detection.wiki

Detection rules › Sigma

Abusable DLL Potential Sideloading From Suspicious Location

Status
test
Severity
high
Log source
product windows, category image_load
Author
X__Junior (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059 Command and Scripting Interpreter

Event coverage

ProviderEventTitle
SysmonEvent ID 7Image loaded

Rule body yaml

title: Abusable DLL Potential Sideloading From Suspicious Location
id: 799a5f48-0ac1-4e0f-9152-71d137d48c2a
status: test
description: Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
references:
    - https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html
    - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
author: X__Junior (Nextron Systems)
date: 2023-07-11
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: image_load
    product: windows
detection:
    selection_dll:
        ImageLoaded|endswith:
            # Note: Add more generic DLLs that cannot be pin-pointed to a single application
            - '\coreclr.dll'
            - '\facesdk.dll'
            - '\HPCustPartUI.dll'
            - '\libcef.dll'
            - '\ZIPDLL.dll'
    selection_folders_1:
        ImageLoaded|contains:
            - ':\Perflogs\'
            - ':\Users\Public\'
            - '\Temporary Internet'
            - '\Windows\Temp\'
    selection_folders_2:
        - ImageLoaded|contains|all:
              - ':\Users\'
              - '\Favorites\'
        - ImageLoaded|contains|all:
              - ':\Users\'
              - '\Favourites\'
        - ImageLoaded|contains|all:
              - ':\Users\'
              - '\Contacts\'
        - ImageLoaded|contains|all:
              - ':\Users\'
              - '\Pictures\'
    condition: selection_dll and 1 of selection_folders_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection_dll and 1 of selection_folders_*

Stage 1: selection_dll

selection_dll:
    ImageLoaded|endswith:
        - '\coreclr.dll'
        - '\facesdk.dll'
        - '\HPCustPartUI.dll'
        - '\libcef.dll'
        - '\ZIPDLL.dll'

Stage 2: selection_folders_1

selection_folders_1:
    ImageLoaded|contains:
        - ':\Perflogs\'
        - ':\Users\Public\'
        - '\Temporary Internet'
        - '\Windows\Temp\'

Stage 3: selection_folders_2

selection_folders_2:
    - ImageLoaded|contains|all:
          - ':\Users\'
          - '\Favorites\'
    - ImageLoaded|contains|all:
          - ':\Users\'
          - '\Favourites\'
    - ImageLoaded|contains|all:
          - ':\Users\'
          - '\Contacts\'
    - ImageLoaded|contains|all:
          - ':\Users\'
          - '\Pictures\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ImageLoadedends_with
  • \HPCustPartUI.dll
  • \ZIPDLL.dll
  • \coreclr.dll
  • \facesdk.dll
  • \libcef.dll
ImageLoadedmatch
  • :\Perflogs\ corpus 2 (sigma 2)
  • :\Users\
  • :\Users\Public\ corpus 2 (sigma 2)
  • \Contacts\ corpus 2 (sigma 2)
  • \Favorites\ corpus 2 (sigma 2)
  • \Favourites\ corpus 2 (sigma 2)
  • \Pictures\ corpus 2 (sigma 2)
  • \Temporary Internet corpus 2 (sigma 2)
  • \Windows\Temp\ corpus 2 (sigma 2)