Title:
Potential RoboForm.DLL Sideloading
Status:
test
Description:Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager
References:
-https://twitter.com/StopMalvertisin/status/1648604148848549888
-https://twitter.com/t3ft3lb/status/1656194831830401024
-https://www.roboform.com/
Author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-14
modified:None
Tags:
- -'attack.persistence'
- -'attack.privilege-escalation'
- -'attack.execution'
- -'attack.stealth'
- -'attack.t1574.001'
Logsource:
- category: image_load
- product: windows
Detection:
selection:
ImageLoaded|endswith:
-'\roboform.dll'
-'\roboform-x64.dll'
filter_main_path:
Image|startswith:
-' C:\Program Files (x86)\Siber Systems\AI RoboForm\'
-' C:\Program Files\Siber Systems\AI RoboForm\'
Image|endswith:
-'\robotaskbaricon.exe'
-'\robotaskbaricon-x64.exe'
condition:
selection and not 1 of filter_main_*
Falsepositives:
-If installed on a per-user level, the path would be located in "AppData\Local". Add additional filters to reflect this mode of installation
Level:
medium
