API via Trusted App Runtime DLL

[rule]
description = """
Identifies attemtps to call Windows memory management APIs from the Trusted App Runtime DLL tprtdll.dll. This may
indicate an attempt to execute syscalls from a trusted module while avoiding potential NTDLL hooks.
"""
id = "ed572422-cefc-496c-b59f-65d8c34b9ac4"
license = "Elastic License v2"
name = "API via Trusted App Runtime DLL"
os_list = ["windows"]
reference = [
    "https://github.com/whokilleddb/function-collections/blob/8ad66ca3276b8d1b1864552d0e09f32c56126ec5/winapi_alternatives/NtAllocateMemoryEx/main.c",
]
version = "1.0.3"

query = '''
api where process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory","VirtualProtectEx", "VirtualAllocEx") and
 (
  process.thread.Ext.call_stack_summary like "tprtdll.dll|*" or

  (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
   process.thread.Ext.call_stack_final_user_module.protection_provenance_path == "c:\\windows\\system32\\tprtdll.dll") or

   process.thread.Ext.call_stack_final_user_module.path == "c:\\windows\\system32\\tprtdll.dll"
  )
'''

min_endpoint_version = "8.14.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.14.2"