Potential AMSI Bypass via SetThreadContext

[rule]
description = "Identifies attempts to bypass the Microsoft Anti Malware Scan Interface via threat context manipulation."
id = "2f7630e4-a125-4ba6-a8a7-3d4f17ece8d5"
license = "Elastic License v2"
name = "Potential AMSI Bypass via SetThreadContext"
os_list = ["windows"]
reference = [
    "https://aidenpearce369.github.io/offsec/AMSI-Memory-Bypass/",
    "https://modexp.wordpress.com/2019/06/03/disable-amsi-wldp-dotnet/",
]
version = "1.0.6"

query = '''
sequence by process.entity_id with maxspan=3s
[library where (dll.name : "amsi.dll" or dll.pe.original_file_name == "amsi.dll") and
  process.thread.Ext.call_stack_summary like "ntdll.dll*" and
  not process.thread.Ext.call_stack_summary like
                                             ("*rpcrt4.dll|combase.dll|*", "*|clr.dll*", "*|jscript.dll*", "*|jscript9.dll*",
                                               "*|vbscript.dll*", "*|mscorlib.ni.dll*", "*|mscoreei.dll*", "*|coreclr.dll*",
                                               "*|vbe?.dll|*", "*fastprox.dll|combase.dll|*", "*|vssvc.exe|sechost.dll*",
                                               "*kernelbase.dll|swprv.dll|svchost.exe*") and
  _arraysearch(process.thread.Ext.call_stack, $entry,
               $entry.symbol_info like ("C:\\Windows\\Sys?????\\ntdll.dll!LdrLoadDll*",
                                        "C:\\Windows\\Sys?????\\KernelBase.dll!LoadLibrary*"))]
[api where event.provider == "Microsoft-Windows-Kernel-Audit-API-Calls" and
 process.Ext.api.name == "SetThreadContext" and process.Ext.api.behaviors != "cross-process" and
 not process.thread.Ext.call_stack_final_user_module.name in ("clr.dll", "coreclr.dll", "Unknown", "Undetermined") and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                         ("0799a4a76a1af52b3ca214c54b60dd5cea0c68111d02354eb240a45d165ffdd3",
                          "1ce43599e89c84d16b4a7044de1245e313c6d64d1d0b761b615af17a03b39dd9",
                          "9e2509ea716edf0464687553ae9740f4e28a748d5587061ec1441a996a7371cc",
                          "baeded008c8bd259685527543807ff3f6f05d7e43b60a5814656fd6912672277",
                          "e84abf700715ba9dff463985f3648910bcec730df60792a9866be57ce6028636",
                          "aa95131a1bd9d71de05031f41ac4930e9c9afe630fa4eef9b0a82e07e69799ed",
                          "4622e028bf88c47cc46ea4351e281ec032a7cdf2c00d3172d24b6daef68e156e",
                          "7f8e0d6e650cc61a5277c6bca2325c096735122dd46df1d410e2e5da3daa8aaf",
                          "b980fe2c06d57e913cba14f67faf49b1f337f889bbf52bbccbec1c4383ffb4db") and
 not (process.executable : "C:\\Program Files\\AzureConnectedMachineAgent\\azcmagent.exe" and
      process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\windows.devices.sensors.dll") and
 not (process.thread.Ext.call_stack_final_user_module.path like ("c:\\program files\\*", "c:\\program files (x86)\\*") and
      _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true)) and
 process.thread.Ext.call_stack_final_user_module.name != null and process.thread.Ext.call_stack_final_user_module.name != "Kernel" and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                   $entry.subject_name in ("Rapid7 LLC", "VELOCIDEX ENTERPRISES PTY LTD", "CyberCX Pty Ltd", "Microsoft Windows Hardware Compatibility Publisher", "Exafunction, Inc.", "Proton AG", ".NET"))]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"