Detection rules › Sigma

EAP service activation by Liontail framework for DLL sideloading (via command)

Status
stable
Severity
medium
Log source
category process_creation, product windows
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker enable the Eaphost component in order to perform a DLL sideloading attack.

Known false positives

  • Administrator activity
  • VPN/IPsec server activation
  • RAS/RADIUS server activation

MITRE ATT&CK coverage

Telemetry coverage

Rule body

title: EAP service activation by Liontail framework for DLL sideloading (via command)
description: Detects scenarios where an attacker enable the Eaphost component in order to perform a DLL sideloading attack.
references:
- https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is-listening/
- https://securelist.com/incident-response-interesting-cases-2023/113611/
tags:
- attack.privilege_escalation
- attack.t1543.003 # Create or Modify System Process: Windows Service
author: mdecrevoisier
status: stable
logsource:
  product: windows
  category: process_creation
detection: # sc.exe config Eaphost start=auto
  selection:
    Image|endswith: '\sc.exe'
    CommandLine|contains|all:
      - config 
      - Eaphost 
      - start
  condition: selection
falsepositives:
- Administrator activity 
- VPN/IPsec server activation
- RAS/RADIUS server activation
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  Image|endswith: '\sc.exe'
  CommandLine|contains|all:
    - config
    - Eaphost
    - start

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • Eaphost
  • config corpus 16 (sigma 15, splunk 1)
  • start corpus 13 (sigma 11, splunk 2)
field:"CommandLine" kind:match
Imageends_with
  • \sc.exe corpus 30 (sigma 30)
field:"Image" kind:ends_with value:"\sc.exe"