Techniques
Sample rules
Windows Unsigned MS DLL Side-Loading
- source: splunk
- technicques:
- T1574.002
- T1547
Description
The following analysis identifies potential DLL side-loading instances involving unsigned DLLs with a company detail signature mimicking Microsoft. This technique is frequently exploited by adversaries to execute malicious code automatically by running a legitimate process. The analytics involves searching Sysmon logs for Event Code 7, where both the Image and ImageLoaded paths do not match system directories (system32, syswow64, and programfiles). Additionally, it verifies whether the loaded DLL is signed and checks if the folder paths of the Image and ImageLoaded are identical. This anomaly detection mechanism serves as a valuable indicator for identifying suspicious processes that load unsigned DLLs. Add other paths based on org hunting.
Detection logic
`sysmon` EventCode=7 Company="Microsoft Corporation" Signed=false SignatureStatus != Valid NOT (Image IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*", "C:\\Program Files*")) NOT (ImageLoaded IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*", "C:\\Program Files*"))
| rex field=Image "(?<ImageFolderPath>.+\\\)"
| rex field=ImageLoaded "(?<ImageLoadedFolderPath>.+\\\)"
| where ImageFolderPath = ImageLoadedFolderPath
| stats count min(_time) as firstTime max(_time) as lastTime by Image ProcessGuid ImageLoaded user Computer EventCode ImageFolderPath ImageLoadedFolderPath Company Description Product Signed SignatureStatus
| rename Computer as dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_unsigned_ms_dll_side_loading_filter`
Windows SqlWriter SQLDumper DLL Sideload
- source: splunk
- technicques:
- T1574.002
Description
The following analytic identifies the abuse of SqlWriter and SQLDumper executables to sideload the vcruntime140.dll library. This technique is commonly used by adversaries to load malicious code into a legitimate process. The analytic searches for EventCode 7 from Sysmon logs where the Image is either SQLDumper.exe or SQLWriter.exe and the ImageLoaded is vcruntime140.dll. The search also filters out the legitimate loading of vcruntime140.dll from the System32 directory to reduce false positives.
Detection logic
`sysmon` EventCode=7 (Image="*\\SQLDumper.exe" OR Image="*\\SQLWriter.exe") ImageLoaded="*\\vcruntime140.dll" NOT ImageLoaded="C:\\Windows\\System32\\*"
| stats values(ImageLoaded) count min(_time) as firstTime max(_time) as lastTime by Image,ImageLoaded, user, Computer, EventCode
| rename Computer as dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_sqlwriter_sqldumper_dll_sideload_filter`