Privilege Escalation via Microsoft Exchange DLL Hijacking

[rule]
description = """
Identifies attempts to load a DLL from a hardcoded path by the Microsoft Exchange IIS worker process (w3wp). This may
indicate an attempt to elevate privilege via loading a malicious DLL from a path writable by low-privileged users.
"""
id = "861b403e-1bbb-4e5f-a19d-f1ea2ded2296"
license = "Elastic License v2"
name = "Privilege Escalation via Microsoft Exchange DLL Hijacking"
os_list = ["windows"]
reference = [
    "https://twitter.com/buffaloverflow/status/1591241996991369217/photo/1",
    "https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion",
    "https://www.zerodayinitiative.com/blog/2022/11/8/the-november-2022-security-update-review",
]
version = "1.0.24"

query = '''
library where process.name : "w3wp.exe" and dll.path : "D:\\ManagedTools\\cmdlets\\*"
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.16.0"