Potential WWlib.DLL Sideloading

Title: Potential WWlib.DLL Sideloading
Status: test
Description:Detects potential DLL sideloading of "wwlib.dll"
References:
  -https://twitter.com/WhichbufferArda/status/1658829954182774784
  -https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/
  -https://securelist.com/apt-luminousmoth/103332/
Author: X__Junior (Nextron Systems)
Date: 2023-05-18
modified:None
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    ImageLoaded|endswith: '\wwlib.dll'
  filter_main_path:
    Image|startswith:
      -'C:\Program Files (x86)\Microsoft Office\'
      -'C:\Program Files\Microsoft Office\'

    Image|endswith: '\winword.exe'
    ImageLoaded|startswith:
      -'C:\Program Files (x86)\Microsoft Office\'
      -'C:\Program Files\Microsoft Office\'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium