[Memory Protection] Add fields for trampoline detection.

[calladoum-elastic]

Change Summary

This PR adds 6 new fields to the memory protection alert:

• Target.process.thread.Ext.original_start_address
• Target.process.thread.Ext.original_start_address_allocation_offset
• Target.process.thread.Ext.original_start_address_bytes
• Target.process.thread.Ext.original_start_address_bytes_disasm
• Target.process.thread.Ext.original_start_address_bytes_disasm_hash
• Target.process.thread.Ext.original_start_address_module

Those fields come to complement the current ones similarly named:

• Target.process.thread.Ext.start_address
• Target.process.thread.Ext.start_address_allocation_offset
• Target.process.thread.Ext.start_address_bytes
• Target.process.thread.Ext.start_address_bytes_disasm
• Target.process.thread.Ext.start_address_bytes_disasm_hash
• Target.process.thread.Ext.start_address_module

The new fields are populated when a trampoline sequence is detected within the shellcode that triggered the alert, by attempting to resolve the effective address (and offset, module, etc.). A trampoline sequence currently corresponds to a series of basic control flow instructions (jmp, ret, etc.), and stack intructions (see https://github.com/elastic/endpoint-dev/issues/10807 for complete list of the currently instructions).

Sample values

Sample document

{ "@timestamp": "2023-02-13T23:56:49.8605525Z", "Endpoint": { "policy": { "applied": { "artifacts": { "global": {}, "user": {} } } } }, "Memory_protection": { "cross_session": false, "feature": "shellcode_thread", "parent_to_child": false, "self_injection": true, "unique_key_v1": "a2db7d87471280d0c472834b0bb1648b624b3eb18ecdc23855463f820664c97f" }, "Target": { "process": { "Ext": { "memory_region": { "allocation_base": 67174400, "allocation_protection": "RWX", "allocation_size": 67108864, "allocation_type": "PRIVATE", "mapped_path": "Unbacked", "region_base": 67174400, "region_protection": "RWX", "region_size": 4096, "region_state": "COMMIT", "strings": [ "This is the magic shellcode string" ] } }, "thread": { "Ext": { "original_start_address": 67174400, "original_start_address_allocation_offset": 0, "original_start_address_bytes": "e93b00000000cccccccccccccccccccccccccccccccccccccccccccccccccccc", "original_start_address_bytes_disasm": "jmp 0x0000000000000040\nadd ah, cl\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3", "original_start_address_bytes_disasm_hash": "4616434e499cb901bfaa6147b50365ab4e170b456ab8318d0288962c9738b6ed", "original_start_address_module": "Unbacked", "parameter": 140702510342160, "start_address": 67174528, "start_address_allocation_offset": 128, "start_address_bytes": "c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "start_address_bytes_disasm": "ret\nint3\nadd byte ptr [rax], al\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3\nint3", "start_address_bytes_disasm_hash": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c", "start_address_module": "Unbacked" } } } }, "agent": { "build": { "original": "version: 8.7.0-SNAPSHOT, compiled: Fri Feb 10 16:00:00 2023, branch: calladoum/vs2022_using_findwdk, commit: 7089e8ef1967710e88448384eaf463b9814e2d0d" }, "id": "", "type": "endpoint", "version": "8.7.0-SNAPSHOT" }, "data_stream": { "dataset": "", "namespace": "", "type": "" }, "ecs": { "version": "1.11.0" }, "elastic": { "agent": { "id": "" } }, "event": { "action": "start", "category": [ "malware", "intrusion_detection" ], "code": "shellcode_thread", "created": "2023-02-13T23:56:49.8605525Z", "dataset": "", "kind": "alert", "module": "endpoint", "risk_score": 99, "sequence": 46, "severity": 99, "type": [ "info", "allowed" ] }, "host": { "architecture": "x86_64", "hostname": "", "id": "", "name": "", "os": { "Ext": { "variant": "" }, "family": "", "full": "", "kernel": "", "name": "Windows", "platform": "", "type": "windows", "version": "" } }, "message": "Memory Threat Detection Alert: Shellcode Injection", "process": { "Ext": { "architecture": "x86_64" }, "architecture": "x86_64", "pid": 14300, "start": 1676332513, "thread": {} }, "rule": { "ruleset": "production" } }

Release Target

8.8

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-02-24T01:07:13.541+0000

• Duration: 8 min 57 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

Package endpoint - 8.8.0 containing this change is available at https://epr.elastic.co/search?package=endpoint