Process Creation via ROP Gadgets

[rule]
description = """
Identifies the creation of a process from unusual modules or NTDLL offsets. This may indicate an attempt to bypass API
monitoring using Return Oriented Programming (ROP) assembly gadgets to execute a syscall instruction.
"""
id = "4cd250a2-82a0-463b-adda-5256cee422ce"
license = "Elastic License v2"
name = "Process Creation via ROP Gadgets"
os_list = ["windows"]
version = "1.0.24"

query = '''
process where event.action == "start" and
 not process.Ext.token.integrity_level_name == "low" and
 process.parent.thread.Ext.call_stack_summary : ("ntdll.dll|*", "win32u.dll|*") and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info:
                                                                 ("*ntdll.dll!*CreateUserProcess*",
                                                                  "*ntdll.dll!*DeviceIoControlFile*",
                                                                  "*ntdll.dll!*CreateThreadEx*",
                                                                  "*ntdll.dll!*AssignProcessToJobObject*",
                                                                  "*ntdll.dll!*DeleteAtom*",
                                                                  "*ntdll.dll!NtSetEvent*",
                                                                  "*ntdll.dll!NtCallbackReturn*",
                                                                  "*KernelBase.dll*!CreateProcess*",
                                                                  "*ntdll.dll+*",
                                                                  "*ntdll.dll!*ReadFile*",
                                                                  "*ntdll.dll!NtReplyWaitReceivePort*",
                                                                  "*KernelBase.dll!WriteConsoleW*", 
                                                                  "*ntdll.dll!NtDebugContinue*", 
                                                                  "*kernel32.dll!CreateProcess*", 
                                                                  "*ntdll.dll!ZwCreateMailslotFile*", 
                                                                  "*ntdll.dll!*EnableLastKnownGood*", 
                                                                  "*ntdll.dll!*CreateEnclave*", 
                                                                  "*ntdll.dll!ZwCreateTimer*",
                                                                  "*ntdll.dll!ZwCreateKeyedEvent*",
                                                                  "*ntdll.dll!NtSinglePhaseReject*",
                                                                  "*ntdll.dll!RtlCompleteProcessCloning*",
                                                                  "*ntdll.dll!NtCreateWaitCompletionPacket*",
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtAlpcDeleteSecurityContext+*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtCreateRegistryTransaction*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtCreatePrivateNamespace*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtDeletePrivateNamespace*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtSetInformationDebugObject*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtQueryAttributesFile*",
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtOpenPrivateNamespace*",
                                                                  "C:\\Windows\\System32\\kernel32.dll!LoadLibrary*",
                                                                  "C:\\Windows\\System32\\KernelBase.dll!LoadLibrary*", 
                                                                  "C:\\Windows\\System32\\advapi32.dll!CreateProcessAsUser*", 
                                                                  "C:\\Windows\\System32\\wersvc.dll!SvchostPushServiceGlobals*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtSetInformationSymbolicLink*")) and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info : "*ntdll.dll*" and $entry.allocation_private_bytes > 0) and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info : "*ntdll.dll+0x*") and
 not process.executable : ("?:\\Windows\\System32\\conhost.exe", "?:\\Windows\\SysWOW64\\WerFault.exe") and
 not (process.executable : "?:\\Windows\\System32\\sppsvc.exe" and process.Ext.protection == "PsProtectedSignerWindows" and 
      process.parent.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|kernel32.dll|services.exe|rpcrt4.dll|ntdll.dll|kernel32.dll|ntdll.dll")
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"