DLL Loaded from a Macro Enabled Document

[rule]
description = """
Identifies when a Microsoft Office process loads a DLL and from a call stack pointing to Microsoft Office Visual Basic
for Applications modules. This may indicate an attempt to get initial access using malicious macro enabled documents.
"""
id = "9ebda43a-16dd-4d9e-ab7c-c1056e7d959a"
license = "Elastic License v2"
name = "DLL Loaded from a Macro Enabled Document"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.24"

query = '''
library where
   process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "mspub.exe", "fltldr.exe", "visio.exe") and
   (
    /* VBA */
    process.thread.Ext.call_stack_summary : "*|vbe?.dll*" or

    /* Shellcode RWX  */
    (_arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and $entry.protection : "RWX") and
     not process.thread.Ext.call_stack_summary : ("*|clr.dll|*", "*mscorwks.dll*", "*mscoreei.dll|mscoree.dll*", "*system.management.ni.dll*"))
   ) and

   /* Suspicious DLLs */
   (
    dll.name : "taskschd.dll" or
    dll.Ext.relative_file_creation_time <= 300 or
    ((dll.code_signature.trusted == false or dll.code_signature.exists == false) and not dll.path : ("?:\\Windows\\System32\\*", "?:\\Windows\\SysWOW64\\*"))
    ) and

    not dll.path :
           ("?:\\Windows\\assembly\\NativeImages_*.dll",
            "?:\\Windows\\System32\\spool\\drivers\\x64\\3\\*",
            "?:\\Program Files\\*",
            "?:\\Program Files (x86)\\*",
            "?:\\Windows\\Microsoft.NET\\Framework*", 
            "?:\\Windows\\system32\\scrrun.dll",
            "?:\\Windows\\syswow64\\scrrun.dll",
            "?:\\Windows\\SysWOW64\\THREED32.OCX",
            "C:\\blp\\*",
            "?:\\Windows\\System32\\DriverStore\\FileRepository\\*") and
    not dll.hash.sha256 :
                 ("a33c6d203ffa6941b1e498f52f6ef565c5d731c2deecbae067c0039208a8db25",
                  "4579447a18f557ef95cad8df77634370dbe7ddeaed8d319ea6e7a26ac1e79db6",
                  "f1c4e834f96abc5d787bd3d4efea008537eb44fd3e3b6560f8cef4eace525a62",
                  "902553c9ffdc9e9751c6045b50590613183d4a7cc730365f7d629729a43fedcd",
                  "b80eca5b58d276be4d66bda65599e609efde2811de252172eeccea803826d41f",
                  "a33c6d203ffa6941b1e498f52f6ef565c5d731c2deecbae067c0039208a8db25",
                  "f110d49ca78d0fe8ee0fa1824f7bb714359159e824a65a13f2fd5bb7d91b692a",
                  "90b3278ba2df87e4d61817adacf60f467359e0ff54dc793c0d5fdbc5fb087e59",
                  "2e531fdebdc3468c03922545ce169804400e3ebb577e08ec88a6561901d2c595",
                  "97c8afd6038b37729933ea0895760abe0a15b48258c46a04a0d010ed1ffa4e07",
                  "81fc25734e3876b34e287a1df17cb94483029534392fed50f0c629e40485660c",
                  "bd92610dd9504c6eef269b4c7b1bcaf9ebf28081bb81a82fc053035701182383",
                  "1e38e061ee5fcd4a76c591c24a39da005dc5fd58062ef8fadfe1ade95bfdbd4c",
                  "96c0caf8a7e7c087028c0793eb9a0ab21f7a4a7a5ca5c85a95ad1f4419a8186c",
                  "079cff190d73f4d1074844bf188588542cf3b52c22f775019fad113e0b63b14d",
                  "d661f1a025d99a98ebc6e42b3e69ae89379773821b2471ae138c4e55a5b63aa7",
                  "75e06078dd24506ffea81cf1615f5f9d9057abe2caf0067c396f20f3bea8b817",
                  "44185134b1f8c503c78e9dbc36891ba3fa109237c3dc79399955bf29e75921d4",
                  "9c2f359207114f5de82f080b08cbcfe723153b3f9c002c3f672a60e88c0d71b6")
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "8.10.0"