Potential Privilege Escalation via Missing DLL

[rule]
description = """
Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows installation (phantom DLL) or
one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate
privileges via privileged file write vulnerabilities.
"""
id = "a2a3d803-5c25-43cc-84b9-a4ae2a4dab27"
license = "Elastic License v2"
name = "Potential Privilege Escalation via Missing DLL"
os_list = ["windows"]
reference = [
    "http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html",
    "http://waleedassar.blogspot.com/2013/01/wow64logdll.html",
    "https://github.com/rapid7/metasploit-framework/blob/5863ff7e357af1634f5b370e811d647a9c999158/modules/exploits/windows/local/cve_2020_17136.rb#L192",
    "https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html",
    "https://itm4n.github.io/windows-dll-hijacking-clarified/",
    "https://shellz.club/edgegdi-dll-for-persistence-and-lateral-movement/",
    "https://windows-internals.com/faxing-your-way-to-system/",
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
    "https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine",
]
version = "1.0.41"

query = '''
library where
   user.id : "S-1-5-18" and (dll.code_signature.trusted == false or dll.code_signature.exists == false) and 
   (dll.Ext.relative_file_creation_time <= 172800 or dll.Ext.relative_file_name_modify_time <= 172800) and 
     (
       dll.name :
         ("wlbsctrl.dll",
          "WptsExtensions.dll",
          "Tsmsisrv.dll",
          "TSVIPSrv.dll",
          "Msfte.dll",
          "wow64log.dll",
          "WindowsCoreDeviceInfo.dll",
          "phoneinfo.dll",
          "EdgeGdi.dll",
          "cdpsgshims.dll",
          "diagtrack_win.dll",
          "wlanhlp.dll",
          "healthapi.dll",
          "prntvpt.dll",
          "SprintCSP.dll") or
       dll.path : ("?:\\Windows\\System32\\Ualapi.dll",
                   "?:\\Windows\\SysWOW64\\Ualapi.dll",
                   "?:\\Windows\\System\\Ualapi.dll",
                   "?:\\Windows\\Ualapi.dll",
                   "?:\\Windows\\System32\\oci.dll",
                   "?:\\Windows\\System32\\spool\\drivers\\x64\\PrintConfig.dll",
                   "?:\\windows\\Ualapi.dll",
                   "?:\\windows\\wbemcomn.dll",
                   "?:\\Windows\\oci.dll",
                   "?:\\windows\\System32\\Wbem\\Ualapi.dll",
                   "?:\\windows\\System32\\WindowsPowerShell\\v1.0\\wbemcomn.dll",
                   "?:\\windows\\System32\\WindowsPowerShell\\v1.0\\Ualapi.dll",
                   "?:\\windows\\System32\\WindowsPowerShell\\v1.0\\oci.dll",
                   "?:\\Python??\\wbemcomn.dll",
                   "?:\\Python??\\Ualapi.dll",
                   "?:\\Python??\\oci.dll",
                   "?:\\windows\\System32\\OpenSSH\\wbemcomn.dll",
                   "?:\\windows\\System32\\OpenSSH\\oci.dll",
                   "?:\\windows\\System32\\OpenSSH\\Ualapi.dll", 
                   "?:\\Windows\\System32\\wbem\\wbemcomn.dll", 
                   "?:\\Windows\\SysWOW64\\wbem\\wbemcomn.dll")
     ) and
     not dll.path : 
               ("?:\\Windows\\System32\\prntvpt.dll", 
                "?:\\Windows\\System32\\wlanhlp.dll", 
                "?:\\Windows\\SysWOW64\\prntvpt.dll", 
                "?:\\Windows\\WinSxS\\*.dll") and 
     not (dll.pe.imphash : "a9ab204cf2b4a1903b3fba3c920bd357" and dll.name : "Ualapi.dll")
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "8.4.0"