Extra Window Memory Injection

// Detect EWM injection via suspicious API calls targeting Shell_TrayWnd
// EWM injection targets Explorer's Shell_TrayWnd window class
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("SetWindowLongApiCall", "SendMessageApiCall", "CreateRemoteThreadApiCall")
| where FileName =~ "explorer.exe"
| where InitiatingProcessFileName !in~ ("explorer.exe", "csrss.exe", "dwm.exe", "winlogon.exe", "ShellExperienceHost.exe", "SearchUI.exe")
| project Timestamp, DeviceName, AccountName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName
| sort by Timestamp desc
// Fallback: detect via ProcessAccess to explorer.exe with write rights
| union (
    DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType == "ProcessAccessedApiCall"
    | where FileName =~ "explorer.exe"
    | where InitiatingProcessFileName !in~ ("explorer.exe", "csrss.exe", "dwm.exe", "winlogon.exe", "taskhost.exe", "taskhostw.exe", "ShellExperienceHost.exe")
)
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
  TargetImage="*\\explorer.exe"
| where GrantedAccess IN ("0x1FFFFF", "0x001F0FFF", "0x1F3FFF", "0x0020", "0x1F1FFF")
| rename SourceImage as EWMInjector, TargetImage as Target
| search NOT EWMInjector IN ("*\\explorer.exe", "*\\csrss.exe", "*\\dwm.exe", "*\\winlogon.exe", "*\\ShellExperienceHost.exe", "*\\SearchUI.exe", "*\\taskhostw.exe", "*\\sihost.exe")
| eval InjectorName=mvindex(split(EWMInjector, "\\"), -1)
| eval EWMIndicator=case(
    GrantedAccess="0x1FFFFF", "Critical - PROCESS_ALL_ACCESS to explorer.exe",
    GrantedAccess="0x001F0FFF", "High - Full process rights to explorer.exe",
    match(GrantedAccess, "0x0020"), "Medium - PROCESS_VM_WRITE to explorer.exe",
    1=1, "Medium - Suspicious access rights"
)
| table _time, host, User, EWMInjector, Target, GrantedAccess, EWMIndicator
| sort - _time

any where event.provider == "Microsoft-Windows-Sysmon" and winlog.event_id == 10 and winlog.event_data.TargetImage like~ "*\\explorer.exe" and winlog.event_data.GrantedAccess in~ ("0x1FFFFF", "0x001F0FFF", "0x1F3FFF", "0x0020", "0x1F1FFF") and not winlog.event_data.SourceImage like~ ("*\\explorer.exe", "*\\csrss.exe", "*\\dwm.exe", "*\\winlogon.exe", "*\\ShellExperienceHost.exe", "*\\SearchUI.exe", "*\\taskhostw.exe", "*\\sihost.exe")

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime, LOGSOURCENAME(logsourceid) AS LogSource, sourceip AS SourceIP, username AS User, QIDNAME(qid) AS EventName, "SourceImage", "TargetImage", "GrantedAccess", CASE WHEN "GrantedAccess" = '0x1FFFFF' THEN 'Critical - PROCESS_ALL_ACCESS to explorer.exe' WHEN "GrantedAccess" = '0x001F0FFF' THEN 'High - Full process rights to explorer.exe' WHEN "GrantedAccess" = '0x0020' THEN 'Medium - PROCESS_VM_WRITE to explorer.exe' ELSE 'Medium - Suspicious access rights to explorer.exe' END AS EWMIndicator FROM events WHERE LOGSOURCETYPENAME(devicetype) = 'Microsoft Windows Security Event Log' AND QIDNAME(qid) LIKE '%Process Access%' AND "TargetImage" ILIKE '%\explorer.exe' AND "GrantedAccess" IN ('0x1FFFFF', '0x001F0FFF', '0x1F3FFF', '0x0020', '0x1F1FFF') AND NOT ("SourceImage" ILIKE '%\explorer.exe' OR "SourceImage" ILIKE '%\csrss.exe' OR "SourceImage" ILIKE '%\dwm.exe' OR "SourceImage" ILIKE '%\winlogon.exe' OR "SourceImage" ILIKE '%\ShellExperienceHost.exe' OR "SourceImage" ILIKE '%\SearchUI.exe' OR "SourceImage" ILIKE '%\taskhostw.exe' OR "SourceImage" ILIKE '%\sihost.exe') LAST 24 HOURS ORDER BY devicetime DESC

_sourceCategory="windows/sysmon" EventCode=10
| where TargetImage matches "*\\explorer.exe"
| where GrantedAccess in ("0x1FFFFF", "0x001F0FFF", "0x1F3FFF", "0x0020", "0x1F1FFF")
| where !(SourceImage matches "*\\explorer.exe" or SourceImage matches "*\\csrss.exe" or SourceImage matches "*\\dwm.exe" or SourceImage matches "*\\winlogon.exe" or SourceImage matches "*\\ShellExperienceHost.exe" or SourceImage matches "*\\SearchUI.exe" or SourceImage matches "*\\taskhostw.exe" or SourceImage matches "*\\sihost.exe")
| parse regex field=SourceImage "\\\\(?P<InjectorName>[^\\\\]+)$"
| if (GrantedAccess == "0x1FFFFF", "Critical - PROCESS_ALL_ACCESS",
     if (GrantedAccess == "0x001F0FFF", "High - Full process rights",
         if (GrantedAccess == "0x0020", "Medium - PROCESS_VM_WRITE",
             "Medium - Suspicious access rights"))) as EWMSeverity
| fields _messageTime, Computer, User, SourceImage, InjectorName, TargetImage, GrantedAccess, EWMSeverity
| sort by _messageTime desc

rule t1055_011_ewm_injection_explorer_access {
  meta:
    author = "df00tech"
    description = "Detects Extra Window Memory (EWM) injection via suspicious process access to explorer.exe with write or full access rights from non-system processes"
    mitre_attack_tactic = "Defense Evasion, Privilege Escalation"
    mitre_attack_technique = "T1055.011"
    severity = "HIGH"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1055/011/"

  events:
    $e.metadata.event_type = "PROCESS_OPEN"
    $e.target.process.file.full_path = /.*\\explorer\.exe$/i
    not $e.principal.process.file.full_path = /.*\\(explorer|csrss|dwm|winlogon|ShellExperienceHost|SearchUI|taskhostw|sihost)\.exe$/i
    $e.additional.fields["GrantedAccess"] in nocase ("0x1FFFFF", "0x001F0FFF", "0x1F3FFF", "0x0020", "0x1F1FFF")

  condition:
    $e
}

#event_simpleName = "TargetProcessAccess"
| TargetImageFileName = /\\explorer\.exe$/i
| DesiredAccess in ["0x1FFFFF", "0x001F0FFF", "0x1F3FFF", "0x0020", "0x1F1FFF"]
| SourceImageFileName != /\\(explorer|csrss|dwm|winlogon|ShellExperienceHost|SearchUI|taskhostw|sihost)\.exe$/i
| InjectorName := replace(SourceImageFileName, /.*\\(.+)$/, "$1")
| EWMSeverity := match(DesiredAccess, [
    "0x1FFFFF" -> "Critical - PROCESS_ALL_ACCESS",
    "0x001F0FFF" -> "High - Full process rights",
    "0x0020" -> "Medium - PROCESS_VM_WRITE",
    * -> "Medium - Suspicious access rights"
  ])
| table([@timestamp, ComputerName, UserName, SourceImageFileName, InjectorName, TargetImageFileName, DesiredAccess, EWMSeverity], sortby="@timestamp", order="desc")