Potential Beacon Masking from a Stomped Module

[rule]
description = """
Identifies multiple attempts to modify the memory protection of a memory module and the origin of the call is coming
from the same target module. This may indicate evasion to mask/unmask the text section of beacon from a stomped module.
"""
id = "d04edc65-b0a1-4445-a148-3fb7ec4f731e"
license = "Elastic License v2"
name = "Potential Beacon Masking from a Stomped Module"
os_list = ["windows"]
version = "1.0.6"

query = '''
api where process.Ext.api.name == "VirtualProtect" and
  process.Ext.api.behaviors == "allocate_shellcode" and process.Ext.api.behaviors == "execute_fluctuation" and
  process.Ext.api.metadata.target_address_name : "*.dll" and process.Ext.api.parameters.size >= 150000 and 
  stringcontains~(process.thread.Ext.call_stack_final_user_module.protection_provenance, process.Ext.api.metadata.target_address_name) and
  process.thread.Ext.call_stack_final_user_module.hash.sha256 != "528056732408c8dd2ef0cd585e719acdf1407326bfac4d9566d50dbb11ac2d1d"
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"