WPS Office Exploitation via DLL Hijack

 1[metadata]
 2creation_date = "2024/08/29"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5updated_date = "2024/10/15"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies the load of a remote library by the WPS Office promecefpluginhost.exe executable. This may indicate the successful 
13exploitation of CVE-2024-7262 or CVE-2024-7263 via DLL hijack abusing the ksoqing custom protocol handler.
14"""
15from = "now-9m"
16index = [ "logs-endpoint.events.library-*", "logs-windows.sysmon_operational-*"]
17language = "eql"
18license = "Elastic License v2"
19name = "WPS Office Exploitation via DLL Hijack"
20references = [
21 "https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/", 
22 "https://mp.weixin.qq.com/s/F8hNyESBdKhwXkQPgtGpew"
23 ]
24risk_score = 73
25rule_id = "ac6bc744-e82b-41ad-b58d-90654fa4ebfb"
26severity = "high"
27tags = [
28    "Domain: Endpoint",
29    "OS: Windows",
30    "Use Case: Threat Detection",
31    "Tactic: Initial Access",
32    "Tactic: Execution",
33    "Data Source: Elastic Defend",
34    "Data Source: Sysmon"
35]
36timestamp_override = "event.ingested"
37type = "eql"
38
39query = '''
40any where host.os.type == "windows" and process.name : "promecefpluginhost.exe" and 
41(
42 (event.category == "library" and 
43  ?dll.path : 
44     ("?:\\Users\\*\\AppData\\Local\\Temp\\wps\\INetCache\\*", 
45      "\\Device\\Mup\\**", "\\\\*")) or 
46
47  ((event.category == "process" and event.action : "Image loaded*") and 
48  ?file.path : 
49     ("?:\\Users\\*\\AppData\\Local\\Temp\\wps\\INetCache\\*", 
50      "\\Device\\Mup\\**", "\\\\*"))
51)
52'''
53
54
55[[rule.threat]]
56framework = "MITRE ATT&CK"
57[[rule.threat.technique]]
58id = "T1203"
59name = "Exploitation for Client Execution"
60reference = "https://attack.mitre.org/techniques/T1203/"
61
62
63[rule.threat.tactic]
64id = "TA0002"
65name = "Execution"
66reference = "https://attack.mitre.org/tactics/TA0002/"
67[[rule.threat]]
68framework = "MITRE ATT&CK"
69[[rule.threat.technique]]
70id = "T1189"
71name = "Drive-by Compromise"
72reference = "https://attack.mitre.org/techniques/T1189/"
73
74
75[rule.threat.tactic]
76id = "TA0001"
77name = "Initial Access"
78reference = "https://attack.mitre.org/tactics/TA0001/"