sigmamediumHunting

Potential Initial Access via DLL Search Order Hijacking

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

MITRE ATT&CK

T1566 T1566.001 T1574 T1574.001

privilege-escalationpersistenceinitial-accessdefense-evasion

Detection Query

selection:
  Image|endswith:
    - \winword.exe
    - \excel.exe
    - \powerpnt.exe
    - \MSACCESS.EXE
    - \MSPUB.EXE
    - \fltldr.exe
    - \cmd.exe
    - \certutil.exe
    - \mshta.exe
    - \cscript.exe
    - \wscript.exe
    - \curl.exe
    - \powershell.exe
    - \pwsh.exe
  TargetFilename|endswith: .dll
  TargetFilename|contains|all:
    - \Users\
    - \AppData\
  TargetFilename|contains:
    - \Microsoft\OneDrive\
    - \Microsoft OneDrive\
    - \Microsoft\Teams\
    - \Local\slack\app-
    - \Local\Programs\Microsoft VS Code\
filter:
  Image|endswith: \cmd.exe
  TargetFilename|contains|all:
    - \Users\
    - \AppData\
    - \Microsoft\OneDrive\
    - \api-ms-win-core-
condition: selection and not filter

Author

Tim Rauch (rule), Elastic (idea)

Created

2022-10-21

Data Sources

windowsFile Events

Platforms

windows

References

Tags

attack.privilege-escalationattack.persistenceattack.t1566attack.t1566.001attack.initial-accessattack.t1574attack.t1574.001attack.defense-evasion

Raw Content

title: Potential Initial Access via DLL Search Order Hijacking
id: dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
status: test
description: Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
references:
    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc
    - https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0
author: Tim Rauch (rule), Elastic (idea)
date: 2022-10-21
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1566
    - attack.t1566.001
    - attack.initial-access
    - attack.t1574
    - attack.t1574.001
    - attack.defense-evasion
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith:
            # add more processes when you find them
            - '\winword.exe'
            - '\excel.exe'
            - '\powerpnt.exe'
            - '\MSACCESS.EXE'
            - '\MSPUB.EXE'
            - '\fltldr.exe'
            - '\cmd.exe'
            - '\certutil.exe'
            - '\mshta.exe'
            - '\cscript.exe'
            - '\wscript.exe'
            - '\curl.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
        TargetFilename|endswith: '.dll'
        TargetFilename|contains|all:
            - '\Users\'
            - '\AppData\'
        TargetFilename|contains:
            # add more suspicious paths when you find them
            - '\Microsoft\OneDrive\'
            - '\Microsoft OneDrive\'
            - '\Microsoft\Teams\'
            - '\Local\slack\app-'
            - '\Local\Programs\Microsoft VS Code\'
    filter:
        Image|endswith: '\cmd.exe'
        TargetFilename|contains|all:
            - '\Users\'
            - '\AppData\'
            - '\Microsoft\OneDrive\'
            - '\api-ms-win-core-'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium