{"id":"6360757a-d460-456c-8b13-74cf0e60cceb","title":"Potential DLL Sideloading Via comctl32.dll","description":"Detects potential DLL sideloading using comctl32.dll to obtain system privileges","author":"Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash)","status":"test","level":"high","date":"2022-12-16","modified":"2022-12-19","tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Unlikely"],"references":["https://github.com/binderlabs/DirCreate2System","https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt"],"source_path":"rules/windows/image_load/image_load_side_load_comctl32.yml","source_sha256":"95b7bf20cc8dc7a273c410e2603e2d8f69172896ff97b6127f4560daf2362984","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_side_load_comctl32.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential DLL Sideloading Via comctl32.dll\nid: 6360757a-d460-456c-8b13-74cf0e60cceb\nstatus: test\ndescription: Detects potential DLL sideloading using comctl32.dll to obtain system privileges\nreferences:\n    - https://github.com/binderlabs/DirCreate2System\n    - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt\nauthor: Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash)\ndate: 2022-12-16\nmodified: 2022-12-19\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        ImageLoaded|startswith:\n            - 'C:\\Windows\\System32\\logonUI.exe.local\\'\n            - 'C:\\Windows\\System32\\werFault.exe.local\\'\n            - 'C:\\Windows\\System32\\consent.exe.local\\'\n            - 'C:\\Windows\\System32\\narrator.exe.local\\'\n            - 'C:\\windows\\system32\\wermgr.exe.local\\'\n        ImageLoaded|endswith: '\\comctl32.dll'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/6360757a-d460-456c-8b13-74cf0e60cceb.json","kind":"sigma"}