{"id":"f64c9b2d-b0ad-481d-9d03-7fc75020892a","title":"Potential RoboForm.DLL Sideloading","description":"Detects potential DLL sideloading of \"roboform.dll\", a DLL used by RoboForm Password Manager","author":"X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-05-14","modified":"","tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["If installed on a per-user level, the path would be located in \"AppData\\Local\". Add additional filters to reflect this mode of installation"],"references":["https://twitter.com/StopMalvertisin/status/1648604148848549888","https://twitter.com/t3ft3lb/status/1656194831830401024","https://www.roboform.com/"],"source_path":"rules/windows/image_load/image_load_side_load_robform.yml","source_sha256":"0960d8b9e2101ba067c88ff010b7fb3162bec990007d3fc2557779c580b22688","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_side_load_robform.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential RoboForm.DLL Sideloading\nid: f64c9b2d-b0ad-481d-9d03-7fc75020892a\nstatus: test\ndescription: Detects potential DLL sideloading of \"roboform.dll\", a DLL used by RoboForm Password Manager\nreferences:\n    - https://twitter.com/StopMalvertisin/status/1648604148848549888\n    - https://twitter.com/t3ft3lb/status/1656194831830401024\n    - https://www.roboform.com/\nauthor: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-05-14\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        ImageLoaded|endswith:\n            - '\\roboform.dll'\n            - '\\roboform-x64.dll'\n    filter_main_path:\n        Image|startswith:\n            - ' C:\\Program Files (x86)\\Siber Systems\\AI RoboForm\\'\n            - ' C:\\Program Files\\Siber Systems\\AI RoboForm\\'\n        Image|endswith:\n            - '\\robotaskbaricon.exe'\n            - '\\robotaskbaricon-x64.exe'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - If installed on a per-user level, the path would be located in \"AppData\\Local\". Add additional filters to reflect this mode of installation\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/f64c9b2d-b0ad-481d-9d03-7fc75020892a.json","kind":"sigma"}