name: Potential process injection via tainted memory section
id: 8e4182f3-02e7-4e95-afc3-93d18c9a9c09
version: 1.0.0
description: |
  Identifies potential process injection when the adversary creates and maps a memory
  section with RW protection rights followed by mapping of the same memory section in
  the remote process with RX protection.
  By definition, the mapped view in the target process mirrors the content of the local
  process address space. The attacker can poison the local section memory with shellcode
  and execute it in the context of the remote process.
labels:
  tactic.id: TA0005
  tactic.name: Defense Evasion
  tactic.ref: https://attack.mitre.org/tactics/TA0005/
  technique.id: T1055
  technique.name: Process Injection
  technique.ref: https://attack.mitre.org/techniques/T1055/
references:
  - https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four
  - https://www.ired.team/offensive-security/code-injection-process-injection/ntcreatesection-+-ntmapviewofsection-code-injection

condition: >
  sequence
  maxspan 1m
    |map_view_of_section and file.view.protection = 'READWRITE' and kevt.pid != 4 and file.view.size >= 4096 and not ps.exe imatches 
      (
        '?:\\Program Files\\*.exe', 
        '?:\\Program Files (x86)\\*.exe'
      )
    | as e1
    |map_view_of_section and file.view.protection = 'READONLY|EXECUTE' and file.key = $e1.file.key and kevt.pid != $e1.kevt.pid|
action:
  - name: kill

min-engine-version: 2.2.0
