defense_evasion_process_execution_from_hollowed_memory_section.yml

name: Process execution from hollowed memory section
id: 2a3fbae8-5e8c-4b71-b9da-56c3958c0d53
version: 2.1.2
description: |
  Adversaries may inject malicious code into suspended and hollowed processes in order to
  evade process-based defenses. Process hollowing is a method of executing arbitrary code
  in the address space of a separate live process.
labels:
  tactic.id: TA0005
  tactic.name: Defense Evasion
  tactic.ref: https://attack.mitre.org/tactics/TA0005/
  technique.id: T1055
  technique.name: Process Injection
  technique.ref: https://attack.mitre.org/techniques/T1055/
  subtechnique.id: T1055.012
  subtechnique.name: Process Hollowing
  subtechnique.ref: https://attack.mitre.org/techniques/T1055/012/
references:
  - https://www.ired.team/offensive-security/code-injection-process-injection/process-hollowing-and-pe-image-relocations

condition: >
  sequence
  maxspan 40s
    |unmap_view_of_section and
     evt.pid != 4 and ps.sid not in ('S-1-5-18', 'S-1-5-19', 'S-1-5-20') and
     file.view.size > 20000 and file.view.protection != 'READONLY' and
     (file.name = '' or file.extension != '.dll') and
     ps.parent.exe not imatches
                    (
                      '?:\\Windows\\System32\\dwm.exe',
                      '?:\\Windows\\System32\\svchost.exe',
                      '?:\\Windows\\System32\\services.exe',
                      '?:\\Windows\\Microsoft.NET\\Framework*\\ngen.exe',
                      '?:\\Windows\\Microsoft.NET\\Framework*\\mscorsvw.exe'
                    )
    | by ps.uuid, file.view.base
    |load_executable and
     module.path not imatches '?:\\Windows\\SoftwareDistribution\\Download\\*\\Package_for_RollupFix*\\*.exe' and
     (ps.exe not imatches '?:\\Windows\\System32\\conhost.exe' and ps.cmdline not imatches '*0xffffffff -ForceV1' and ps.parent.exe not imatches '?:\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe')
    | by ps.uuid, module.base
action:
  - name: kill

output: >
  Process %2.ps.exe executed from hollowed memory section
severity: high

min-engine-version: 3.0.0