Title:
Potential CCleanerDU.DLL Sideloading
Status:
test
Description:Detects potential DLL sideloading of "CCleanerDU.dll"
References:
-https://lab52.io/blog/2344-2/
Author: X__Junior (Nextron Systems)
Date: 2023-07-13
modified:None
Tags:
- -'attack.persistence'
- -'attack.privilege-escalation'
- -'attack.execution'
- -'attack.stealth'
- -'attack.t1574.001'
Logsource:
- category: image_load
- product: windows
Detection:
selection:
ImageLoaded|endswith:
'\CCleanerDU.dll'
filter_main_path:
Image|startswith:
-'C:\Program Files\CCleaner\'
-'C:\Program Files (x86)\CCleaner\'
Image|endswith:
-'\CCleaner.exe'
-'\CCleaner64.exe'
condition:
selection and not 1 of filter_main_*
Falsepositives:
-False positives could occur from other custom installation paths. Apply additional filters accordingly.
Level:
medium
