Windows process injection via CobaltStrike BOF call stack and high access grants

title: Windows process injection via CobaltStrike BOF call stack and high access grants
id: 8f1fe27c-8402-4cb8-8945-1358836bc4b3
status: test
description: This rule matches Windows process access events where the call stack includes a ntdll-to-KERNELBASE sequence and ends with an UNKNOWN() entry matching a 16-character hex argument. It also requires unusually high GrantedAccess values (0x1028 or 0x1fffff), which aligns with attempts to inject into or manipulate other processes. The detection relies on process access telemetry that includes call traces and granted access flags.
references:
  - https://github.com/boku7/injectAmsiBypass
  - https://github.com/boku7/spawn
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-04
modified: 2023-11-28
tags:
  - attack.execution
  - attack.defense-impairment
  - attack.t1106
  - attack.t1685
logsource:
  category: process_access
  product: windows
detection:
  selection:
    CallTrace|re: ^C:\\Windows\\SYSTEM32\\ntdll\.dll\+[a-z0-9]{4,6}\|C:\\Windows\\System32\\KERNELBASE\.dll\+[a-z0-9]{4,6}\|UNKNOWN\([A-Z0-9]{16}\)$
    GrantedAccess:
      - "0x1028"
      - "0x1fffff"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 09706624-b7f6-455d-9d02-adee024cee1d
    type: derived