name: Thread context set from unbacked memory
id: f8219274-ee68-416b-8489-4d2e635c7844
version: 1.0.2
description: |
  Identifies manipulation of the thread context from unbacked memory region. This may be
  indicative of process injection.
labels:
  tactic.id: TA0005
  tactic.name: Defense Evasion
  tactic.ref: https://attack.mitre.org/tactics/TA0005/
  technique.id: T1055
  technique.name: Process Injection
  technique.ref: https://attack.mitre.org/techniques/T1055/

condition: >
  set_thread_context and thread.callstack.summary imatches ('ntdll.dll|kernelbase.dll|unbacked')
    and
    not
  ps.exe imatches
    (
      '?:\\Program Files\\Git\\mingw64\\bin\\git.exe',
      '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe',
      '?:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe',
      '?:\\Windows\\System32\\taskhostw.exe'
    )

min-engine-version: 2.2.0
