Unsigned DLL Side-Loading from a Suspicious Folder

  1[metadata]
  2creation_date = "2022/11/22"
  3maturity = "production"
  4integration = ["endpoint"]
  5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
  6min_stack_version = "8.4.0"
  7updated_date = "2023/06/22"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted
 13program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading 
 14a malicious DLL within the memory space of a signed processes.
 15"""
 16from = "now-9m"
 17index = ["logs-endpoint.events.*"]
 18language = "eql"
 19license = "Elastic License v2"
 20name = "Unsigned DLL Side-Loading from a Suspicious Folder"
 21note = """## Setup
 22
 23If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
 24"""
 25risk_score = 47
 26rule_id = "ca98c7cf-a56e-4057-a4e8-39603f7f0389"
 27severity = "medium"
 28tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Data Source: Elastic Defend"]
 29timestamp_override = "event.ingested"
 30type = "eql"
 31
 32query = '''
 33library where host.os.type == "windows" and
 34
 35 process.code_signature.trusted == true and 
 36 
 37 (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and 
 38 
 39  not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*", "errorChaining") and 
 40  
 41      /* Suspicious Paths */
 42      dll.path : ("?:\\PerfLogs\\*.dll",
 43                  "?:\\Users\\*\\Pictures\\*.dll",
 44                  "?:\\Users\\*\\Music\\*.dll",
 45                  "?:\\Users\\Public\\*.dll",
 46                  "?:\\Users\\*\\Documents\\*.dll",
 47                  "?:\\Windows\\Tasks\\*.dll",
 48                  "?:\\Windows\\System32\\Tasks\\*.dll",
 49                  "?:\\Intel\\*.dll",
 50                  "?:\\AMD\\Temp\\*.dll",
 51                  "?:\\Windows\\AppReadiness\\*.dll",
 52                  "?:\\Windows\\ServiceState\\*.dll",
 53                  "?:\\Windows\\security\\*.dll",
 54		  "?:\\Windows\\System\\*.dll",
 55                  "?:\\Windows\\IdentityCRL\\*.dll",
 56                  "?:\\Windows\\Branding\\*.dll",
 57                  "?:\\Windows\\csc\\*.dll",
 58                  "?:\\Windows\\DigitalLocker\\*.dll",
 59                  "?:\\Windows\\en-US\\*.dll",
 60                  "?:\\Windows\\wlansvc\\*.dll",
 61                  "?:\\Windows\\Prefetch\\*.dll",
 62                  "?:\\Windows\\Fonts\\*.dll",
 63                  "?:\\Windows\\diagnostics\\*.dll",
 64                  "?:\\Windows\\TAPI\\*.dll",
 65                  "?:\\Windows\\INF\\*.dll",
 66                  "?:\\windows\\tracing\\*.dll",
 67                  "?:\\windows\\IME\\*.dll",
 68                  "?:\\Windows\\Performance\\*.dll",
 69                  "?:\\windows\\intel\\*.dll",
 70                  "?:\\windows\\ms\\*.dll",
 71                  "?:\\Windows\\dot3svc\\*.dll",
 72                  "?:\\Windows\\ServiceProfiles\\*.dll",
 73                  "?:\\Windows\\panther\\*.dll",
 74                  "?:\\Windows\\RemotePackages\\*.dll",
 75                  "?:\\Windows\\OCR\\*.dll",
 76                  "?:\\Windows\\appcompat\\*.dll",
 77                  "?:\\Windows\\apppatch\\*.dll",
 78                  "?:\\Windows\\addins\\*.dll",
 79                  "?:\\Windows\\Setup\\*.dll",
 80                  "?:\\Windows\\Help\\*.dll",
 81                  "?:\\Windows\\SKB\\*.dll",
 82                  "?:\\Windows\\Vss\\*.dll",
 83                  "?:\\Windows\\Web\\*.dll",
 84                  "?:\\Windows\\servicing\\*.dll",
 85                  "?:\\Windows\\CbsTemp\\*.dll",
 86                  "?:\\Windows\\Logs\\*.dll",
 87                  "?:\\Windows\\WaaS\\*.dll",
 88                  "?:\\Windows\\twain_32\\*.dll",
 89                  "?:\\Windows\\ShellExperiences\\*.dll",
 90                  "?:\\Windows\\ShellComponents\\*.dll",
 91                  "?:\\Windows\\PLA\\*.dll",
 92                  "?:\\Windows\\Migration\\*.dll",
 93                  "?:\\Windows\\debug\\*.dll",
 94                  "?:\\Windows\\Cursors\\*.dll",
 95                  "?:\\Windows\\Containers\\*.dll",
 96                  "?:\\Windows\\Boot\\*.dll",
 97                  "?:\\Windows\\bcastdvr\\*.dll",
 98                  "?:\\Windows\\TextInput\\*.dll",
 99                  "?:\\Windows\\schemas\\*.dll",
100                  "?:\\Windows\\SchCache\\*.dll",
101                  "?:\\Windows\\Resources\\*.dll",
102                  "?:\\Windows\\rescache\\*.dll",
103                  "?:\\Windows\\Provisioning\\*.dll",
104                  "?:\\Windows\\PrintDialog\\*.dll",
105                  "?:\\Windows\\PolicyDefinitions\\*.dll",
106                  "?:\\Windows\\media\\*.dll",
107                  "?:\\Windows\\Globalization\\*.dll",
108                  "?:\\Windows\\L2Schemas\\*.dll",
109                  "?:\\Windows\\LiveKernelReports\\*.dll",
110                  "?:\\Windows\\ModemLogs\\*.dll",
111                  "?:\\Windows\\ImmersiveControlPanel\\*.dll",
112                  "?:\\$Recycle.Bin\\*.dll") and 
113	 
114	 /* DLL loaded from the process.executable current directory */
115	 endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))
116'''
117
118
119[[rule.threat]]
120framework = "MITRE ATT&CK"
121[[rule.threat.technique]]
122id = "T1574"
123name = "Hijack Execution Flow"
124reference = "https://attack.mitre.org/techniques/T1574/"
125[[rule.threat.technique.subtechnique]]
126id = "T1574.002"
127name = "DLL Side-Loading"
128reference = "https://attack.mitre.org/techniques/T1574/002/"
129
130
131
132[rule.threat.tactic]
133id = "TA0005"
134name = "Defense Evasion"
135reference = "https://attack.mitre.org/tactics/TA0005/"