AMSI or WLDP Bypass via Memory Patching

[rule]
description = """
Identifies attempts to modify the permissions or write to Microsoft Anti Malware Scan Interface or Windows Lock Down
Policy related DLLs from memory. This may indicate an attempt to tamper with certain Windows native protections.
"""
id = "586bf106-b208-45fc-9401-727664175ca0"
license = "Elastic License v2"
name = "AMSI or WLDP Bypass via Memory Patching"
os_list = ["windows"]
reference = [
    "https://aidenpearce369.github.io/offsec/AMSI-Memory-Bypass/",
    "https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell/blob/master/README.md#Patch-the-providers-DLL-of-Microsoft-MpOav.dll",
    "https://modexp.wordpress.com/2019/06/03/disable-amsi-wldp-dotnet/",
    "https://www.elastic.co/security-labs/doubling-down-etw-callstacks",
]
version = "1.0.30"

query = '''
api where

 ((process.Ext.api.name in ("VirtualProtect", "VirtualProtectEx") and process.Ext.api.parameters.protection like "?W*") or
  process.Ext.api.name == "WriteProcessMemory") and

 process.Ext.api.summary : ("* amsi.dll*", "* mpoav.dll*", "* wldp.dll*") and 
 process.executable != null and process.parent.executable != null and process.thread.Ext.call_stack_summary : "?*" and
 not process.thread.Ext.call_stack_final_user_module.name in ("Kernel", "Unknown") and
 (
  process.thread.Ext.call_stack_summary like
                    ("ntdll.dll|kernelbase.dll|Unbacked",
                     "ntdll.dll|kernelbase.dll|Unknown",
                     "ntdll.dll|kernelbase.dll|kernel32.dll|Unbacked",
                     "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                     "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll", 
                     "ntdll.dll|kernelbase.dll|*|_ctypes.pyd|python*.dll|Unknown|kernel32.dll|ntdll.dll",
                     "ntdll.dll|*|vbe?.dll|*",
                     "ntdll.dll|Unknown") or

  endswith~(process.thread.Ext.call_stack_summary, concat("ntdll.dll|kernelbase.dll|Unbacked|", process.name)) or

  endswith~(process.thread.Ext.call_stack_summary, concat(concat("ntdll.dll|kernelbase.dll|Unbacked|", process.name), "|kernel32.dll|ntdll.dll"))
 ) and
 not (process.code_signature.subject_name in
              ("TPZ SOLUCOES DIGITAIS LTDA", "NedGraphics Software B.V.", "Gerber Technology LLC", "Rocscience Inc.", 
               "Wilcom International Pty Limited", "Code Systems Corporation", "Wilcom Pty Ltd", "Galooli Ltd",
               "MECH-MIND ROBOTICS TECHNOLOGIES LTD.", "COJALI SL") and
      process.code_signature.trusted == true) and
 not process.parent.executable : "?:\\Program Files\\PC SOFT\\WINDEV*\\Programmes\\windev64local.exe" and 
 not process.executable : ("?:\\Program Files\\GRAPHISOFT\\ArchiCAD ??\\ArchiCAD.exe", 
                           "?:\\Program Files\\nQueue\\iAPrintManager\\iAPrintManager.exe", 
                           "?:\\Program Files\\PC SOFT\\WINDEV*\\Programmes\\windev64local.exe", 
                           "?:\\Program Files\\PC SOFT\\WINDEV*\\Programmes\\windev64local.exe",
                           "?:\\Program Files\\Sophos\\Endpoint Defense\\SSPService.exe") and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.subject_name in ("Bitdefender SRL", "Parallels International GmbH") and $entry.status == "trusted") and
 not process.thread.Ext.call_stack_final_user_module.path like
                                                            ("c:\\windows\\sys?????\\apphelp.dll",
                                                             "c:\\windows\\syswow64\\esensordbi.dll",
                                                             "c:\\program files\\bitdefender\\endpoint security\\bdhkm\\*\\bdhkm64.dll",
                                                             "c:\\program files (x86)\\internet explorer\\ieshims.dll") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*", "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*"))
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"