Potential DLL Search Order Hijacking of an Existing Program

[rule]
description = """
Identifies attempts to load a recently created unsigned DLL file by an already existing signed process. This may
indicate an attempt to load a malicious module via DLL search order hijacking.
"""
id = "bf189c50-de24-471f-8e9e-01c9cfb5e05b"
license = "Elastic License v2"
name = "Potential DLL Search Order Hijacking of an Existing Program"
os_list = ["windows"]
reference = [
    "https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0",
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.31"

query = '''
sequence by process.entity_id with maxspan=1m

   [process where event.action == "start" and
    process.code_signature.trusted == true and
    process.executable : ("?:\\ProgramData\\*.exe", "?:\\Users\\*.exe") and

    /* creation time is at least 30 days old */
    process.Ext.relative_file_creation_time >= 2592000 and

    /* not modified in the last 24 hours */
    process.Ext.relative_file_name_modify_time > 86400 and

    not process.code_signature.subject_name :
              ("IFS World Operations AB", "TEAMDEV LTD.", "philandro Software GmbH", "Autodesk, Inc.", "Loom, Inc.",
               "SystemServer", "Kramer Electronics LTD.", "WILLIAM HENSHAW (Affiliate)", "Oracle America, Inc.",
               "Voicebrook Inc")
    ]

   [library where
    /* creation time equal or less than 24 hrs*/
    dll.Ext.relative_file_creation_time <= 86400 and
    not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
    process.executable : ("?:\\ProgramData\\*.exe", "?:\\Users\\*.exe") and
    dll.path : ("?:\\ProgramData\\*.dll", "?:\\Users\\*.dll") and

    /* DLL loaded from the process.executable current directory */
	 endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1))) and

	 not dll.hash.sha256 :
	         ("73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf",
	          "76f19b52423774932831dcba0596989ec56213f9b217a0432fbc122f99704a2a",
	          "0da7803bdd72de8f635336057d3d672b645d4da963e5c61544a4c5a2e8289fd8",
	          "d78adc29ea8fd4f180a3eaaa5713874af42cb79509aef6509af299b895b8dd77",
	          "822dae5c53e148cad6a789fb5f6fb759fab740e2d34d07f3ddbed5cbe226a785",
	          "3871034ebb72b5700722526ce15a67030a9d42ec9329dd878d979ed680dc9424",
	          "8740c64aaeba10108c4384eb6723407b8e9bed4f57c79c0f279ab9f28cb6287e",
	          "db00672e1b66559684e66c4c92aa39230ee75234a2580b0730c39dc171db632a")]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"