detection.wiki

Detection rules › Sigma

Microsoft Office DLL Sideload

Status
test
Severity
high
Log source
category image_load, product windows
Author
Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
Source
github.com/SigmaHQ/sigma

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Known false positives

  • Unlikely

MITRE ATT&CK coverage

TacticTechniques
Execution
Stealth

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 7: Image loaded

Rule body

title: Microsoft Office DLL Sideload
id: 829a3bdf-34da-4051-9cf4-8ed221a8ae4f
status: test
description: Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
references:
    - https://hijacklibs.net/ # For list of DLLs that could be sideloaded (search for dlls mentioned here in there)
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
date: 2022-08-17
modified: 2023-03-15
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\outllib.dll'
    filter:
        ImageLoaded|startswith:
            - 'C:\Program Files\Microsoft Office\OFFICE'
            - 'C:\Program Files (x86)\Microsoft Office\OFFICE'
            - 'C:\Program Files\Microsoft Office\Root\OFFICE'
            - 'C:\Program Files (x86)\Microsoft Office\Root\OFFICE'
    condition: selection and not filter
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
    ImageLoaded|endswith: '\outllib.dll'

Stage 2: not filter

filter:
    ImageLoaded|startswith:
        - 'C:\Program Files\Microsoft Office\OFFICE'
        - 'C:\Program Files (x86)\Microsoft Office\OFFICE'
        - 'C:\Program Files\Microsoft Office\Root\OFFICE'
        - 'C:\Program Files (x86)\Microsoft Office\Root\OFFICE'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
ImageLoadedstarts_withC:\Program Files (x86)\Microsoft Office\OFFICEexcludes:ImageLoaded field:"ImageLoaded" value:"C:\Program Files (x86)\Microsoft Office\OFFICE"
ImageLoadedstarts_withC:\Program Files (x86)\Microsoft Office\Root\OFFICEexcludes:ImageLoaded field:"ImageLoaded" value:"C:\Program Files (x86)\Microsoft Office\Root\OFFICE"
ImageLoadedstarts_withC:\Program Files\Microsoft Office\OFFICEexcludes:ImageLoaded field:"ImageLoaded" value:"C:\Program Files\Microsoft Office\OFFICE"
ImageLoadedstarts_withC:\Program Files\Microsoft Office\Root\OFFICEexcludes:ImageLoaded field:"ImageLoaded" value:"C:\Program Files\Microsoft Office\Root\OFFICE"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ImageLoadedends_with
  • \outllib.dll
field:"ImageLoaded" kind:ends_with value:"\outllib.dll"