 process.Ext.api.name in ("WriteProcessMemory", "VirtualAllocEx", "VirtualProtectEx") and process.Ext.api.parameters.size >= 10000 and
 process.executable != null and Target.process.executable != null and
 not (process.executable : "C:\\Windows\\System32\\lsass.exe" and process.parent.executable : "C:\\Windows\\System32\\wininit.exe") and
 not process.executable : ("C:\\Program Files\\McAfee\\Endpoint Security\\Threat Prevention\\mfetp.exe",
                           "C:\\Program Files (x86)\\CheckPoint\\Endpoint Security\\EFR\\EFRService.exe",
                           "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe",
                           "C:\\Program Files (x86)\\360\\Total Security\\safemon\\QHActiveDefense.exe",
                           "C:\\Program Files\\Palo Alto Networks\\DEM\\bin\\mtr.exe",
                           "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe",
                           "C:\\Program Files (x86)\\Globus Connect Personal\\bin\\ext\\relaytool.exe",
                           "C:\\Program Files (x86)\\Adobe\\Acrobat *\\Acrobat\\AcroRd32.exe",
                           "C:\\Program Files\\Git\\usr\\bin\\bash.exe",
                           "C:\\Program Files\\Git\\usr\\bin\\sh.exe",
                           "C:\\Program Files\\Git\\usr\\bin\\mintty.exe",
                           "C:\\Program Files\\ESET\\ESET Security\\ekrn.exe",
                           "C:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe",
                           "C:\\Program Files (x86)\\Globus Connect Personal\\bin\\ext\\relaytool.exe") and
 not (process.name : "bash.exe" and Target.process.name : "bash.exe" and process.Ext.api.metadata.target_address_name like ("Data", "cyg*.dll")) and 
 not (process.name : "perl.exe" and Target.process.name : "perl.exe" and process.Ext.api.metadata.target_address_name like ("Data", "cyg*.dll", "posix.dll*", "msxml3.dll")) and 
 not (process.name : "ssh.exe" and Target.process.name : "ssh.exe" and process.Ext.api.metadata.target_address_name like ("Data", "msys-*.dll", "cyg*.dll")) and 
 not (process.name : "sh.exe" and Target.process.name : "sh.exe" and process.Ext.api.metadata.target_address_name like ("Data", "cyg*.dll")) and 
 not (process.Ext.api.name == "WriteProcessMemory" and process.executable : "C:\\GEservice\\cygwin\\bin\\perl.exe" and 
      Target.process.executable : "C:\\GEservice\\cygwin\\bin\\perl.exe" and process.Ext.token.integrity_level_name == "system") and
 not (process.Ext.api.summary == "WriteProcessMemory( ssh.exe, Data, 0x3c80 )" and process.name == "relaytool.exe")
'''

min_endpoint_version = "8.14.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Target.process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"