VMGuestLib DLL Sideload

Title: VMGuestLib DLL Sideload
Status: test
Description:Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.
References:
  -https://decoded.avast.io/martinchlumecky/png-steganography/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-01
modified:None
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    ImageLoaded|contains|all:
      -'\VMware\VMware Tools\vmStatsProvider\win32'
      -'\vmGuestLib.dll'

    Image|endswith: '\Windows\System32\wbem\WmiApSrv.exe'
  filter:
    Signed: 'true'
  condition:selection and not filter
Falsepositives:
  -FP could occur if the legitimate version of vmGuestLib already exists on the system
Level: medium