Name:Windows Known Abused DLL Loaded Suspiciously id:dd6d1f16-adc0-4e87-9c34-06189516b803 version:13 date:None author:Steven Dick status:production type:TTP Description:The following analytic detects when DLLs with known abuse history are loaded from an unusual location.
This activity may represent an attacker performing a DLL search order or sideload hijacking technique.
These techniques are used to gain persistence as well as elevate privileges on the target system. Data_source:
-Sysmon EventID 7
search:`sysmon` ImageLoaded EventCode=7
NOT ImageLoaded IN ( "C:\\$WINDOWS.~BT\\*", "C:\\$WinREAgent\\*", "C:\\Windows\\SoftwareDistribution\\*", "C:\\Windows\\SyChpe32\\*", "C:\\Windows\\System32\\*", "C:\\Windows\\SystemTemp\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Windows\\WinSxS\\*" )
NOT ( ImageLoaded="C:\\Windows\\Temp\\*" Image IN ( "C:\\Windows\\WinSxS\\arm64*", "C:\\Windows\\UUS\\arm64\\*" ) Image IN ( "*\\TiWorker.exe", "*\\wuaucltcore.exe" ) )
NOT ( ImageLoaded="C:\\Windows\\Microsoft.NET\\*" ImageLoaded="*\\cscui.dll" )
NOT ( ImageLoaded="C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*" ImageLoaded="*\\version.dll" )
NOT ( ImageLoaded="C:\\Program Files\\WindowsApps\\Microsoft.DirectXRuntime_*" ImageLoaded="*\\d3dx9_43.dll" )
NOT ImageLoaded="C:\\Windows\\ImmersiveControlPanel\\SystemSettings.dll"
NOT ( ImageLoaded="C:\\Program Files\\Microsoft\\Exchange Server\\*" ImageLoaded="*\\mswb7.dll" )
NOT ( ImageLoaded="C:\\Program Files\\Arsenal-Image-Mounter-*" ImageLoaded IN ( "*\\mi.dll", "*\\miutils.dll" ) )
NOT ImageLoaded="C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\*"
NOT ( Image IN ( "C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*", "C:\\Windows\\System32\\backgroundTaskHost.exe" ) ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs*" )
NOT ( ImageLoaded="C:\\Program Files\\WindowsApps\\DellInc.DellSupportAssistforPCs\\*" ImageLoaded="*\\wldp.dll" )
NOT ( Image IN ( "C:\\Program Files\\CheckPoint\\*", "C:\\Program Files (x86)\\CheckPoint\\*" ) Image="*\\SmartConsole.exe" ImageLoaded IN ( "C:\\Program Files\\CheckPoint\\*", "C:\\Program Files (x86)\\CheckPoint\\*" ) ImageLoaded="*\\PolicyManager.dll" )
| lookup local=t hijacklibs_loaded library AS loaded_file OUTPUT islibrary comment as reference | lookup local=t hijacklibs_loaded library AS loaded_file excludes AS loaded_file_path OUTPUT islibrary AS excluded | where islibrary="TRUE" AND excluded="false"
| stats count min(_time) as firstTime max(_time) as lastTime
by dest loaded_file loaded_file_path process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user user_id reference vendor_product
how_to_implement:The following analytic requires Sysmon operational logs to be ingested, with EventID 7 being mapped to the process_name field. Modify the sysmon macro as needed to match the sourcetype or add index. known_false_positives:False positives are expected from third party applications and other legitimate system processes located in Program Files and other similar locations. Filter as needed. References: -https://attack.mitre.org/techniques/T1574/002/ -https://hijacklibs.net/api/ -https://wietze.github.io/blog/hijacking-dlls-in-windows -https://github.com/olafhartong/sysmon-modular/pull/195/files drilldown_searches: name:'View the detection results for - "$dest$" and "$user$"' search:'%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$" and "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['SolarWinds WHD RCE Post Exploitation', 'Windows Defense Evasion Tactics', 'Living Off The Land']
