false positives are expected from third party applications and other legitimate system processes located in program files and other similar locations. filter as needed.

splunk

Techniques

Sample rules

Windows Known Abused DLL Loaded Suspiciously

source: splunk
technicques:

Description

The following analytic detects when DLLs with known abuse history are loaded from an unusual location. This activity may represent an attacker performing a DLL search order or sideload hijacking technique. These techniques are used to gain persistence as well as elevate privileges on the target system.

Detection logic

`sysmon`
ImageLoaded
EventCode=7

NOT ImageLoaded IN (
    "C:\\$WINDOWS.~BT\\*",
    "C:\\$WinREAgent\\*",
    "C:\\Windows\\SoftwareDistribution\\*",
    "C:\\Windows\\SyChpe32\\*",
    "C:\\Windows\\System32\\*",
    "C:\\Windows\\SystemTemp\\*",
    "C:\\Windows\\SysWOW64\\*",
    "C:\\Windows\\WinSxS\\*"
)

NOT (
    ImageLoaded="C:\\Windows\\Temp\\*"
    Image IN (
        "C:\\Windows\\WinSxS\\arm64*",
        "C:\\Windows\\UUS\\arm64\\*"
    )
    Image IN (
        "*\\TiWorker.exe",
        "*\\wuaucltcore.exe"
    )
)

NOT (
    ImageLoaded="C:\\Windows\\Microsoft.NET\\*"
    ImageLoaded="*\\cscui.dll"
)

NOT (
    ImageLoaded="C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*"
    ImageLoaded="*\\version.dll"
)

NOT (
    ImageLoaded="C:\\Program Files\\WindowsApps\\Microsoft.DirectXRuntime_*"
    ImageLoaded="*\\d3dx9_43.dll"
)

NOT ImageLoaded="C:\\Windows\\ImmersiveControlPanel\\SystemSettings.dll"

NOT (
    ImageLoaded="C:\\Program Files\\Microsoft\\Exchange Server\\*"
    ImageLoaded="*\\mswb7.dll"
)

NOT (
    ImageLoaded="C:\\Program Files\\Arsenal-Image-Mounter-*"
    ImageLoaded IN (
        "*\\mi.dll",
        "*\\miutils.dll"
    )
)

NOT (
    Image="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe"
    ImageLoaded="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll"
)

NOT ImageLoaded="C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\*"

NOT (
    Image IN (
        "C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*",
        "C:\\Windows\\System32\\backgroundTaskHost.exe"
    )
    ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*"
)

NOT (
    ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs\\*"
    ImageLoaded="*\\wldp.dll"
)

NOT (
    Image IN (
        "C:\\Program Files\\CheckPoint\\*",
        "C:\\Program Files (x86)\\CheckPoint\\*"
    )
    Image="*\\SmartConsole.exe"
    ImageLoaded IN (
        "C:\\Program Files\\CheckPoint\\*",
        "C:\\Program Files (x86)\\CheckPoint\\*"
    )
    ImageLoaded="*\\PolicyManager.dll"
)


| lookup local=t hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as reference

| lookup local=t hijacklibs_loaded library AS loaded_file excludes AS loaded_file_path OUTPUT islibrary AS excluded

| where islibrary="TRUE" AND excluded="false"


| stats count min(_time) as firstTime
              max(_time) as lastTime

  by dest loaded_file loaded_file_path process_exec
     process_guid process_hash process_id process_name
     process_path service_dll_signature_exists
     service_dll_signature_verified signature
     signature_id user user_id reference vendor_product


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_known_abused_dll_loaded_suspiciously_filter`