[rule]
description = """
Identifies registry modification to the original WaaSMedicSvc COM TypeLib registry key used as a primitive to hijack the
normal behaviour of this service for evasion and privileges elevation.
"""
id = "7ca4d620-3611-4c29-80c8-a76a4e67ed9f"
license = "Elastic License v2"
name = "WaaSMedicSvc COM Type Lib Hijack"
os_list = ["windows"]
reference = [
"https://blog.scrt.ch/2023/03/17/bypassing-ppl-in-userland-again/",
"https://googleprojectzero.blogspot.com/2018/10/injecting-code-into-windows-protected.html",
]
version = "1.0.18"
query = '''
registry where
registry.path :
("HKLM\\SOFTWARE\\Classes\\TypeLib\\{3ff1aab8-f3d8-11d4-825d-00104b3646c0}\\*\\Win??\\",
"HKEY_USERS\\*Classes\\TypeLib\\{3ff1aab8-f3d8-11d4-825d-00104b3646c0}\\*\\Win??\\") and
registry.data.strings != null and
not (user.id : "S-1-5-18" and process.executable : "?:\\windows\\system32\\svchost.exe" and
registry.data.strings : "?:\\WINDOWS\\system32\\WaaSMedicPS.dll")
'''
min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[threat.technique.subtechnique]]
id = "T1546.015"
name = "Component Object Model Hijacking"
reference = "https://attack.mitre.org/techniques/T1546/015/"
[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"