DLL Side Loading via a Copied Microsoft Executable

[rule]
description = """
Identifies when a Microsoft signed binary is copied to a directory and shortly followed by the loading of an unsigned
DLL from the same directory. Adversaries may opt for moving Microsoft signed binaries to a random directory and use them
as a host for malicious DLL sideloading during the installation phase.
"""
id = "d84090d7-91e4-4063-84c1-c1f410dd717b"
license = "Elastic License v2"
name = "DLL Side Loading via a Copied Microsoft Executable"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
    "https://www.microsoft.com/en-us/security/blog/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/",
]
version = "1.0.32"

query = '''
sequence by user.id with maxspan=5m
 [file where event.action != "deletion" and
  not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and file.Ext.header_bytes : "4d5a*" and

  /* PE file copied */
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*CopyFileEx*", "*MoveFileExW*")) and 
  
  /* DismHost is copied by CleanMgr */
  not (file.name : "DismHost.exe" and process.thread.Ext.call_stack_summary : "*|dismcore.dll|*") and
       
  not (file.path : "?:\\Program Files*\\Microsoft\\EdgeUpdate\\*\\MicrosoftEdgeUpdateComRegisterShell*.exe" and 
       process.executable : "?:\\Program Files*\\Microsoft\\Temp\\*\\MicrosoftEdgeUpdate.exe") and

  not (process.executable : "?:\\Program Files*\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" and
       file.path : "?:\\Program Files*\\Common Files\\microsoft shared\\ClickToRun\\Updates\\*\\OfficeClickToRun.exe") and 

  not process.executable : ("?:\\Program Files\\Microsoft Visual Studio\\*\\Common?\\IDE\\devenv.exe", 
                            "?:\\Program Files (x86)\\Microsoft Visual Studio\\*\\Common?\\IDE\\devenv.exe", 
                            "?:\\Program Files\\Microsoft Visual Studio\\*\\MSBuild.exe", 
                            "?:\\Program Files\\dotnet\\dotnet.exe") and

  not (file.path : "C:\\SuperGrate\\mighost.exe" and process.executable : "D:\\SuperGrate\\SuperGrate.exe")

 ] by file.path
 [library where
  process.code_signature.subject_name : "Microsoft*" and process.code_signature.trusted == true and
  not startswith~(dll.name, process.name) and dll.hash.sha256 != null and 
  (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and
  not dll.code_signature.status : "trusted" and

  /* DLL loaded from the process.executable directory */
  endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1))) and

  not dll.hash.sha256 :
              ("3e278f47c124c44e8e5a18a12364f3b7af723292b6a4c6011e8f558325bbd7cb",
               "bd7874d8b30a39e306d53f83588478622d3e152fe1c7d29a1e0e04fa8844b1e3",
               "ecd44288b475131a8cc14a1fff497af478bcb26a772e838fa711cd654835a233",
               "6c48d66731fcf6a60e7aef335c91e55ee27743df9912856c63302f7dfecde906",
               "2e0559d248a68402d209d65e6009c05628fe6c30f892a1047fa3365a89d7d9a6",
               "c7601b2f8b2439211433de59bda62a09347480bfdbbe03b4c560aa350c543e3a",
               "7e1a25b50775cb246303ae162bba86c9d5fe2bd7fa98044899ffb58919b4ed3a", 
               "44f3a05334de6ca0b43ebd17f6c7f1935630e026f049f28828566e364b7f41aa", 
               "45715793b8c8571554b0bfb4eccc29e2884c16481e1c7dbee78363bbe4da3dd9", 
               "99c109628e7d9bccf0961c0fd40d2f0e98e43fca59fe88e8467cd0f9be6bfdd9") and

  not (dll.path : "?:\\$WINDOWS.~BT\\Sources\\*.dll" and process.executable : "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe") and
  not dll.path : "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\*.dll"
  ] by process.executable
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"