Remote Thread Context Manipulation

Description

Identifies potential remote process manipulation using SetThreadContext API. This may indicate an attempt to inject code or debug a remote process.

Query · eql

api where 
  process.Ext.api.name : ("SetThreadContext", "Wow64SetThreadContext") and 
  process.executable != null and 
  ((process.Ext.api.behaviors == "cross-process" and process.Ext.api.behaviors == "execute_shellcode") or process.Ext.api.behaviors == "hardware_breakpoint_set") and
  not process.Ext.api.summary : "*OSError*" and process.thread.Ext.call_stack_final_user_module.name != null and
  (process.thread.Ext.call_stack_final_user_module.hash.sha256 like "?*" or
   process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|Unbacked") and
  not (process.code_signature.subject_name :
               ("Duncan Ogilvie", "International Business Machines Corporation", "COGNOSPHERE PTE. LTD.",
                "CAPCOM CO., LTD.", "Larian Studios Games Ltd.", "Valve Corp.", "Rockstar Games, Inc.",
                "Johannes Schindelin", "Unity Technologies ApS",
                "Paradox Interactive AB (publ)", "CD PROJEKT SPÓŁKA AKCYJNA", "JetBrains s.r.o.",
                "Open Source Developer, Maksim Moisiuk", "Take-Two Interactive Software, Inc.",
                "Facepunch Studios Ltd", "Nox Limited", "Maksim Moisiuk",
                "Activision Publishing Inc", "OpenJS Foundation", "Ubisoft Entertainment Sweden AB", 
                "Epic Games Inc.", "NEXON Korea Corporation.", "Molotov", "Agilebits", "Gaijin Network Ltd", "Open Source Developer, Duncan Ogilvie",
                "COMPUTACION EN ACCION SA DE CV", "MPTronic", "Docker Inc", "Embark Studios AB", "Piriform Software Ltd", "Unity Technologies SF") and
      process.code_signature.trusted == true) and 
 not process.thread.Ext.call_stack_final_user_module.name like ("Kernel", "Unknown", "dbgeng.dll", "Undetermined") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Kernel", "kernel|*") and
 not (process.code_signature.trusted == true and stringcontains~(process.executable, process.thread.Ext.call_stack_final_user_module.path)) and 
 not process.thread.Ext.call_stack_final_user_module.path : 
                                               ("?:\\Program Files\\*", 
                                                "?:\\Program Files (x86)\\*", 
                                                "\\Program Files\\*", 
                                                "\\Program Files (x86)\\*") and 
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                        ("31f65b7afe91e23ae88d8229fd54c5eb494ffd4594bdc3d6a91d2d69892b284b",
                         "766ac0f768c5b2acb19ecb8cf179c59d56b74d71437f5d1331408d9c827cfde8",
                         "67ca92cc7beea130c6f7e8f3982f3256f1724f22c6de869a884df47dcc0b7b95",
                         "b6a39ef455952471c935ea190a78eecf423fba2a49ffce1afdf737d58bb2c9d3",
                         "062a170de010b5be0840dd92a9ad43da1d1e09738956cffce78368305afe885b",
                         "2c5e3525840ef01510583ecc37f876791b2d6e73fbe8099c93ab0f5787ba626d",
                         "655d6df92eef4c947498456d40b7856cbe72ede8c6432072f968207817825b52",
                         "8b451b88d2cc91b079251e2347abb84d2b09712512fa9e57d9de35e93c751863",
                         "615ac4399eed0a26e5cd9bba4e7dcf661400fb0546dce067523fe275351d3b04",
                         "22a8ae4f904366c8f42d8da22df28c755cefd28ab34268c77275229964e34c66",
                         "6957d81c1fb22b7a2c88dd63f1c99a777805d13e0d0af6411a46c1f40e8b22e9",
                         "2dfa7a9d8be474447f8ea53dc864a5bb8cdcc526664636154adfa8b71386f883",
                         "e3fdcd2b4c5215e74b0cabe91ce7fe2800cbf8e2a28157342960bca61bbd6b5d",
                         "f1b668a9cca5c832ae8374c1815cfc8fcb452d05268797f0c022d74000ecd486",
                         "c0a45f327f40cf8cdc79dc9cccf858ae862a6df0a26c83141cb3c24fc604b483",
                         "8fb6e0cd1c0d01157ee1a87da9e894f7451988a5349cff5d99f2d3d9c6ffc397",
                         "4c6bbe178708b9590be27d8423261d6c1abfcdfe6cf90df1654ff60033a48bee",
                         "7eda2d6011ed2dae3f0c2ec30bdd2ae0c0146bf1baaa827dccb002b6ad793820",
                         "60ac461ca948a8a26dc3013d3b30fa615666b0d3fe8f5014dfd39a5de5440868",
                         "1165eb20cab73c780b439fdbea3fd9c6545f1d5488bf6c6194bf4dd49450f618",
                         "79ab757eaf9d745e9da693510c58b180ac45d6450d8df2260826c285bfe0f2de") and
 not process.executable : ("D:\\laragon\\bin\\php\\php-8.0.25-nts-Win32-vs16-x64\\php.exe", 
                           "D:\\laragon\\bin\\php\\php-8.2.4-nts-Win32-vs16-x64\\php.exe", 
                           "Z:\\SteamLibrary\\steamapps\\common\\*.exe",
                           "D:\\SteamLibrary\\steamapps\\common\\*.exe",
                           "D:\\Steam\\steamapps\\common\\*.exe",
                           "D:\\Visual Studio\\Common7\\IDE\\devenv.exe",
                           "?:\\Program Files\\DebugDiag\\DbgHost.exe",
                           "?:\\Program Files\\Git\\usr\\bin\\env.exe",
                           "?:\\Program Files\\Microsoft Visual Studio*\\Common?\\IDE\\*.exe",
                           "?:\\Program Files (x86)\\Microsoft Visual Studio*\\Common?\\IDE\\*.exe",
                           "?:\\Program Files (x86)\\Steam\\steamapps\\common\\*.exe",
                           "?:\\Program Files\\Microsoft Visual Studio\\2022\\Professional\\Common7\\IDE\\devenv.exe",
                           "?:\\Program Files (x86)\\WinHex 19.6 Portable\\WinHex64.exe",
                           "?:\\Program Files\\JetBrains\\*\\plugins\\go\\lib\\dlv\\windows\\dlv.exe") and
 not process.parent.executable :
                     ("?:\\Program Files\\cmder\\vendor\\conemu-maximus?\\ConEmu\\ConEmuC64.exe",
                      "C:\\Program Files (x86)\\GitExtensions\\ConEmu\\ConEmuC64.exe",
                      "C:\\Program Files\\Git\\mingw64\\libexec\\git-core\\git-remote-https.exe",
                      "C:\\Program Files\\Git\\usr\\bin\\bash.exe") and
 not (process.name : ("cmd.exe", "powershell.exe", "csc.exe") and
      _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection_provenance : "conemuhk64.dll*")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info : ("?:\\program files (x86)\\steam\\gameoverlayrenderer64.dll*",
                                        "?:\\program files\\windowsapps\\microsoft.windbg*\\amd64\\dbgeng.dll!DebugCreateEx*",
                                        "*\\vsdebugeng.impl.dll!ImplDllCreateInstance*",
                                        "?:\\program files\\windowsapps\\dolbylaboratories.dolbyaccess_*\\dlls\\x64\\dolbyaudioprocessing.dll*",
                                        "?:\\program files\\windowsapps\\pythonsoftwarefoundation.python.*\\dlls\\sqlite3.dll!sqlite?_enable_shared_cache*",
                                        "?:\\windows\\systemapps\\microsoft.windows.contentdeliverymanager_*\\contentdeliverymanager.background.dll!*")) and
 not process.thread.Ext.call_stack_summary : ("ntdll.dll|kernelbase.dll|gdb.exe|kernel32.dll|ntdll.dll", "ntdll.dll|bcrypt.dll") and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
                                          "Microsoft Windows Software Compatibility Publisher",
                                          "Valve Corp."))
Raw source Remote Thread Context Manipulation · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = """
Identifies potential remote process manipulation using SetThreadContext API. This may indicate an attempt to inject code
or debug a remote process.
"""
id = "c456266f-e920-4acb-9b32-711fa7b94ca5"
license = "Elastic License v2"
name = "Remote Thread Context Manipulation"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/doubling-down-etw-callstacks"]
version = "1.0.30"

query = '''
api where 
  process.Ext.api.name : ("SetThreadContext", "Wow64SetThreadContext") and 
  process.executable != null and 
  ((process.Ext.api.behaviors == "cross-process" and process.Ext.api.behaviors == "execute_shellcode") or process.Ext.api.behaviors == "hardware_breakpoint_set") and
  not process.Ext.api.summary : "*OSError*" and process.thread.Ext.call_stack_final_user_module.name != null and
  (process.thread.Ext.call_stack_final_user_module.hash.sha256 like "?*" or
   process.thread.Ext.call_stack_summary == "ntdll.dll|kernelbase.dll|Unbacked") and
  not (process.code_signature.subject_name :
               ("Duncan Ogilvie", "International Business Machines Corporation", "COGNOSPHERE PTE. LTD.",
                "CAPCOM CO., LTD.", "Larian Studios Games Ltd.", "Valve Corp.", "Rockstar Games, Inc.",
                "Johannes Schindelin", "Unity Technologies ApS",
                "Paradox Interactive AB (publ)", "CD PROJEKT SPÓŁKA AKCYJNA", "JetBrains s.r.o.",
                "Open Source Developer, Maksim Moisiuk", "Take-Two Interactive Software, Inc.",
                "Facepunch Studios Ltd", "Nox Limited", "Maksim Moisiuk",
                "Activision Publishing Inc", "OpenJS Foundation", "Ubisoft Entertainment Sweden AB", 
                "Epic Games Inc.", "NEXON Korea Corporation.", "Molotov", "Agilebits", "Gaijin Network Ltd", "Open Source Developer, Duncan Ogilvie",
                "COMPUTACION EN ACCION SA DE CV", "MPTronic", "Docker Inc", "Embark Studios AB", "Piriform Software Ltd", "Unity Technologies SF") and
      process.code_signature.trusted == true) and 
 not process.thread.Ext.call_stack_final_user_module.name like ("Kernel", "Unknown", "dbgeng.dll", "Undetermined") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Kernel", "kernel|*") and
 not (process.code_signature.trusted == true and stringcontains~(process.executable, process.thread.Ext.call_stack_final_user_module.path)) and 
 not process.thread.Ext.call_stack_final_user_module.path : 
                                               ("?:\\Program Files\\*", 
                                                "?:\\Program Files (x86)\\*", 
                                                "\\Program Files\\*", 
                                                "\\Program Files (x86)\\*") and 
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                        ("31f65b7afe91e23ae88d8229fd54c5eb494ffd4594bdc3d6a91d2d69892b284b",
                         "766ac0f768c5b2acb19ecb8cf179c59d56b74d71437f5d1331408d9c827cfde8",
                         "67ca92cc7beea130c6f7e8f3982f3256f1724f22c6de869a884df47dcc0b7b95",
                         "b6a39ef455952471c935ea190a78eecf423fba2a49ffce1afdf737d58bb2c9d3",
                         "062a170de010b5be0840dd92a9ad43da1d1e09738956cffce78368305afe885b",
                         "2c5e3525840ef01510583ecc37f876791b2d6e73fbe8099c93ab0f5787ba626d",
                         "655d6df92eef4c947498456d40b7856cbe72ede8c6432072f968207817825b52",
                         "8b451b88d2cc91b079251e2347abb84d2b09712512fa9e57d9de35e93c751863",
                         "615ac4399eed0a26e5cd9bba4e7dcf661400fb0546dce067523fe275351d3b04",
                         "22a8ae4f904366c8f42d8da22df28c755cefd28ab34268c77275229964e34c66",
                         "6957d81c1fb22b7a2c88dd63f1c99a777805d13e0d0af6411a46c1f40e8b22e9",
                         "2dfa7a9d8be474447f8ea53dc864a5bb8cdcc526664636154adfa8b71386f883",
                         "e3fdcd2b4c5215e74b0cabe91ce7fe2800cbf8e2a28157342960bca61bbd6b5d",
                         "f1b668a9cca5c832ae8374c1815cfc8fcb452d05268797f0c022d74000ecd486",
                         "c0a45f327f40cf8cdc79dc9cccf858ae862a6df0a26c83141cb3c24fc604b483",
                         "8fb6e0cd1c0d01157ee1a87da9e894f7451988a5349cff5d99f2d3d9c6ffc397",
                         "4c6bbe178708b9590be27d8423261d6c1abfcdfe6cf90df1654ff60033a48bee",
                         "7eda2d6011ed2dae3f0c2ec30bdd2ae0c0146bf1baaa827dccb002b6ad793820",
                         "60ac461ca948a8a26dc3013d3b30fa615666b0d3fe8f5014dfd39a5de5440868",
                         "1165eb20cab73c780b439fdbea3fd9c6545f1d5488bf6c6194bf4dd49450f618",
                         "79ab757eaf9d745e9da693510c58b180ac45d6450d8df2260826c285bfe0f2de") and
 not process.executable : ("D:\\laragon\\bin\\php\\php-8.0.25-nts-Win32-vs16-x64\\php.exe", 
                           "D:\\laragon\\bin\\php\\php-8.2.4-nts-Win32-vs16-x64\\php.exe", 
                           "Z:\\SteamLibrary\\steamapps\\common\\*.exe",
                           "D:\\SteamLibrary\\steamapps\\common\\*.exe",
                           "D:\\Steam\\steamapps\\common\\*.exe",
                           "D:\\Visual Studio\\Common7\\IDE\\devenv.exe",
                           "?:\\Program Files\\DebugDiag\\DbgHost.exe",
                           "?:\\Program Files\\Git\\usr\\bin\\env.exe",
                           "?:\\Program Files\\Microsoft Visual Studio*\\Common?\\IDE\\*.exe",
                           "?:\\Program Files (x86)\\Microsoft Visual Studio*\\Common?\\IDE\\*.exe",
                           "?:\\Program Files (x86)\\Steam\\steamapps\\common\\*.exe",
                           "?:\\Program Files\\Microsoft Visual Studio\\2022\\Professional\\Common7\\IDE\\devenv.exe",
                           "?:\\Program Files (x86)\\WinHex 19.6 Portable\\WinHex64.exe",
                           "?:\\Program Files\\JetBrains\\*\\plugins\\go\\lib\\dlv\\windows\\dlv.exe") and
 not process.parent.executable :
                     ("?:\\Program Files\\cmder\\vendor\\conemu-maximus?\\ConEmu\\ConEmuC64.exe",
                      "C:\\Program Files (x86)\\GitExtensions\\ConEmu\\ConEmuC64.exe",
                      "C:\\Program Files\\Git\\mingw64\\libexec\\git-core\\git-remote-https.exe",
                      "C:\\Program Files\\Git\\usr\\bin\\bash.exe") and
 not (process.name : ("cmd.exe", "powershell.exe", "csc.exe") and
      _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection_provenance : "conemuhk64.dll*")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info : ("?:\\program files (x86)\\steam\\gameoverlayrenderer64.dll*",
                                        "?:\\program files\\windowsapps\\microsoft.windbg*\\amd64\\dbgeng.dll!DebugCreateEx*",
                                        "*\\vsdebugeng.impl.dll!ImplDllCreateInstance*",
                                        "?:\\program files\\windowsapps\\dolbylaboratories.dolbyaccess_*\\dlls\\x64\\dolbyaudioprocessing.dll*",
                                        "?:\\program files\\windowsapps\\pythonsoftwarefoundation.python.*\\dlls\\sqlite3.dll!sqlite?_enable_shared_cache*",
                                        "?:\\windows\\systemapps\\microsoft.windows.contentdeliverymanager_*\\contentdeliverymanager.background.dll!*")) and
 not process.thread.Ext.call_stack_summary : ("ntdll.dll|kernelbase.dll|gdb.exe|kernel32.dll|ntdll.dll", "ntdll.dll|bcrypt.dll") and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
                                          "Microsoft Windows Software Compatibility Publisher",
                                          "Valve Corp."))
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.