{"id":"9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c","title":"DLL Load By System Process From Suspicious Locations","description":"Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as \"C:\\Users\\Public\"","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-07-17","modified":"2023-09-18","tags":["attack.stealth","attack.t1070"],"technique_ids":["T1070"],"logsource":{"product":"windows","category":"image_load"},"falsepositives":["Unknown"],"references":["https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC (Idea)"],"source_path":"rules/windows/image_load/image_load_susp_dll_load_system_process.yml","source_sha256":"f7b58125b493e002578db2381f38e17eb4eb453bb5154db9226204f82c67b7a8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_susp_dll_load_system_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DLL Load By System Process From Suspicious Locations\nid: 9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c\nstatus: test\ndescription: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as \"C:\\Users\\Public\"\nreferences:\n    - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC (Idea)\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-07-17\nmodified: 2023-09-18\ntags:\n    - attack.stealth\n    - attack.t1070\nlogsource:\n    product: windows\n    category: image_load\ndetection:\n    selection:\n        Image|startswith: 'C:\\Windows\\'\n        ImageLoaded|startswith:\n            # TODO: Add more suspicious paths as you see fit in your env\n            - 'C:\\Users\\Public\\'\n            - 'C:\\PerfLogs\\'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1070","id":"T1070","name":"Indicator Removal","page":"techniques/enterprise/T1070/"}],"data_path":"data/detection-rules/9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c.json","kind":"sigma"}