Common Language Runtime Loaded via an Unsigned Module

[rule]
description = "Identifies the load of the Microsoft Common Language Runtime DLL CLR.dll from a recently dropped unsigned DLL."
id = "d8d90a1a-a912-4716-994b-26e24d363d76"
license = "Elastic License v2"
name = "Common Language Runtime Loaded via an Unsigned Module"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.20"

query = '''
sequence by process.entity_id with maxspan=1m
 [library where
  dll.Ext.relative_file_creation_time <= 300 and
  dll.code_signature.trusted  != true and not startswith~(dll.name, process.name) and
  dll.hash.sha256 : "??*" and dll.path : "?*" and
  (process.code_signature.subject_name : "Microsoft*" or process.code_signature.exists == false) and
  not dll.code_signature.status : ("trusted", "errorCode_endpoint*") and
  not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\System32\\DriverStore\\FileRepository\\*") and
  not dll.path : ("?:\\Windows\\assembly\\NativeImages_v*",
                  "?:\\Windows\\System32\\DriverStore\\FileRepository\\*",
                  "?:\\Windows\\SoftwareDistribution\\Download\\*",
                  "?:\\Windows\\WinSxS\\*",
                  "?:\\Program Files\\*",
                  "?:\\Program Files (x86)\\*") and
  not dll.hash.sha256 : "f51ff500ace815d2d2213fe961a2080f8b7da98474d7a7736a49961938e1028e"] as event0
 [library where dll.name : "clr.dll" and
  stringcontains~(process.thread.Ext.call_stack_summary, concat("mscoreei.dll|", event0.dll.name)) and
  not process.thread.Ext.call_stack_summary : "*mscoreei.dll|msi*.tmp|msi.dll*"]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"