Third Party Software DLL Sideloading

Title: Third Party Software DLL Sideloading
Status: test
Description:Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)
References:
  -https://hijacklibs.net/
Author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
Date: 2022-08-17
modified:None
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• category: image_load
• product: windows

Detection:
  selection_lenovo:
    ImageLoaded|endswith: '\commfunc.dll'
  filter_lenovo:
ImageLoaded|contains:'\AppData\local\Google\Chrome\Application\'     - ImageLoaded|startswith:
      - 'C:\Program Files\Lenovo\Communications Utility\'
      - 'C:\Program Files (x86)\Lenovo\Communications Utility\'
  selection_toshiba:
    ImageLoaded|endswith: '\tosbtkbd.dll'
  filter_toshiba:
    ImageLoaded|startswith:
      -'C:\Program Files\Toshiba\Bluetooth Toshiba Stack\'
      -'C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\'

  condition:(selection_lenovo and not filter_lenovo) or (selection_toshiba and not filter_toshiba)
Falsepositives:
  -Unknown
Level: medium