Potential Initial Access via DLL Search Order Hijacking

[rule]
description = """
Identifies attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or
OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order
hijacking.
"""
id = "ddc4fa22-4675-44c0-a813-e786e638d7e0"
license = "Elastic License v2"
name = "Potential Initial Access via DLL Search Order Hijacking"
os_list = ["windows"]
reference = [
    "https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0",
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
]
version = "1.0.32"

query = '''
file where event.action != "deletion" and
 file.extension : "dll" and
 file.path :
        ("?:\\Users\\*\\AppData\\*\\Microsoft\\OneDrive\\*.dll",
         "?:\\Users\\*\\AppData\\*\\Microsoft OneDrive\\*.dll",
         "?:\\Users\\*\\AppData\\*\\Microsoft\\Teams\\*.dll",
         "?:\\Users\\*\\AppData\\Local\\slack\\app-*\\*.dll",
         "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\*",
         "?:\\Users\\*\\AppData\\Local\\*\\Well Known Domains\\*\\well_known_domains.dll",
         "?:\\Users\\*\\AppData\\Local\\*\\Domain Actions\\*\\domain_actions.dll") and
 process.name : ("winword.exe", "excel.exe", "powerpnt.exe", "MSACCESS.EXE", "MSPUB.EXE", "fltldr.exe", "cmd.exe",
                 "certutil.exe", "mshta.exe", "cscript.exe", "wscript.exe", "curl.exe", "powershell.exe", "pwsh.exe",
                 "mstsc.exe", "explorer.exe", "dllhost.exe", "xcopy.exe", "expand.exe") and
 not file.path : ("?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\\*.dll",
                  "?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\resources\\meeting-addin\\*",
                  "?:\\Users\\*\\Teams\\current\\*")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"