Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution — Sigma Rule

Rule metadata and linked tags

Author: frack113. Source status: test; severity: medium. Source dates: 2022-03-06 / 2023-08-03.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: fa7dcc872a25d5f269bd8d1e63d982edf4d8c2c0dd9d6191bce806f55ca393a0

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution
id: 02b18447-ea83-4b1b-8805-714a8a34546a
status: test
description: |
    Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory.
    The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/OfflineScannerShell/
author: frack113
date: 2022-03-06
modified: 2023-08-03
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\OfflineScannerShell.exe'
        - OriginalFileName: 'OfflineScannerShell.exe'
    filter_main_legit_dir:
        CurrentDirectory: 'C:\Program Files\Windows Defender\Offline\'
    filter_main_empty:
        CurrentDirectory: ''
    filter_main_null:
        CurrentDirectory: null
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://lolbas-project.github.io/lolbas/Binaries/OfflineScannerShell/