Library Load of a File Written by a Signed Binary Proxy

[rule]
description = """
Identifies the image load of a DLL file written or modified by a signed Microsoft binary proxy utility such as
MSHTA.exe, CertReq.exe or CertUtil.exe. Adversaries may bypass process and/or signature-based defenses by proxying
execution of malicious content with signed binaries.
"""
id = "7b5a1c52-12ff-4c1b-b1f1-2226ceb11c9a"
license = "Elastic License v2"
name = "Library Load of a File Written by a Signed Binary Proxy"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.31"

query = '''
sequence with maxspan=5m
   [file where
    process.name : ("MSHTA.EXE", "CertUtil.exe", "CertReq.exe", "tar.exe", "curl.exe", "xcopy.exe")
    and file.Ext.header_bytes : "4d5a*" and process.executable : "?:\\Windows\\Sys*\\*.exe" and 
    not (process.name : "xcopy.exe" and user.id : "S-1-5-18")] as event0
   [library where not startswith~(process.executable, dll.path) and
    startswith~(dll.path, event0.file.path) and
    process.code_signature.subject_name : "Microsoft*" and
    not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
    not (process.executable : "?:\\Windows\\SysWOW64\\regsvr32.exe" and dll.path : "C:\\oracle12\\*.dll") and
    not dll.path :
            ("?:\\Oracle\\product\\instantclien*.dll",
             "?:\\Program Files\\*",
             "?:\\Program Files (x86)\\*") and
    not (process.name : "regsvr32.exe" and dll.path : "?:\\Oracle\\*.dll") and
    not process.executable : 
              ("?:\\Program Files (x86)\\Microsoft Visual Studio\\*\\MSBuild.exe", 
               "?:\\Windows\\Sys*\\inetsrv\\w3wp.exe", 
               "C:\\gstr\\rdcnet\\tools\\gacutil.exe", 
               "?:\\Program Files\\IIS Express\\iisexpress.exe",
               "C:\\Program Files (x86)\\Microsoft Visual Studio\\*\\Common7\\IDE\\devenv.exe") and
    not dll.hash.sha256 : "cd9c2a615d6b842bda79c0f10eb44cc9b428bf4ad25c0cefbd5f43f9599d51f1"]
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.4.0"