fibratus/rules/defense_evasion_potential_thread_execution_hijacking.yml at master · rabbitstack/fibratus · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
name: Potential thread execution hijacking
id: 8b9f6d47-e9ba-4b3a-9da2-d7bf27e08ca9
version: 1.0.4
description: |
  Adversaries may inject malicious code into hijacked processes in order to evade process-based
  defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of
  executing arbitrary code in the address space of a separate live process.

  This is very similar to Process Hollowing but targets an existing process rather than creating
  a process in a suspended state.

  Running code in the context of another process may allow access to the process's memory,
  system/network resources, and possibly elevated privileges. Execution via Thread Execution
  Hijacking may also evade detection from security products since the execution is masked under
  a legitimate process.
labels:
  tactic.id: TA0005
  tactic.name: Defense Evasion
  tactic.ref: https://attack.mitre.org/tactics/TA0005/
  technique.id: T1055
  technique.name: Process Injection
  technique.ref: https://attack.mitre.org/techniques/T1055/
  subtechnique.id: T1055.003
  subtechnique.name: Thread Execution Hijacking
  subtechnique.ref: https://attack.mitre.org/techniques/T1055/003/
references:
  - https://www.ired.team/offensive-security/code-injection-process-injection/injecting-to-remote-process-via-thread-hijacking

condition: >
  sequence
  maxspan 2m
  by ps.uuid
    |open_remote_thread and
     thread.access.mask.names in ('ALL_ACCESS', 'SUSPEND_THREAD') and
     ps.exe not imatches
                (
                  '?:\\Program Files\\*',
                  '?:\\Program Files (x86)\\*',
                  '?:\\WINDOWS\\system32\\csrss.exe'
                )
    |
    |set_thread_context and
     ps.exe not imatches
                (
                  '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',
                  '?:\\Program Files\\Windows Kits\\*\\Debuggers\\*',
                  '?:\\Program Files (x86)\\Windows Kits\\*\\Debuggers\\*',
                  '?:\\Program Files\\Microsoft Visual Studio\\*\\Common7\\IDE\\*',
                  '?:\\Program Files (x86)\\Microsoft Visual Studio\\*\\Common7\\IDE\\*'
                )
    |
action:
  - name: kill

min-engine-version: 3.0.0