Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory. The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution
id: 02b18447-ea83-4b1b-8805-714a8a34546a
status: test
description: |
    Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory.
    The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/OfflineScannerShell/
author: frack113
date: 2022-03-06
modified: 2023-08-03
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\OfflineScannerShell.exe'
        - OriginalFileName: 'OfflineScannerShell.exe'
    filter_main_legit_dir:
        CurrentDirectory: 'C:\Program Files\Windows Defender\Offline\'
    filter_main_empty:
        CurrentDirectory: ''
    filter_main_null:
        CurrentDirectory: null
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    - Image|endswith: '\OfflineScannerShell.exe'
    - OriginalFileName: 'OfflineScannerShell.exe'

Stage 2: `not filter_main_*`

filter_main_legit_dir:
    CurrentDirectory: 'C:\Program Files\Windows Defender\Offline\'
filter_main_empty:
    CurrentDirectory: ''
filter_main_null:
    CurrentDirectory: null

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CurrentDirectory`	eq	`C:\Program Files\Windows Defender\Offline\`	`excludes:CurrentDirectory` `field:"CurrentDirectory" value:"C:\Program Files\Windows Defender\Offline\"`
`CurrentDirectory`	is_null	(no value, null check)	`excludes:CurrentDirectory`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\OfflineScannerShell.exe`	`field:"Image" kind:ends_with value:"\OfflineScannerShell.exe"`
`OriginalFileName`	eq	`OfflineScannerShell.exe`	`field:"OriginalFileName" kind:eq value:"OfflineScannerShell.exe"`