Potential DLL Sideloading Using Coregen.exe

Title: Potential DLL Sideloading Using Coregen.exe
Status: test
Description:Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.
References:
  -https://lolbas-project.github.io/lolbas/OtherMSBinaries/Coregen/
Author: frack113
Date: 2022-12-31
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1218'
• -'attack.t1055'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    Image|endswith: '\coregen.exe'
  filter_main_legit_paths:
    ImageLoaded|startswith:
      -'C:\Program Files (x86)\Microsoft Silverlight\'
      -'C:\Program Files\Microsoft Silverlight\'
      -'C:\Windows\System32\'
      -'C:\Windows\SysWOW64\'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium