Rundll32 or Regsvr32 Loaded a DLL from Unbacked Memory

[rule]
description = """
Identifies instances of RunDLL32 or Regsvr32 loading a DLL from an unbacked memory region. Adversaries often abuse those
programs to proxy execution of malicious libraries.
"""
id = "226df8a0-6ef8-4965-91b4-7ce64078c206"
license = "Elastic License v2"
name = "Rundll32 or Regsvr32 Loaded a DLL from Unbacked Memory"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.27"

query = '''
sequence by process.entity_id
 [process where event.action == "start" and
  (process.name : ("rundll32.exe", "regsvr32.exe") or process.pe.original_file_name : ("rundll32.exe", "regsvr32.exe")) and

  not (process.name : "rundll32.exe" and
       process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and process.parent.executable : "?:\\Windows\\Sys*\\msiexec.exe") and

  not (process.executable : ("?:\\Windows\\sys*\\rundll32.exe", "\\\\?\\Volume{*}\\Windows\\Sys*\\rundll32.exe") and
       process.args : ("--type=gpu-process", "--enable-speech-input", "--type=utility", "--no-sandbox")) and

  not (process.command_line : "\"C:\\Windows\\sys*\\rundll32.exe\"  --enable-speech-input --enable-media-stream --no-sandbox" and
       process.parent.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and

  not process.parent.executable :
                     ("?:\\Program Files\\Royal TS V6\\RoyalTS.exe",
                      "?:\\Program Files (x86)\\Kaarya LLC\\myKaarma Desktop\\KaarmaDesktop.exe",
                      "?:\\Program Files (x86)\\Steam\\steamapps\\common\\Sun Haven\\Sun Haven.exe",
                      "?:\\Program Files\\Symantec\\Symantec Endpoint Protection\\*\\Bin64\\ccSvcHst.exe",
                      "?:\\Program Files (x86)\\VCOM\\VcomConsole.exe") and

  not (process.args : "--zoam=IndexCigar\\license.dat" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and 
  not (process.name : "rundll32.exe" and 
       process.command_line : ("\"C:\\Windows\\SysWOW64\\rundll32.exe\" --eoim",
                               "\"C:\\WINDOWS\\system32\\rundll32.exe\" --eoim",
                               "\"C:\\Windows\\System32\\rundll32.exe\" C:\\Windows\\System32\\LogiLDA.dll,LogiFetch")) and 
  not (process.parent.executable : "?:\\Windows\\System32\\svchost.exe" and 
       process.command_line : ("\"C:\\WINDOWS\\system32\\rundll32.exe\" Windows.Storage.ApplicationData.dll,CleanupTemporaryState", 
	                       "rundll32.exe AppXDeploymentExtensions.OneCore.dll,ShellRefresh"))
  ]
 [library where dll.name : ("wininet.dll", "ws2_32.dll", "winhttp.dll", "vaultcli.dll") and
  process.thread.Ext.call_stack_summary :
                  ("*ntdll.dll|kernelbase.dll|Unbacked*",
				   "ntdll.dll|iphlpapi.dll|Unbacked",
				   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|wininet.dll|Unbacked|kernel32.dll|ntdll.dll",
				   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|winhttp.dll|Unbacked|kernel32.dll|ntdll.dll",
				   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|wininet.dll|Unbacked") and
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_trailing_bytes :
                         ("*8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b*",
                          "49bb60c05eb7ff7f000048b9*",
                          "*ba0c0000004c8d4c2450448d423441ffd3*",
                          "*f0000ba0c0000004c8d4c2450448d423441ffd349bb80c3*",
                          "8be55d558bec83ec08c745f800000000c745fc02000000c745f*",
                          "eb4feb4b8b45fc83780800740eff750c*",
                          "3bf4e8*008945f4837df800740c837dfc007406837df4007569813*",
                          "eb60eb5c488b44243048837810007410e8907bffff488b4c2440ffd0eb44eb40488b44243048837818007415e8a44500004533c033d2488b4c2438ffd0eb23eb",
                          "48898424e80300004883bc24e803000000750eff94247e030000898424f0030000eb30488d8c2430010000ff94248e03000048898424e80300004883bc24e803",
                          "8bd885db751eff55c88945f8eb168d8592fdffff50ff55d08bd885db7506ff55c88945f856ff55bc85db0f847601000080bd82fcffff0074508b45fc05a00000",
                          "488b55a8c6420c01833d8bbeb25f007406ff1593c7b25f8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b8d70ffffff48894a10488d65",
                          "488944242848837c242800750bff9424ae03000089442430eb27488d8c2460010000ff9424be030000488944242848837c242800750bff9424ae030000894424",
                          "4889442428488d0d83750b00ff152d170900488944243048837c242800741048837c242000740848837c2430007578488d0569fe150048390562fe15007459b8",
                          "90fece85c08bd6a3f024c009b8000000000f95c0c0e6074a8984243c0300000facd01633b42440010000e9fd0000008bc6c0fa02038424b80100008b5424040f",
                          "eb4feb4b8b45fc83780800740eff750ce877adffffffd0eb38eb348b45fc83780c0074126a006a00ff7508e8f9300000ffd0eb1deb198b45fc8378100074106a",
                          "49bb*f0000ba0c0000004c8d4c2450448d423441ffd349bb*",
                          "4c8bf04885c00f84cc00000083fb027c22488d4c2458c74424585b57485dc744245c2047504166c74424600a00ff9570010000488d542468498bceff55384c8b",
                          "85c07503c20400595a68008000006a00e8000000006681242400f051ffe0558bec81ec6c010000535657c7857cffffff4b45524e8d856cffffffc74580454c33",
                          "4889442428488d0d83b40b00ff156d3b0900488944243048837c242800741048837c242000740848837c2430007578488d05a9401600483905a24016007459b8"))

  ]
  until [process where event.action == "end"]
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.010"
name = "Regsvr32"
reference = "https://attack.mitre.org/techniques/T1218/010/"

[[threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"