{"id":"dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c","title":"Potential Initial Access via DLL Search Order Hijacking","description":"Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.","author":"Tim Rauch (rule), Elastic (idea)","status":"test","level":"medium","date":"2022-10-21","modified":"","tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1566","attack.t1566.001","attack.initial-access","attack.t1574","attack.t1574.001"],"technique_ids":["T1566","T1566.001","T1574","T1574.001"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc","https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0"],"source_path":"rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml","source_sha256":"cbc75f89cbae90d8422b939f25a179a83fb40303bf61a0aad9d5cc6c7d69e60e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Initial Access via DLL Search Order Hijacking\nid: dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c\nstatus: test\ndescription: Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.\nreferences:\n    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc\n    - https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0\nauthor: Tim Rauch (rule), Elastic (idea)\ndate: 2022-10-21\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.execution\n    - attack.stealth\n    - attack.t1566\n    - attack.t1566.001\n    - attack.initial-access\n    - attack.t1574\n    - attack.t1574.001\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        Image|endswith:\n            # add more processes when you find them\n            - '\\winword.exe'\n            - '\\excel.exe'\n            - '\\powerpnt.exe'\n            - '\\MSACCESS.EXE'\n            - '\\MSPUB.EXE'\n            - '\\fltldr.exe'\n            - '\\cmd.exe'\n            - '\\certutil.exe'\n            - '\\mshta.exe'\n            - '\\cscript.exe'\n            - '\\wscript.exe'\n            - '\\curl.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n        TargetFilename|endswith: '.dll'\n        TargetFilename|contains|all:\n            - '\\Users\\'\n            - '\\AppData\\'\n        TargetFilename|contains:\n            # add more suspicious paths when you find them\n            - '\\Microsoft\\OneDrive\\'\n            - '\\Microsoft OneDrive\\'\n            - '\\Microsoft\\Teams\\'\n            - '\\Local\\slack\\app-'\n            - '\\Local\\Programs\\Microsoft VS Code\\'\n    filter:\n        Image|endswith: '\\cmd.exe'\n        TargetFilename|contains|all:\n            - '\\Users\\'\n            - '\\AppData\\'\n            - '\\Microsoft\\OneDrive\\'\n            - '\\api-ms-win-core-'\n    condition: selection and not filter\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1566","id":"T1566","name":"Phishing","page":"techniques/enterprise/T1566/"},{"key":"enterprise/T1566.001","id":"T1566.001","name":"Spearphishing Attachment","page":"techniques/enterprise/T1566.001/"},{"key":"enterprise/T1574","id":"T1574","name":"Hijack Execution Flow","page":"techniques/enterprise/T1574/"},{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c.json","kind":"sigma"}