Known Desktop Application DLL Search Order Hijack

[rule]
description = """
Identifies attempts to load an unsigned DLL file to a known desktop application dependencies folder such as Slack, Teams
or OneDrive. This may indicate an attempt to load a malicious module via DLL search order hijacking.
"""
id = "60b68900-08b4-4bd3-832a-6e36e0921d74"
license = "Elastic License v2"
name = "Known Desktop Application DLL Search Order Hijack"
os_list = ["windows"]
reference = [
    "https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0",
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.2"

query = '''
library where
 (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and
 (dll.code_signature.trusted == false or dll.code_signature.exists == false) and
  not dll.code_signature.status like "errorCode_endpoint*" and
  dll.path :
        ("?:\\Users\\*\\AppData\\*\\Microsoft\\OneDrive\\*.dll",
         "?:\\Users\\*\\AppData\\*\\Microsoft OneDrive\\*.dll",
         "?:\\Users\\*\\AppData\\*\\Microsoft\\Teams\\*.dll",
         "?:\\Users\\*\\AppData\\Local\\slack\\app-*\\*.dll",
         "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\*.dll",
         "?:\\Users\\*\\AppData\\Local\\*\\Well Known Domains\\*\\well_known_domains.dll",
         "?:\\Users\\*\\AppData\\Local\\*\\Domain Actions\\*\\domain_actions.dll") and
 not dll.path : ("?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\\*.dll",
                  "?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\resources\\meeting-addin\\*",
                  "?:\\Users\\*\\Teams\\current\\*")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"