Network Module Loaded from Suspicious Unbacked Memory

Description

Identifies the load of a Windows network module by a process where the creating thread's stack contains frames pointing outside any known executable image. This may indicate evasion via process injection.

Query · eql

sequence by process.entity_id
 [process where event.action == "start" and process.parent.executable != null and

  not process.Ext.token.integrity_level_name == "low" and

  not user.id in ("S-1-5-19", "S-1-5-20") and

  not (process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "?:\\ProgramData\\*", "?:\\Users\\*\\AppData\\*") and
       process.code_signature.trusted == true) and
       
  not (process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and process.Ext.relative_file_creation_time >= 80000) and 
  
  not process.executable : ("?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe", "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe") and

  not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe" and
       process.parent.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe") and 

  not (process.executable : "?:\\WINDOWS\\SysWOW64\\DWRCS.EXE" and
       process.parent.executable : "?:\\WINDOWS\\SysWOW64\\DWRCS.EXE" and process.parent.args : "-service") and 

  not (process.executable : "?:\\Windows\\System32\\LogonUI.exe" and 
       process.parent.executable : "?:\\Windows\\System32\\winlogon.exe") and 

  not (process.executable : "?:\\Windows\\SysWOW64\\icacls.exe" and 
       process.args : "?:\\Program Files\\Tenable\\Nessus Agent\\*" and 
       process.parent.executable : "?:\\Windows\\SysWOW64\\msiexec.exe") and 

  not (process.name : "rundll32.exe" and
       process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and
       process.parent.executable : "?:\\Windows\\sys*\\msiexec.exe") and

  not (process.name : "rundll32.exe" and process.command_line : "*PcaSvc.dll,PcaPatchSdbTask*" and
       user.id == "S-1-5-18" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and

  not (process.code_signature.subject_name :
                    ("Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "YANDEX LLC", "ConnectWise, Inc.",
                     "Brave Software, Inc.", "Opera Norway AS", "GitHub, Inc.", "Stefan Ries", "JetBrains s.r.o.",
                     "Intel(R) Rapid Storage Technology", "Waves Inc", "Dell Inc", "Lenovo", "DameWare Development, LLC.",
                     "Essential Objects, Inc*", "HP Inc.", "Aina Maximit Oy", "Logitech Inc", "N-ABLE TECHNOLOGIES LTD", 
                     "Cognizant TriZetto Software Group, Inc.", "win.acme.simple@gmail.com", "Crownalytics, LLC", 
                     "Kodak Alaris Inc.", "JAM Software GmbH", "UBISOFT ENTERTAINMENT INC.", "DASSAULT SYSTEMES SE", 
                     "Link Data Security A/S", "Western Digital Technologies, Inc.", "Rockstar Games, Inc.",
                     "SEMPERIS INC.", "Micro-Star International CO., LTD.", "Kaseya Holdings Inc", "KASEYA US LLC",
                     "Intel(R) Software Development Products", "AAC Infotray AG",
                     "CORE.AI SCIENTIFIC TECHNOLOGIES PRIVATE LIMITED", "ClaimMaster Software LLC", "Cellebrite DI LTD",
                     "Riot Games, Inc.", "Autodesk, Inc.", "ACCA software S.p.A.", "Tempus Technologies, Inc.",
                     "NextgenId, Inc.", "Cloud Software Group, Inc.",
                     "Bloomberg LP", "GEO NETWORK SRL", "Geo Network - S.R.L.",
                     "FARO Technologies Inc", "Axis Communications AB", "EWA Technologies, Inc.") and
       process.code_signature.trusted == true) and

  not (process.pe.original_file_name in~ ("msedge.exe", "msedgewebview2.exe") and
       process.code_signature.subject_name like "Microsoft *" and process.code_signature.trusted == true) and

  not (process.executable : "?:\\Windows\\System32\\Essentials\\SharedServiceHost.exe" and
       process.parent.executable : "?:\\Windows\\System32\\services.exe") and

  not (process.name : "powershell.exe" and
       process.parent.executable : "?:\\Program Files (x86)\\Lenovo\\VantageService\\*\\LenovoVantage-(LenovoSystemUpdateAddin).exe") and
  not process.pe.imphash in ("d41d8cd98f00b204e9800998ecf8427e", "45e4653ae633e067079dd72666b0158b") and
  not process.hash.sha256 in
                   ("35542bc04fbfa2e3ef68837640e0459c6f99729c0c73578c08ab351cdf030696",
                    "1005dcfddfbde91cc967ecc6d778c81cb4f7bede03121a3e6e0d9bae12a033e0",
                    "53cec44e4fc9a3477d264c5edc9e376af8fcca20853faa289387f5bd7eaae05f",
                    "49113f4cd7bbf3343a43b13edd745008c4f41da1d80c9f89dc90a4b0bb39b8f8",
                    "0ab8a14e7fd42818608cc0916fc26a12b2ae6b976c97310dc86011713e455d2d",
                    "afa3dc1ecd4e15a869dc57a280aee930fc0bab1cd49e17afd3944ae4ad1fc91f",
                    "18b177280b0e0e05aa0e26807f34634c3384ae4f5901f41ff5bb0a720ea5c106",
                    "4f1528318085f6117734a27f34a317a83b096d55532000f81ed67b1bb10632fa",
                    "35f210c1f941f917b81c2516bee9de8f0495baca42095685e9b0b76f67250dc9",
                    "edef301528767963f460bf7fe497ca3b5c648627a2d13abe74d5544578b56bd4",
                    "f856a3c582ca689bdea3e784ef6a0db37011bd5ebb31d7c79d0328ebfcf6d8a4",
                    "fe62ba0a61191a9b54aab7ba3221479c451b042fa30a08957cacff84ddfe094b",
                    "183cd12fbdd93aa785d3793a8872c4a9730dd154f6482c39f94552e556a7b4e9",
                    "ed6c844c72fccd7e7799d448f5e74df368cafd2631858573e6e29110c213ac79",
                    "43a84e01b5ddecf0b6297277d53c72025a73b00b9f0073933a700695a240b5e8",
                    "f4cb2a001dcee0577046c56df5adfe989bc875c29ecfe27c9569849a9a6f0671",
                    "ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
                    "51346e95656164783ae4de9d6b202f28be87358eb0e056d2d7cdd12b502d30e7",
                    "889cb8827a400984bea2e0561a1efbf9d18044e879974da8baa750a0c63748c6",
                    "96dcdb449ab48b21b6efd33afc59ae163dea5fc597ffaf5dd7030b20d2624467", 
                    "43714f0fc5cea25a6ee936fd36a83f86a45f61447c16c8e9255ef317089ce39c", 
                    "52a5036d1578a6b899fb5d14fd3ab12af463e94ac791d1dddb22b7e8cc1f4bd7", 
                    "f5f15ab19171dbcb58e757cd6446be41e04adf00797d712b07e544066ecd3c67", 
                    "49b95a804337ee7e12092cc7a13c2eb6c3acb33f9bbaac8e820b9184063642f2", 
                    "4c974212f5fc3720d58a8df6c2b9587b85949edc676f9f82921c04f067c261f1", 
                    "ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
                    "121a4e78abe13c92a7ff91d2e91bc98173724072cc891ecbbc10765e8d5bd024", 
                    "54e55d6da825d709cf495eb18be10d8cbb92ac1904c1359999d53d3fa42161e2",
                    "07e79814fde31ff5968d5c0448014d931cd3a2e59b2ac841bc53a155c333a1b9",
                    "afcee50eace500b9b2c3dc4faab371fd040d769ba3a5197ef3a8762fe5457337",
                    "e7883c7d57f5cfe7d1649ab138f62f5042f7acda8ed3c8664c9335c3ddba85c4",
                    "8982729121fa3b3e6c283437f5832916a5a3611374ac848368c6edaae5086257",
                    "63f2a4be0dfbaf2b9740aa5c2320d0290451d6d5581cc6f8e183ced9ea796d95",
                    "30534b04d137543932bc0e66fc778d772ca5d90c0b5faec74a842cad8d50ade8",
                    "fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85",
                    "cffea8d18419170baded53d75a8d1b8d20170c21ef2d4bebddfb2efcb89a641c",
                    "ca52dce8cc2aecc23138a524683ad608b4a5eaed9a7a10336e4cf6c7b9d6e5e0",
                    "b4aa6923bd807af4433c968aa1ded17a3bf8e36f1053fe24dc31dd5a8eb9f4ce",
                    "4acdfb075f5a801b976819cd22bc3a930ad5f8ee92de2d5ad36b0a4f1e5a8b24",
                    "1c237e9015c81487aa67d56f8aa4788fbb6bfb3039e455485376712cfc978e62",
                    "47585eb41299f97c88028c3dae3ba6049355b8e0a8074abeae9f4f9381832c20",
                    "a26dfec1922d751c710a2f2ab16a33facb6fef8997d21784681f1be637a78b5d",
                    "be92c45eeb7ffb4b3bf62b76b3218a0c4cdcfa52c8ddb5a47b9abc407dda282e") and

  not (process.executable : "?:\\Windows\\SysWOW64\\dllhost.exe" and process.parent.name : "svchost.exe" and
       process.Ext.effective_parent.executable : "?:\\Program Files (x86)\\Skillbrains\\lightshot\\*\\Lightshot.exe") and

  not (process.executable : ("?:\\Windows\\SysWOW64\\DWRCST.EXE", "?:\\Windows\\SysWOW64\\DWRCS.EXE") and
       process.parent.executable : ("?:\\WINDOWS\\SysWOW64\\runonce.exe", "?:\\Windows\\SysWOW64\\DWRCST.EXE", "?:\\Windows\\SysWOW64\\DWRCS.EXE")) and

  not (process.executable : "?:\\Windows\\system32\\winsat.exe" and
       process.parent.executable : "?:\\Windows\\system32\\rundll32.exe" and
       process.parent.args : "sysmain.dll,PfSvWsSwapAssessmentTask") and

  not (process.executable :  "?:\\Windows\\System32\\inetsrv\\w3wp.exe" and
       process.parent.executable : ("?:\\Windows\\System32\\inetsrv\\w3wp.exe", "?:\\Windows\\System32\\svchost.exe")) and

  not (process.name : "rundll32.exe" and process.args : "--no-sandbox" and
        _arraysearch(process.parent.thread.Ext.call_stack, $entry,
                     $entry.symbol_info : "?:\\Windows\\assembly\\NativeImages_*\\EO.Base\\*\\EO.Base.ni.dll*")) and

  not process.parent.executable : ("?:\\Program Files (x86)\\Advanced Monitoring Agent\\featureres\\PMESetup.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\featureres\\PMESetup.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\downloads\\NetworkManagementInstall.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\staging\\_new_setup.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\downloads\\MAV-Installer.exe",
                                    "?:\\Program Files (x86)\\LiongardInc\\*\\node.exe",
                                    "C:\\WINDOWS\\_ScriptingFramework\\Modul\\Engine.exe",
                                    "C:\\Program Files\\IperiusRemote\\GlantzSupportClient.exe",
                                    "C:\\Program Files (x86)\\ReluxDesktop\\converter\\Raster2Vector.exe",
                                    "C:\\Program Files (x86)\\Assinador Serpro\\uninstall.exe") and
  not (process.executable : "C:\\Windows\\Microsoft.NET\\Framework\\*\\RegAsm.exe" and
       process.args : "C:\\Program Files (x86)\\Common Files\\PortsRanch\\WenuMeta\\Micriuuft_Inroles.dll" and
       process.parent.executable : "C:\\WINDOWS\\system32\\svchost.exe") and

  not process.executable :
                  ("C:\\Program Files (x86)\\MultiExtractor\\MultiExtractor.exe",
                   "C:\\Program Files (x86)\\Naverisk\\Agent\\Packages\\SoftwareScanPackage\\SoftwareScanner\\Naverisk.Agent.SoftwareScanner.exe") and

  not (process.executable : "?:\\APP\\d3\\nats\\NatsCtl.exe" and process.parent.executable : "?:\\APP\\d3\\procmgr\\dserver.exe" and
       process.code_signature.trusted == true and process.code_signature.subject_name : "d.velop AG") and

  not (process.executable : "*\\PeaxactLicenseServerMonitor.exe" and
       process.code_signature.subject_name == "S-PACT GmbH" and
       process.code_signature.trusted == true)
 ]
 [library where
  dll.name in~ ("ws2_32.dll", "wininet.dll", "winhttp.dll") and
  process.thread.Ext.call_stack_contains_unbacked == true and
  (
   process.thread.Ext.call_stack_summary in
                  ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|kernelbase.dll|Unbacked",
                   "ntdll.dll|iphlpapi.dll|Unbacked",
                   "ntdll.dll|winhttp.dll|Unbacked",
                   "ntdll.dll|kernelbase.dll|wininet.dll|Unbacked",
                   "ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|wininet.dll|Unbacked|ntdll.dll",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|kernelbase.dll|Unbacked|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll") or
  
  startswith~(process.thread.Ext.call_stack_summary, concat(concat("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|", process.name), "|kernel32.dll|ntdll.dll"))
  ) and
  /* DynTrace, HP Sure Click Hook Dll */
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_leading_bytes :
                         ("*6764a118008b40243b835b080000753033c089835b0800008d835f080000508d8353000000506a006a00ff936b080000*",
                          "45fc33c08945f88bf28dbd82fcffffb9dc000000f3a566a568008000006a0052ff55b86803800000ff55bc8bf080bd82fcffff0074188d8592fdffff50ff55c4",
                          "*d74533db4c8b4d504c894d284c8d0d0f0000004c894d404c8b4d6041c6410c00ffd0*",
                          "83ec28488b4c2430ff15b40f00004883c428c3cccccccccccccc4c894424188954241048894c24084883ec38837c244801755f488d0d701f0000ff15720f0000",
                          "55c0488d55c0488b4d10e8886dadff488bc8488975b8488b55b0488b5220488b02488bd64533db4c8b45b04c8945804c8d050a0000004c894598c6470c00ffd0", 
                          "488bcd48894da8488d8d78ffffff48894b10488975c0488b4db8488b4920488b01488bcf488bd64c8b45b84c8945884c8d050a0000004c8945a0c6430c00ffd0",
                          "80000000c7858c00000001000000488b4d50488b4920488b01488b8d800000004533db488b555048895528488d150e00000048895540488b5560c6420c00ffd0")) and
  /* Managed Code, Cynet MemScanner, xSecuritas */
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_trailing_bytes :
                         ("*8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b*",
                          "c6430c01833d*5f007406ff1*",
                          "48898424e80300004883bc24e803000000750eff94247e030000898424f0030000eb30488d8c2430010000ff94248e03000048898424e80300004883bc24e803",
                          "8bd885db751eff55c88945f8eb168d8592fdffff50ff55d08bd885db7506ff55c88945f856ff55bc85db0f847601000080bd82fcffff0074508b45fc05a00000",
                          "488b55a8c6420c01833d8bbeb25f007406ff1593c7b25f8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b8d70ffffff48894a10488d65",
                          "**45a848894590eb00488b4590488b5588c6420c01488b5588",
                          "*488b5560c6420c01488b5560488b4d2048894a",
                          "c6470c01833d6cf1b45f007406ff15f40cb45f8bf0e8b5e76f5f85f6400f95c6400fb6f64883bdc0000000007423488b8dc0000000e825ebe25e448bc0488b95",
                          "488b5560c6420c01833db339f55f007406ff153b43f55f898584000000488b4d00e845000000908b8584000000488b5560c6420c01488b5560488b4d2048894a",
                          "898383080000c7837f080000010000006a0056ff9397080000ff938b*",
                          "41c64?0c01833d*",
                          "c6430c0148ba*f87f0000833a00740c*",
                          "488b8d70ffffffc6410*",
                          "c6470c01833d*",
                          "a3b8eb*",
                          "a314a2e40585c*",
                          "488b9570ffffffc6420*",
                          "49bb60c0*",
                          "488b8d?0ffffffc6410401833d*",
                          "488b8d?0ffffffc6410401833d*",
                          "488b5590c6420c01833d*",
                          "8bf08b45d8c6400801833d801*45e88945dc8b45dc8b55",
                          "c6470401833de8eee*84883c4785b5e5f415c415d415e415f5dc31910090010e20c300b",
                          "49bb80b681f6fc7f000048*7f0000ba0c0000004c8d4c2450448d423441ffd3*",
                          "488b4d88c6410c01*488945a0488b45a0488945a8909090*",
                          "ebfecc0000*",
                          "*ba0c0000004c8d4c2450448d423441ffd3*",
                          "*ca85c0b8000000000fb6d60f95c0898424f40200000ac22b742458d0d80fb6c0*",
                          "*898424300300008d14922b9c24d0010000f7d28bc3034424600fbbc20facc2183b44240892",
                          "41c6460c0148ba*7f0000833a00740c*",
                          "8be55d558bec83ec08c745f800000000*",
                          "48898424b80000004883bc24b8000000000f848d000000488b442440480510130000488bd0488b8c24b8000000ff94249000000048898424d80000004883bc24", 
                          "898383080000c7837f080000010000006a0056ff9397080000ff938b08000050ff9393080000cc8b1c24c3ce0000087c00960046003a005c00500072006f0067", 
                          "488944242048837c24200075*", 
                          "c6430c01833d*",
                          "c22800ccccff7424248b0d5c93*",
                          "a36c3e*985c00f84f9000000568b35*",
                          "a3b022*985c00f84f9000000568b354c81*",
                          "48898424b80000004883bc24b8000000000f8498000000488b442440480510130000488bd0488b8c24b8000000ff94249000000048898424d80000004883bc24",                          "*0000ba0c0000004c8d4c2450448d423441ffd3*",
                          "41c6470c0148ba*7f0000833a00740c48b9*",
                          "41c6470c0148ba*4c8b6d8849897508498bc5488b9548ffffff498957104881",
                          "c6460c01833db6e5e75f007406ff15eae8e65f488bd8e8aa38b25f488bc3488b4d8048894e104883c4785b5e5f415c415d415e415f5dc367611910090010e20c",
                          "49bb60c05eb7ff7f000048b9*",
                          "488945984885c07507bac4020000eb2d6685db750*",
                          "*488b5588498956104883c4785b5e5f415c415d415e",
                          "c6460c01833d*",
                          "898383080000c7837f080000010000006a0056ff9397080000*",
                          "8be55d558bec83ec08c745f800000000c745fc02000000*",
                          "898383080000c7837f080000010000006a0056ff*",
                          "49bbb014*f0000ba0c0000004c8d4c2450448d423441ffd349bb403*",
                          "*00ba0c0000004c8d4c2450448d423441ffd349bb*",
                          "*48bf7063107ef67f0000488b064889074883c6084883c708488b06488907415f415e415d415c41*",
                          "1bd1a3300a*f9bc00fa3cab8000000000f98c28d14400f95c00fca0fca8984242403*",
                          "84c07507e8b8836effeb498b45f88b55c089108b45e48945f4c70518c*",
                          "488b8d70ffffffc6410c01833df07bca5e007406ff15a47fc95e488b8d70ffffff488b9528ffffff48895110488945b0ff15804ce6fe8945c4488bcce8780000",
                          "498bd7488bcf4c8be8e819bbffff4533ff4d85ed0f84520200004c8b9760020000488d95e0000000440fb74424744533c9498bcd41ffd24c8be04885c00f8420",
                          "488943384885c07512ff15035608004c8d054ce80800e93fffffff4c3973407438663b6b1c7511488b5330488bcfff15d65a080085c07421488b4b40ff157857",
                          "89434885c07507f0ff054b360c000f57c04489bb2c0200004c89bb400200004c89bb480200004489bb500200000f1183580200000f1183680200000f11837802",
                          "488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
                          "c6430c0148ba446a76e3fd7f0000833a00740c48b9988375e3fd7f0000ff11488b5580488953104883c4785b5e5f415c415d415e415f5dc30000001910090010",
                          "f7d20fca85c08af3a37002f103b8000000000fca0f95c01af08984243803000033b424e001000003c60fc8e9a50100004a8bc6c1ea0b8d94248c01000003023b",
                          "488945984885c07507bac4020000eb2d6685db7505bbffff00000fb7d3488bc8448bca89542420448bc2488d058dc00000ff140785c0752cbad0020000488b8d",
                          "807c240c00894604740d85c0740583f8ff7504c64608008bc65ec20800568bf18b4e0433c085c9741083f9ff740bff74240851ff1598412f03807c240c007407",
                          "488906488bcb41ff542420488b064903e6eb17488bcb41ff5424384883f8087e06488b46f8eb034833c04883c420415e415c5f5e5bc300000000000000000000", 
                          "48898424f00300004883bc24f003000000750eff94248e030000898424f80300008b8c24fc030000ff942476030000eb30488d8c2440010000ff94249e030000", 
                          "8945f8837df80074658b45fc05601a0000508b4df8518b55fc8b8250170000ffd08945f4837df4007426b9010000006bd1008b45fc0fbe8c10641b000085c974",
                          "c6430c0148ba446a8e00f87f0000833a00740c48b998838d00f87f0000ff11488b5580488953104883c4785b5e5f415c415d415e415f5dc30000001910090010",
                          "48890550cf4700483bc30f849e010000488d15f0ab3800488bc8ff15a7173600488b0d30cf4700488d15c1ab380048890532cf4700ff158c173600488b0d15cf",
                          "4889842470020000488d0d1e5e1100ff15c0fc10004889442458488d0dfc5d1100ff15aefc100048898424a0020000488d15cf5d1100488b4c2458ff159cfc10",
                          "488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
                          "4885c0750bb8030000004883c4205bc3488d9318020000488bc8ff53084885c0750bb8040000004883c4205bc3488b4b10ffd033c04883c4205bc3cccccccccc",
                          "488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
                          "488b8d70ffffffc6410c01833d1479e65d007406ff1524cde55d488b8d70ffffff488b9528ffffff48895110488945b0ff1558ca1cfe8945c4488bcce8780000",
                          "4c8bd04889442458488d05345d00004803c6488d4c2458ffd084c07407bac3020000eb2d6685db7505bb102700000fb7d3488d053fbd0000448bca8954242044",
                          "86f285c00f94c28b9424c0020000a3302858048bc2b8000000000f90c00fa3d00f95c03ae084f48984245c0300000f94c4c0dc022b9c24bc0100008d049b0fa4",
                          "86f285c00f94c28b9424c0020000a33028*",
                          "49bbb01432c7fd7f000048b9*f0000ba0c0000004c8d4c2450448d423441ffd349bb403ed1c9fd7f*",
                          "488b4d98c6410c01833d*488b4d98488b9558ffffff4889511*",
                          "488944242848837c242800750bff9424be03000089442430eb27488d8c2470010000ff9424ce030000488944242848837c242800750bff9424be030000894424",
                          "4c8bf04885c00f84cc00000083fb027c22488d4c2458c74424585b57485dc744245c2047504166c74424600a00ff9570010000488d542468498bceff55384c8b",
                          "488bc84885c075098d41034883c4205bc3488b4308488d9318020000ffd04885c0750bb8040000004883c4205bc3488b4b10ffd033c04883c4205bc3cccc488b",
                          "48be84*7f0000488b064889074883c6084883c708488b06488907415f415e415d415c415b415a415941585f5e5d5c5b5*",
                          "488d15d1832000488bc8ff1590651700488905a1a7280048833d99a72800000f84ab000000488d1524010000488d0d85a72800e8483a120085c0754be87f79f1",
                          "8bd8488d8d28ffffffff159fb9010083fb6f0f85d00100008b4db8ff154dbf0100488945b0488d55b848895580488b4db048894d88488d8d28ffffffff1564b9",
                          "8bf8689c2*02ffd689458068902*",
                          "8bf86*ffd689458068*",
                          "5356578965e880*6a015b0f85f502000088*",
                          "8945a88b7b0c037ddc8bf7ac84c07*",
                          "8bf08b45d8c6400801833d8011*8945ec33c9894de08b4dece*",
                          "c0d60285c086d6a39000*c1ea1bf6d28bc30fb6d22b8424e00100004a8ad3",
                          "411bd5a3900*fbec375218ae0fec6039c24a0010000f7dac784",
                          "c6470401833de*48894f084883c4785b5e5f415c415d415e415f5dc31910090010e20c300b",
                          "89854d294400c78551294400000000008b95d83044008b0685c075038b461003c20385512944008b188b7e1003fa03bd5129440085db0f84a2000000f7c30000",
                          "c22800cccccccccccc8b4424148b5424108b0d08a92d05508b442410528b542410508b44241081c1ac080000528b11508b4224ffd0ffd0c21400cccccccccccc",
                          "488944242848837c242800750bff9424ae03000089442430eb27488d8c2460010000ff9424be030000488944242848837c242800750bff9424ae030000894424",
                          "a36c3e*85c00f84f9000000568b3548*",
                          "8bd885db0f8440020000895e148d45c08b0d1c16*",
                          "898307100000c78303100000010000006a0056ff9313280000ff930728000050ff930f280000cc8b1c24c38da424000000008da424000000008da42400000000",
                          "488905fc764c00483bc30f84a5010000488d1504803d00488bc8ff1593253b00488b0ddc764c00488d15d57f3d00488905de764c00ff1578253b00488b0dc176", 
                          "898307100000c78303100000010000006a0056ff9313280000ff930728000050ff930f280000cc8b1c24c38da424000000008da424000000008da42400000000"))]
  until [process where event.action == "end"]
Raw source Network Module Loaded from Suspicious Unbacked Memory · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = """
Identifies the load of a Windows network module by a process where the creating thread's stack contains frames pointing
outside any known executable image. This may indicate evasion via process injection.
"""
id = "aa265fbd-4c57-46ff-9e89-0635101cc50d"
license = "Elastic License v2"
name = "Network Module Loaded from Suspicious Unbacked Memory"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/pikabot-i-choose-you",
    "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus",
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.62"

query = '''
sequence by process.entity_id
 [process where event.action == "start" and process.parent.executable != null and

  not process.Ext.token.integrity_level_name == "low" and

  not user.id in ("S-1-5-19", "S-1-5-20") and

  not (process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "?:\\ProgramData\\*", "?:\\Users\\*\\AppData\\*") and
       process.code_signature.trusted == true) and
       
  not (process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and process.Ext.relative_file_creation_time >= 80000) and 
  
  not process.executable : ("?:\\Windows\\Microsoft.NET\\Framework*\\NGenTask.exe", "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe") and

  not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe" and
       process.parent.executable : "?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe") and 

  not (process.executable : "?:\\WINDOWS\\SysWOW64\\DWRCS.EXE" and
       process.parent.executable : "?:\\WINDOWS\\SysWOW64\\DWRCS.EXE" and process.parent.args : "-service") and 

  not (process.executable : "?:\\Windows\\System32\\LogonUI.exe" and 
       process.parent.executable : "?:\\Windows\\System32\\winlogon.exe") and 

  not (process.executable : "?:\\Windows\\SysWOW64\\icacls.exe" and 
       process.args : "?:\\Program Files\\Tenable\\Nessus Agent\\*" and 
       process.parent.executable : "?:\\Windows\\SysWOW64\\msiexec.exe") and 

  not (process.name : "rundll32.exe" and
       process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and
       process.parent.executable : "?:\\Windows\\sys*\\msiexec.exe") and

  not (process.name : "rundll32.exe" and process.command_line : "*PcaSvc.dll,PcaPatchSdbTask*" and
       user.id == "S-1-5-18" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and

  not (process.code_signature.subject_name :
                    ("Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "YANDEX LLC", "ConnectWise, Inc.",
                     "Brave Software, Inc.", "Opera Norway AS", "GitHub, Inc.", "Stefan Ries", "JetBrains s.r.o.",
                     "Intel(R) Rapid Storage Technology", "Waves Inc", "Dell Inc", "Lenovo", "DameWare Development, LLC.",
                     "Essential Objects, Inc*", "HP Inc.", "Aina Maximit Oy", "Logitech Inc", "N-ABLE TECHNOLOGIES LTD", 
                     "Cognizant TriZetto Software Group, Inc.", "win.acme.simple@gmail.com", "Crownalytics, LLC", 
                     "Kodak Alaris Inc.", "JAM Software GmbH", "UBISOFT ENTERTAINMENT INC.", "DASSAULT SYSTEMES SE", 
                     "Link Data Security A/S", "Western Digital Technologies, Inc.", "Rockstar Games, Inc.",
                     "SEMPERIS INC.", "Micro-Star International CO., LTD.", "Kaseya Holdings Inc", "KASEYA US LLC",
                     "Intel(R) Software Development Products", "AAC Infotray AG",
                     "CORE.AI SCIENTIFIC TECHNOLOGIES PRIVATE LIMITED", "ClaimMaster Software LLC", "Cellebrite DI LTD",
                     "Riot Games, Inc.", "Autodesk, Inc.", "ACCA software S.p.A.", "Tempus Technologies, Inc.",
                     "NextgenId, Inc.", "Cloud Software Group, Inc.",
                     "Bloomberg LP", "GEO NETWORK SRL", "Geo Network - S.R.L.",
                     "FARO Technologies Inc", "Axis Communications AB", "EWA Technologies, Inc.") and
       process.code_signature.trusted == true) and

  not (process.pe.original_file_name in~ ("msedge.exe", "msedgewebview2.exe") and
       process.code_signature.subject_name like "Microsoft *" and process.code_signature.trusted == true) and

  not (process.executable : "?:\\Windows\\System32\\Essentials\\SharedServiceHost.exe" and
       process.parent.executable : "?:\\Windows\\System32\\services.exe") and

  not (process.name : "powershell.exe" and
       process.parent.executable : "?:\\Program Files (x86)\\Lenovo\\VantageService\\*\\LenovoVantage-(LenovoSystemUpdateAddin).exe") and
  not process.pe.imphash in ("d41d8cd98f00b204e9800998ecf8427e", "45e4653ae633e067079dd72666b0158b") and
  not process.hash.sha256 in
                   ("35542bc04fbfa2e3ef68837640e0459c6f99729c0c73578c08ab351cdf030696",
                    "1005dcfddfbde91cc967ecc6d778c81cb4f7bede03121a3e6e0d9bae12a033e0",
                    "53cec44e4fc9a3477d264c5edc9e376af8fcca20853faa289387f5bd7eaae05f",
                    "49113f4cd7bbf3343a43b13edd745008c4f41da1d80c9f89dc90a4b0bb39b8f8",
                    "0ab8a14e7fd42818608cc0916fc26a12b2ae6b976c97310dc86011713e455d2d",
                    "afa3dc1ecd4e15a869dc57a280aee930fc0bab1cd49e17afd3944ae4ad1fc91f",
                    "18b177280b0e0e05aa0e26807f34634c3384ae4f5901f41ff5bb0a720ea5c106",
                    "4f1528318085f6117734a27f34a317a83b096d55532000f81ed67b1bb10632fa",
                    "35f210c1f941f917b81c2516bee9de8f0495baca42095685e9b0b76f67250dc9",
                    "edef301528767963f460bf7fe497ca3b5c648627a2d13abe74d5544578b56bd4",
                    "f856a3c582ca689bdea3e784ef6a0db37011bd5ebb31d7c79d0328ebfcf6d8a4",
                    "fe62ba0a61191a9b54aab7ba3221479c451b042fa30a08957cacff84ddfe094b",
                    "183cd12fbdd93aa785d3793a8872c4a9730dd154f6482c39f94552e556a7b4e9",
                    "ed6c844c72fccd7e7799d448f5e74df368cafd2631858573e6e29110c213ac79",
                    "43a84e01b5ddecf0b6297277d53c72025a73b00b9f0073933a700695a240b5e8",
                    "f4cb2a001dcee0577046c56df5adfe989bc875c29ecfe27c9569849a9a6f0671",
                    "ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
                    "51346e95656164783ae4de9d6b202f28be87358eb0e056d2d7cdd12b502d30e7",
                    "889cb8827a400984bea2e0561a1efbf9d18044e879974da8baa750a0c63748c6",
                    "96dcdb449ab48b21b6efd33afc59ae163dea5fc597ffaf5dd7030b20d2624467", 
                    "43714f0fc5cea25a6ee936fd36a83f86a45f61447c16c8e9255ef317089ce39c", 
                    "52a5036d1578a6b899fb5d14fd3ab12af463e94ac791d1dddb22b7e8cc1f4bd7", 
                    "f5f15ab19171dbcb58e757cd6446be41e04adf00797d712b07e544066ecd3c67", 
                    "49b95a804337ee7e12092cc7a13c2eb6c3acb33f9bbaac8e820b9184063642f2", 
                    "4c974212f5fc3720d58a8df6c2b9587b85949edc676f9f82921c04f067c261f1", 
                    "ed3730a3436454022e8cf1a27569babef8c9c348ea875f1df80cba9b743365c9",
                    "121a4e78abe13c92a7ff91d2e91bc98173724072cc891ecbbc10765e8d5bd024", 
                    "54e55d6da825d709cf495eb18be10d8cbb92ac1904c1359999d53d3fa42161e2",
                    "07e79814fde31ff5968d5c0448014d931cd3a2e59b2ac841bc53a155c333a1b9",
                    "afcee50eace500b9b2c3dc4faab371fd040d769ba3a5197ef3a8762fe5457337",
                    "e7883c7d57f5cfe7d1649ab138f62f5042f7acda8ed3c8664c9335c3ddba85c4",
                    "8982729121fa3b3e6c283437f5832916a5a3611374ac848368c6edaae5086257",
                    "63f2a4be0dfbaf2b9740aa5c2320d0290451d6d5581cc6f8e183ced9ea796d95",
                    "30534b04d137543932bc0e66fc778d772ca5d90c0b5faec74a842cad8d50ade8",
                    "fc0ea005db332feec00e6c34e36de85469d24074c8af23cea84b72eb0fa7fb85",
                    "cffea8d18419170baded53d75a8d1b8d20170c21ef2d4bebddfb2efcb89a641c",
                    "ca52dce8cc2aecc23138a524683ad608b4a5eaed9a7a10336e4cf6c7b9d6e5e0",
                    "b4aa6923bd807af4433c968aa1ded17a3bf8e36f1053fe24dc31dd5a8eb9f4ce",
                    "4acdfb075f5a801b976819cd22bc3a930ad5f8ee92de2d5ad36b0a4f1e5a8b24",
                    "1c237e9015c81487aa67d56f8aa4788fbb6bfb3039e455485376712cfc978e62",
                    "47585eb41299f97c88028c3dae3ba6049355b8e0a8074abeae9f4f9381832c20",
                    "a26dfec1922d751c710a2f2ab16a33facb6fef8997d21784681f1be637a78b5d",
                    "be92c45eeb7ffb4b3bf62b76b3218a0c4cdcfa52c8ddb5a47b9abc407dda282e") and

  not (process.executable : "?:\\Windows\\SysWOW64\\dllhost.exe" and process.parent.name : "svchost.exe" and
       process.Ext.effective_parent.executable : "?:\\Program Files (x86)\\Skillbrains\\lightshot\\*\\Lightshot.exe") and

  not (process.executable : ("?:\\Windows\\SysWOW64\\DWRCST.EXE", "?:\\Windows\\SysWOW64\\DWRCS.EXE") and
       process.parent.executable : ("?:\\WINDOWS\\SysWOW64\\runonce.exe", "?:\\Windows\\SysWOW64\\DWRCST.EXE", "?:\\Windows\\SysWOW64\\DWRCS.EXE")) and

  not (process.executable : "?:\\Windows\\system32\\winsat.exe" and
       process.parent.executable : "?:\\Windows\\system32\\rundll32.exe" and
       process.parent.args : "sysmain.dll,PfSvWsSwapAssessmentTask") and

  not (process.executable :  "?:\\Windows\\System32\\inetsrv\\w3wp.exe" and
       process.parent.executable : ("?:\\Windows\\System32\\inetsrv\\w3wp.exe", "?:\\Windows\\System32\\svchost.exe")) and

  not (process.name : "rundll32.exe" and process.args : "--no-sandbox" and
        _arraysearch(process.parent.thread.Ext.call_stack, $entry,
                     $entry.symbol_info : "?:\\Windows\\assembly\\NativeImages_*\\EO.Base\\*\\EO.Base.ni.dll*")) and

  not process.parent.executable : ("?:\\Program Files (x86)\\Advanced Monitoring Agent\\featureres\\PMESetup.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\featureres\\PMESetup.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\downloads\\NetworkManagementInstall.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\staging\\_new_setup.exe",
                                    "?:\\PROGRA~2\\ADVANC~1\\downloads\\MAV-Installer.exe",
                                    "?:\\Program Files (x86)\\LiongardInc\\*\\node.exe",
                                    "C:\\WINDOWS\\_ScriptingFramework\\Modul\\Engine.exe",
                                    "C:\\Program Files\\IperiusRemote\\GlantzSupportClient.exe",
                                    "C:\\Program Files (x86)\\ReluxDesktop\\converter\\Raster2Vector.exe",
                                    "C:\\Program Files (x86)\\Assinador Serpro\\uninstall.exe") and
  not (process.executable : "C:\\Windows\\Microsoft.NET\\Framework\\*\\RegAsm.exe" and
       process.args : "C:\\Program Files (x86)\\Common Files\\PortsRanch\\WenuMeta\\Micriuuft_Inroles.dll" and
       process.parent.executable : "C:\\WINDOWS\\system32\\svchost.exe") and

  not process.executable :
                  ("C:\\Program Files (x86)\\MultiExtractor\\MultiExtractor.exe",
                   "C:\\Program Files (x86)\\Naverisk\\Agent\\Packages\\SoftwareScanPackage\\SoftwareScanner\\Naverisk.Agent.SoftwareScanner.exe") and

  not (process.executable : "?:\\APP\\d3\\nats\\NatsCtl.exe" and process.parent.executable : "?:\\APP\\d3\\procmgr\\dserver.exe" and
       process.code_signature.trusted == true and process.code_signature.subject_name : "d.velop AG") and

  not (process.executable : "*\\PeaxactLicenseServerMonitor.exe" and
       process.code_signature.subject_name == "S-PACT GmbH" and
       process.code_signature.trusted == true)
 ]
 [library where
  dll.name in~ ("ws2_32.dll", "wininet.dll", "winhttp.dll") and
  process.thread.Ext.call_stack_contains_unbacked == true and
  (
   process.thread.Ext.call_stack_summary in
                  ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|kernelbase.dll|Unbacked",
                   "ntdll.dll|iphlpapi.dll|Unbacked",
                   "ntdll.dll|winhttp.dll|Unbacked",
                   "ntdll.dll|kernelbase.dll|wininet.dll|Unbacked",
                   "ntdll.dll|kernelbase.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|wininet.dll|Unbacked|ntdll.dll",
                   "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|Unbacked|kernel32.dll|ntdll.dll",
                   "ntdll.dll|kernelbase.dll|Unbacked|kernelbase.dll|ntdll.dll|kernel32.dll|ntdll.dll") or
  
  startswith~(process.thread.Ext.call_stack_summary, concat(concat("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|", process.name), "|kernel32.dll|ntdll.dll"))
  ) and
  /* DynTrace, HP Sure Click Hook Dll */
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_leading_bytes :
                         ("*6764a118008b40243b835b080000753033c089835b0800008d835f080000508d8353000000506a006a00ff936b080000*",
                          "45fc33c08945f88bf28dbd82fcffffb9dc000000f3a566a568008000006a0052ff55b86803800000ff55bc8bf080bd82fcffff0074188d8592fdffff50ff55c4",
                          "*d74533db4c8b4d504c894d284c8d0d0f0000004c894d404c8b4d6041c6410c00ffd0*",
                          "83ec28488b4c2430ff15b40f00004883c428c3cccccccccccccc4c894424188954241048894c24084883ec38837c244801755f488d0d701f0000ff15720f0000",
                          "55c0488d55c0488b4d10e8886dadff488bc8488975b8488b55b0488b5220488b02488bd64533db4c8b45b04c8945804c8d050a0000004c894598c6470c00ffd0", 
                          "488bcd48894da8488d8d78ffffff48894b10488975c0488b4db8488b4920488b01488bcf488bd64c8b45b84c8945884c8d050a0000004c8945a0c6430c00ffd0",
                          "80000000c7858c00000001000000488b4d50488b4920488b01488b8d800000004533db488b555048895528488d150e00000048895540488b5560c6420c00ffd0")) and
  /* Managed Code, Cynet MemScanner, xSecuritas */
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_trailing_bytes :
                         ("*8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b*",
                          "c6430c01833d*5f007406ff1*",
                          "48898424e80300004883bc24e803000000750eff94247e030000898424f0030000eb30488d8c2430010000ff94248e03000048898424e80300004883bc24e803",
                          "8bd885db751eff55c88945f8eb168d8592fdffff50ff55d08bd885db7506ff55c88945f856ff55bc85db0f847601000080bd82fcffff0074508b45fc05a00000",
                          "488b55a8c6420c01833d8bbeb25f007406ff1593c7b25f8945b4488bcce82c000000908b45b4488b55a8c6420c01488b55a8488b8d70ffffff48894a10488d65",
                          "**45a848894590eb00488b4590488b5588c6420c01488b5588",
                          "*488b5560c6420c01488b5560488b4d2048894a",
                          "c6470c01833d6cf1b45f007406ff15f40cb45f8bf0e8b5e76f5f85f6400f95c6400fb6f64883bdc0000000007423488b8dc0000000e825ebe25e448bc0488b95",
                          "488b5560c6420c01833db339f55f007406ff153b43f55f898584000000488b4d00e845000000908b8584000000488b5560c6420c01488b5560488b4d2048894a",
                          "898383080000c7837f080000010000006a0056ff9397080000ff938b*",
                          "41c64?0c01833d*",
                          "c6430c0148ba*f87f0000833a00740c*",
                          "488b8d70ffffffc6410*",
                          "c6470c01833d*",
                          "a3b8eb*",
                          "a314a2e40585c*",
                          "488b9570ffffffc6420*",
                          "49bb60c0*",
                          "488b8d?0ffffffc6410401833d*",
                          "488b8d?0ffffffc6410401833d*",
                          "488b5590c6420c01833d*",
                          "8bf08b45d8c6400801833d801*45e88945dc8b45dc8b55",
                          "c6470401833de8eee*84883c4785b5e5f415c415d415e415f5dc31910090010e20c300b",
                          "49bb80b681f6fc7f000048*7f0000ba0c0000004c8d4c2450448d423441ffd3*",
                          "488b4d88c6410c01*488945a0488b45a0488945a8909090*",
                          "ebfecc0000*",
                          "*ba0c0000004c8d4c2450448d423441ffd3*",
                          "*ca85c0b8000000000fb6d60f95c0898424f40200000ac22b742458d0d80fb6c0*",
                          "*898424300300008d14922b9c24d0010000f7d28bc3034424600fbbc20facc2183b44240892",
                          "41c6460c0148ba*7f0000833a00740c*",
                          "8be55d558bec83ec08c745f800000000*",
                          "48898424b80000004883bc24b8000000000f848d000000488b442440480510130000488bd0488b8c24b8000000ff94249000000048898424d80000004883bc24", 
                          "898383080000c7837f080000010000006a0056ff9397080000ff938b08000050ff9393080000cc8b1c24c3ce0000087c00960046003a005c00500072006f0067", 
                          "488944242048837c24200075*", 
                          "c6430c01833d*",
                          "c22800ccccff7424248b0d5c93*",
                          "a36c3e*985c00f84f9000000568b35*",
                          "a3b022*985c00f84f9000000568b354c81*",
                          "48898424b80000004883bc24b8000000000f8498000000488b442440480510130000488bd0488b8c24b8000000ff94249000000048898424d80000004883bc24",                          "*0000ba0c0000004c8d4c2450448d423441ffd3*",
                          "41c6470c0148ba*7f0000833a00740c48b9*",
                          "41c6470c0148ba*4c8b6d8849897508498bc5488b9548ffffff498957104881",
                          "c6460c01833db6e5e75f007406ff15eae8e65f488bd8e8aa38b25f488bc3488b4d8048894e104883c4785b5e5f415c415d415e415f5dc367611910090010e20c",
                          "49bb60c05eb7ff7f000048b9*",
                          "488945984885c07507bac4020000eb2d6685db750*",
                          "*488b5588498956104883c4785b5e5f415c415d415e",
                          "c6460c01833d*",
                          "898383080000c7837f080000010000006a0056ff9397080000*",
                          "8be55d558bec83ec08c745f800000000c745fc02000000*",
                          "898383080000c7837f080000010000006a0056ff*",
                          "49bbb014*f0000ba0c0000004c8d4c2450448d423441ffd349bb403*",
                          "*00ba0c0000004c8d4c2450448d423441ffd349bb*",
                          "*48bf7063107ef67f0000488b064889074883c6084883c708488b06488907415f415e415d415c41*",
                          "1bd1a3300a*f9bc00fa3cab8000000000f98c28d14400f95c00fca0fca8984242403*",
                          "84c07507e8b8836effeb498b45f88b55c089108b45e48945f4c70518c*",
                          "488b8d70ffffffc6410c01833df07bca5e007406ff15a47fc95e488b8d70ffffff488b9528ffffff48895110488945b0ff15804ce6fe8945c4488bcce8780000",
                          "498bd7488bcf4c8be8e819bbffff4533ff4d85ed0f84520200004c8b9760020000488d95e0000000440fb74424744533c9498bcd41ffd24c8be04885c00f8420",
                          "488943384885c07512ff15035608004c8d054ce80800e93fffffff4c3973407438663b6b1c7511488b5330488bcfff15d65a080085c07421488b4b40ff157857",
                          "89434885c07507f0ff054b360c000f57c04489bb2c0200004c89bb400200004c89bb480200004489bb500200000f1183580200000f1183680200000f11837802",
                          "488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
                          "c6430c0148ba446a76e3fd7f0000833a00740c48b9988375e3fd7f0000ff11488b5580488953104883c4785b5e5f415c415d415e415f5dc30000001910090010",
                          "f7d20fca85c08af3a37002f103b8000000000fca0f95c01af08984243803000033b424e001000003c60fc8e9a50100004a8bc6c1ea0b8d94248c01000003023b",
                          "488945984885c07507bac4020000eb2d6685db7505bbffff00000fb7d3488bc8448bca89542420448bc2488d058dc00000ff140785c0752cbad0020000488b8d",
                          "807c240c00894604740d85c0740583f8ff7504c64608008bc65ec20800568bf18b4e0433c085c9741083f9ff740bff74240851ff1598412f03807c240c007407",
                          "488906488bcb41ff542420488b064903e6eb17488bcb41ff5424384883f8087e06488b46f8eb034833c04883c420415e415c5f5e5bc300000000000000000000", 
                          "48898424f00300004883bc24f003000000750eff94248e030000898424f80300008b8c24fc030000ff942476030000eb30488d8c2440010000ff94249e030000", 
                          "8945f8837df80074658b45fc05601a0000508b4df8518b55fc8b8250170000ffd08945f4837df4007426b9010000006bd1008b45fc0fbe8c10641b000085c974",
                          "c6430c0148ba446a8e00f87f0000833a00740c48b998838d00f87f0000ff11488b5580488953104883c4785b5e5f415c415d415e415f5dc30000001910090010",
                          "48890550cf4700483bc30f849e010000488d15f0ab3800488bc8ff15a7173600488b0d30cf4700488d15c1ab380048890532cf4700ff158c173600488b0d15cf",
                          "4889842470020000488d0d1e5e1100ff15c0fc10004889442458488d0dfc5d1100ff15aefc100048898424a0020000488d15cf5d1100488b4c2458ff159cfc10",
                          "488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
                          "4885c0750bb8030000004883c4205bc3488d9318020000488bc8ff53084885c0750bb8040000004883c4205bc3488b4b10ffd033c04883c4205bc3cccccccccc",
                          "488944242048837c242000750e488d0d7e0f0000e8a1ffffffeb37488d15980f0000488b4c2420ff153d0f0000488944242848837c242800750e488d0d910f00",
                          "488b8d70ffffffc6410c01833d1479e65d007406ff1524cde55d488b8d70ffffff488b9528ffffff48895110488945b0ff1558ca1cfe8945c4488bcce8780000",
                          "4c8bd04889442458488d05345d00004803c6488d4c2458ffd084c07407bac3020000eb2d6685db7505bb102700000fb7d3488d053fbd0000448bca8954242044",
                          "86f285c00f94c28b9424c0020000a3302858048bc2b8000000000f90c00fa3d00f95c03ae084f48984245c0300000f94c4c0dc022b9c24bc0100008d049b0fa4",
                          "86f285c00f94c28b9424c0020000a33028*",
                          "49bbb01432c7fd7f000048b9*f0000ba0c0000004c8d4c2450448d423441ffd349bb403ed1c9fd7f*",
                          "488b4d98c6410c01833d*488b4d98488b9558ffffff4889511*",
                          "488944242848837c242800750bff9424be03000089442430eb27488d8c2470010000ff9424ce030000488944242848837c242800750bff9424be030000894424",
                          "4c8bf04885c00f84cc00000083fb027c22488d4c2458c74424585b57485dc744245c2047504166c74424600a00ff9570010000488d542468498bceff55384c8b",
                          "488bc84885c075098d41034883c4205bc3488b4308488d9318020000ffd04885c0750bb8040000004883c4205bc3488b4b10ffd033c04883c4205bc3cccc488b",
                          "48be84*7f0000488b064889074883c6084883c708488b06488907415f415e415d415c415b415a415941585f5e5d5c5b5*",
                          "488d15d1832000488bc8ff1590651700488905a1a7280048833d99a72800000f84ab000000488d1524010000488d0d85a72800e8483a120085c0754be87f79f1",
                          "8bd8488d8d28ffffffff159fb9010083fb6f0f85d00100008b4db8ff154dbf0100488945b0488d55b848895580488b4db048894d88488d8d28ffffffff1564b9",
                          "8bf8689c2*02ffd689458068902*",
                          "8bf86*ffd689458068*",
                          "5356578965e880*6a015b0f85f502000088*",
                          "8945a88b7b0c037ddc8bf7ac84c07*",
                          "8bf08b45d8c6400801833d8011*8945ec33c9894de08b4dece*",
                          "c0d60285c086d6a39000*c1ea1bf6d28bc30fb6d22b8424e00100004a8ad3",
                          "411bd5a3900*fbec375218ae0fec6039c24a0010000f7dac784",
                          "c6470401833de*48894f084883c4785b5e5f415c415d415e415f5dc31910090010e20c300b",
                          "89854d294400c78551294400000000008b95d83044008b0685c075038b461003c20385512944008b188b7e1003fa03bd5129440085db0f84a2000000f7c30000",
                          "c22800cccccccccccc8b4424148b5424108b0d08a92d05508b442410528b542410508b44241081c1ac080000528b11508b4224ffd0ffd0c21400cccccccccccc",
                          "488944242848837c242800750bff9424ae03000089442430eb27488d8c2460010000ff9424be030000488944242848837c242800750bff9424ae030000894424",
                          "a36c3e*85c00f84f9000000568b3548*",
                          "8bd885db0f8440020000895e148d45c08b0d1c16*",
                          "898307100000c78303100000010000006a0056ff9313280000ff930728000050ff930f280000cc8b1c24c38da424000000008da424000000008da42400000000",
                          "488905fc764c00483bc30f84a5010000488d1504803d00488bc8ff1593253b00488b0ddc764c00488d15d57f3d00488905de764c00ff1578253b00488b0dc176", 
                          "898307100000c78303100000010000006a0056ff9313280000ff930728000050ff930f280000cc8b1c24c38da424000000008da424000000008da42400000000"))]
  until [process where event.action == "end"]
'''

min_endpoint_version = "8.8.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.8.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.