new: bindfltapi.dll execution by suspicious process

[vl43den]

Summary of the Pull Request

Adds Windows Security (Event ID 4663) detections for FILE_EXECUTE access to the BindFlt API DLL, which is, as stated in the ZeroSalarium's reference, possible by usermode. These rules are intended for defensive validation of BindFlt API usage as described in ZeroSalarium’s research ("EDR-Redir V2 – Blind EDR With Fake Program Files"), and help surface processes that load the BindFlt API to create redirecting bind links - with the goal of evading EDR solutions (Defender, Elastic Defend, Sophos Intercept X, ESET Premium, CrowdStrike Falcon). Rules include common field aliases and exec mask for portability. This was tested on a Windows Server 2022 Standard VM Version 10.0.20348 Build 20348 by using the following source and the x64 exe built from it:
"https://github.com/TwoSevenOneT/EDR-Redir"

As this rule detects execute access to bindfltapi.dll by suspicious processes, it requires File System auditing and SACL to catch these hits.

Changelog

new: win_security_susp_bindfltapi_execute.yml

Example Log Event

True Positive Example, Matches the rule (ObjectType: File, path endswith \bindfltapi.dll, AccessMask 0x20 / %%4421 Execute, non-system process):

EventID: 4663
ObjectServer: Security
ObjectType: File
ObjectName: C:\Windows\System32\bindfltapi.dll
HandleId: 0xAC
AccessMask: 0x20
AccessList: %%4421
ProcessId: 0x984
ProcessName: C:\EDR-Redir\x64\Debug\EDR-Redir.exe
SubjectUserName: Administrator
SubjectUserSid: S-1-5-21-4024965044-827233860-1202526542-500
SubjectDomainName: WIN-41I2QDGCQ0B
SubjectLogonId: 0x16bba6
ResourceAttributes: S:AI

False Positive Example (Only ReadAttributes, not Execute. Process is Defender (MsMpEng.exe)):

EventID: 4663
ObjectServer: Security
ObjectType: File
ObjectName: C:\Windows\System32\bindfltapi.dll
HandleId: 0xF84
AccessMask: 0x80
AccessList: %%4423
ProcessId: 0xA58
ProcessName: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.6-0\MsMpEng.exe
SubjectUserSid: S-1-5-18
SubjectUserName: WIN-41I2QDGCQ0B$
SubjectDomainName: WORKGROUP
SubjectLogonId: 0x3e7
ResourceAttributes: S:AI

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions