[rule]
description = """
Identifies attempt to call memory manipulation APIs or load a library where call stack is pointing to the RPC function
NdrServerCall2, this may indicate an attempt to exploit a vulnerability using fake RPC messages to bypass CFG
mitigation.
"""
id = "94668ca0-a006-4aea-a878-a025c5308b88"
license = "Elastic License v2"
name = "Potential Exploit via Fake RPC Messages"
os_list = ["windows"]
reference = ["https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html"]
version = "1.0.4"
query = '''
any where event.category in ("api", "library") and
process.thread.Ext.call_stack_summary like ("ntdll.dll|rpcrt4.dll|*", "ntdll.dll|kernelbase.dll|rpcrt4.dll|*") and
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*\\rpcrt4.dll!NdrServerCall2*") and
not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*\\rpcrt4.dll!Rpc*", "*\\rpcrt4.dll!I_Rpc*"))
'''
min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1211"
name = "Exploitation for Defense Evasion"
reference = "https://attack.mitre.org/techniques/T1211/"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "8.7.0"