Remote-write process handle opened from an unbacked call stack

1title: Remote-write process handle opened from an unbacked call stack2id: 2090f327-16e6-4383-8de1-36cf389116b93status: experimental4description: |5  AN0297 describes a four-step chain — OpenProcess, VirtualAllocEx,6  WriteProcessMemory of an MZ header or shellcode, then CreateRemoteThread —7  and Process Access is the one log source in the strategy where the access8  rights that chain requires and the identity of the caller arrive together on9  a single event. The rule therefore matches the OpenProcess step and requires10  two things at once: a GrantedAccess mask that grants remote memory write,11  memory operation and remote thread creation (the full-access variants plus12  the narrower query/write/create-thread masks a minimal injector asks for),13  and a CallTrace containing an UNKNOWN frame, which is how Sysmon renders a14  return address that no loaded module backs. That second half is the closest15  single-event proxy for the analytic's "without touching disk" — code16  executing from allocated memory rather than from a mapped image. The mask17  list is assembled here and is not MITRE's; this brief's knobs are18  PayloadEntropyThreshold, TargetProcessList, TimeWindow and19  ParentProcessAnomalyThreshold, and of those only TargetProcessList is20  expressible, as an added TargetImage filter once a site knows which21  processes should never be opened this way. Two limits are structural: an22  injector whose code runs from a normal on-disk DLL produces a fully23  module-backed CallTrace and is missed entirely, and the allocation, the24  write and the thread creation are separate events that lib/sigma has no25  timeframe or correlation to join, so only the handle acquisition is26  modelled. Nothing in the logic is specific to a portable executable either:27  the MZ header that separates this sub-technique from DLL injection, section28  mapping or hollowing sits in the WriteProcessMemory payload, which no log29  source in this brief records, so a hit is evidence of remote injection in30  general and not of PE injection in particular. Prerequisite: Sysmon emits EventID 10 only where the configuration31  carries a ProcessAccess rule, and the widely used baseline configurations32  scope that to lsass.exe alone — on such a host this rule returns zero rows,33  and zero rows reads as quiet when it actually means blind.34  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0106, not hand-written and not tested by its author. Any lab result is on this rule's own page.35references:36  - https://attack.mitre.org/techniques/T1055/00237  - https://attack.mitre.org/detectionstrategies/DET010638author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)39date: 2026-08-1640tags:41  - attack.defense-evasion42  - attack.privilege-escalation43  - attack.t1055.00244logsource:45  category: process_access46  product: windows47detection:48  selection_rights:49    GrantedAccess:50      - '0x1F0FFF'51      - '0x1F1FFF'52      - '0x1F2FFF'53      - '0x1F3FFF'54      - '0x1FFFFF'55      - '0x147A'56      - '0x143A'57      - '0x47A'58      - '0x43A'59      - '0x42A'60      - '0x2A'61  selection_unbacked:62    CallTrace|contains: 'UNKNOWN'63  condition: selection_rights and selection_unbacked64falsepositives:65  - "Managed .NET applications, which are the dominant source and the reason this rule is not rated higher. JIT-compiled code is emitted into allocated memory that no module backs, so Sysmon renders those frames as UNKNOWN — any .NET process that opens a handle with these rights matches the CallTrace half by construction, including PowerShell, MSBuild, Visual Studio and the large population of management and line-of-business agents written on .NET."66  - "Endpoint protection, EDR and DLP agents, which open full-access handles across the estate and inject their monitoring stubs from hook trampolines that live in allocated memory and so also render as UNKNOWN frames. These come from a small and stable set of SourceImage values per estate, which is where the exclusion belongs."67  - "Debuggers and crash handlers. WerFault.exe collecting a dump, and any interactive attach from WinDbg or Visual Studio, request full access and create remote threads as their normal operation."68  - "Anti-cheat engines, DRM wrappers and application-compatibility shims, all of which inject into their protected target by design and present the same masks."69  - "Accessibility software, screen recorders, input-method editors and .NET profiling or APM agents that hook a running application in memory to observe or extend it."70level: medium