Microsoft Office DLL Sideload

Title: Microsoft Office DLL Sideload
Status: test
Description:Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
References:
  -https://hijacklibs.net/
Author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
Date: 2022-08-17
modified:2023-03-15
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    ImageLoaded|endswith: '\outllib.dll'
  filter:
    ImageLoaded|startswith:
      -'C:\Program Files\Microsoft Office\OFFICE'
      -'C:\Program Files (x86)\Microsoft Office\OFFICE'
      -'C:\Program Files\Microsoft Office\Root\OFFICE'
      -'C:\Program Files (x86)\Microsoft Office\Root\OFFICE'

  condition:selection and not filter
Falsepositives:
  -Unlikely
Level: high