Add Queue APC injection signature

modules/signatures/windows/injection_thread.py

@@ -54,3 +54,45 @@ def on_call(self, call, process):
 
     def on_complete(self):
         return self.ret
+
+
+class ApcInjection(Signature):
+    name = "apc_injection"
+    description = "Queues an Asynchronous Procedure Call (APC) to a thread, indicative of injection"
+    severity = 3
+    confidence = 80
+    categories = ["injection", "evasion"]
+    authors = ["Kevin Ross"]
+    minimum = "1.3"
+    evented = True
+    ttps = ["T1055", "T1055.004"]
+    mbcs = ["E1055", "E1055.004"]
+
+    filter_apinames = {"NtQueueApcThread", "QueueUserAPC"}
+
+    def __init__(self, *args, **kwargs):
+        Signature.__init__(self, *args, **kwargs)
+        self.ret = False
+        self.apc_targets = set()
+
+    def on_call(self, call, process):
+        if call["api"] == "NtQueueApcThread":
+            target_thread = self.get_argument(call, "ThreadId")
+            apc_routine = self.get_argument(call, "ApcRoutine")
+        else:
+            target_thread = self.get_argument(call, "ThreadHandle")
+            apc_routine = self.get_argument(call, "pfnAPC")
+        if target_thread and apc_routine:
+            pid = process.get("process_id")
+            targetpid_str = self.get_argument(call, "ProcessId")
+
+            if targetpid_str and int(apc_routine, 16) != 0:
+                targetpid = int(targetpid_str)
+                if pid != targetpid:
+                    if target_thread not in self.apc_targets:
+                        self.apc_targets.add(target_thread)
+                        self.mark_call()
+                        self.ret = True
+
+    def on_complete(self):
+        return self.ret