WPS Office Exploitation via DLL Hijack

  1[metadata]
  2creation_date = "2024/08/29"
  3integration = ["endpoint", "windows"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the load of a remote library by the WPS Office promecefpluginhost.exe executable. This may indicate the
 11successful exploitation of CVE-2024-7262 or CVE-2024-7263 via DLL hijack abusing the ksoqing custom protocol handler.
 12"""
 13from = "now-9m"
 14index = ["logs-endpoint.events.library-*", "logs-windows.sysmon_operational-*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "WPS Office Exploitation via DLL Hijack"
 18references = [
 19    "https://www.welivesecurity.com/en/eset-research/analysis-of-two-arbitrary-code-execution-vulnerabilities-affecting-wps-office/",
 20    "https://mp.weixin.qq.com/s/F8hNyESBdKhwXkQPgtGpew",
 21]
 22risk_score = 73
 23rule_id = "ac6bc744-e82b-41ad-b58d-90654fa4ebfb"
 24severity = "high"
 25tags = [
 26    "Domain: Endpoint",
 27    "OS: Windows",
 28    "Use Case: Threat Detection",
 29    "Tactic: Initial Access",
 30    "Tactic: Execution",
 31    "Data Source: Elastic Defend",
 32    "Data Source: Sysmon",
 33    "Resources: Investigation Guide",
 34    "Noise: Low",
 35    "Performance: Normal",
 36    "Profile: Recommended",
 37    "Threat: Vulnerability Exploit",
 38    "Rule Type: Event Correlation (EQL)",
 39    "Platform: Windows",
 40    "Vuln: CVE-2024-7262",
 41    "Vuln: CVE-2024-7263",
 42]
 43timestamp_override = "event.ingested"
 44type = "eql"
 45
 46query = '''
 47any where host.os.type == "windows" and process.name : "promecefpluginhost.exe" and
 48(
 49 (event.category == "library" and
 50  ?dll.path :
 51     ("?:\\Users\\*\\AppData\\Local\\Temp\\wps\\INetCache\\*",
 52      "\\Device\\Mup\\**", "\\\\*")) or
 53
 54  ((event.category == "process" and event.action : "Image loaded*") and
 55  ?file.path :
 56     ("?:\\Users\\*\\AppData\\Local\\Temp\\wps\\INetCache\\*",
 57      "\\Device\\Mup\\**", "\\\\*"))
 58)
 59'''
 60
 61note = """## Triage and analysis
 62
 63### Investigating WPS Office Exploitation via DLL Hijack
 64
 65#### Possible investigation steps
 66
 67- What WPS library-load path did the alert capture?
 68  - Why: WPS loading from cache, device, or UNC paths defines the likely abuse route before identity checks.
 69  - Focus: `process.name`, `process.executable`, `process.command_line`, `dll.path`, and `dll.name`.
 70  - Implication: escalate when "promecefpluginhost.exe" loads from "Temp\\wps\\INetCache", "\\Device\\Mup\\", or a UNC path outside the WPS install tree; lower suspicion only when normalized `dll.path` resolves to the same Kingsoft-controlled component path as the loader and no protocol-abuse arguments appear.
 71
 72- Is the WPS loader the expected Kingsoft component?
 73  - Focus: `process.executable`, `process.pe.original_file_name`, `process.hash.sha256`, `process.code_signature.subject_name`, and `process.code_signature.trusted`.
 74  - Implication: escalate when the loader is unsigned, renamed, outside the installed WPS Office directory, or signed by an unexpected publisher; lower suspicion when identity matches a stable Kingsoft WPS component, but continue because a trusted loader can still load an attacker DLL.
 75
 76- Does the command line and parentage show "ksoqing" protocol abuse?
 77  - Focus: loader process events for `host.id` and `process.entity_id`, then `process.command_line`, `process.parent.executable`, and `process.parent.command_line`. $investigate_2
 78  - Implication: escalate when "wps.exe" or "et.exe" opens user content with arguments exposing "ksoqing", plugin-service paths, encoded paths, or remote paths; lower suspicion only when parentage and arguments match a recognized controlled-share launch without document-driven protocol handling.
 79
 80- Does the loaded DLL identity fit a legitimate WPS dependency?
 81  - Focus: `dll.hash.sha256`, `dll.pe.original_file_name`, `dll.code_signature.subject_name`, `dll.code_signature.trusted`, and `dll.Ext.relative_file_creation_time`.
 82  - Hint: if endpoint file telemetry is available, use `host.id` and `dll.path` to identify the writer or rename event. Missing file telemetry is unresolved, not benign. $investigate_4
 83  - Implication: escalate when the DLL is unsigned, non-Kingsoft, recently created, recently renamed in `dll.Ext.relative_file_name_modify_time`, or loaded as an unexpected WPS dependency from a remote share; if recency metadata is absent, rely on path, hash, signer, and parentage.
 84
 85- If local evidence is suspicious or incomplete, do related alerts show follow-on activity?
 86  - Focus: child process events from the WPS loader and related alerts for `user.id`, especially WPS document execution, additional library loads, downloader behavior, or child-process alerts from the same workstation.
 87    - $investigate_3
 88    - $investigate_0
 89  - Hint: if user context is missing or ambiguous, review same-host alerts for `host.id` across the last 48 hours. $investigate_1
 90  - Implication: broaden scope when the same user or host shows repeated WPS-triggered loads, the same `dll.hash.sha256`, the same suspicious path pattern, or follow-on execution; lower urgency when isolated, but do not close if local path or DLL identity remains unresolved.
 91
 92- Escalate when load path, loader identity, protocol or parentage, DLL signer/hash/recency, or related-alert evidence supports attacker-controlled DLL loading from INetCache, a device path, or UNC path; close only when the same evidence binds to one authorized validation, sandbox, or controlled-share workflow with no contradictory artifacts; preserve artifacts and escalate if evidence is mixed or incomplete.
 93
 94### False positive analysis
 95
 96- Authorized vulnerability validation or sandbox detonation can reproduce this load pattern. Confirm scope with outside records when available, and require telemetry alignment on `host.id`, `user.id`, `process.executable`, `process.command_line`, `dll.path`, `dll.hash.sha256`, and `dll.code_signature.subject_name`. If not a known test, default to suspicious.
 97- Controlled software distribution or application virtualization can serve WPS components from a managed share. Confirm `dll.path` stays on that exact share, `dll.hash.sha256` and `dll.code_signature.subject_name` match the expected Kingsoft component, and parentage lacks document-driven protocol or plugin-path arguments. Without inventories, use recurrence only to validate the same stable share, hash, signer, `process.executable`, `host.id`, and `user.id` workflow before exceptioning.
 98- Build exceptions only from the minimum confirmed workflow: stable `process.executable`, `process.code_signature.subject_name`, `dll.path`, `dll.hash.sha256`, `dll.code_signature.subject_name`, and bounded `host.id` or `user.id` scope. Avoid exceptions on `process.name` alone for "promecefpluginhost.exe", "Temp\\wps\\INetCache", or UNC prefixes.
 99
100### Response and remediation
101
102- If confirmed benign, record the exact workflow evidence first: loader identity, `process.command_line`, DLL path/hash/signer, and bounded `host.id` or `user.id` scope. Then reverse temporary containment and create an exception only for that bounded workflow.
103- If suspicious but unconfirmed, preserve the alert, host/user scope, `process.entity_id`, parent lineage, `dll.path`, `dll.hash.sha256`, and DLL signer/recency evidence before containment. Use reversible actions first, such as restricting a non-business remote share named in `dll.path`, quarantining a recovered lure document, or temporarily restricting WPS on the affected host; isolate only when follow-on execution or repeated malicious loads justify the interruption.
104- If confirmed malicious, isolate the host through endpoint response after evidence preservation, then terminate the WPS loader chain if it is still active and block confirmed malicious `dll.hash.sha256` values and remote shares from `dll.path`. If endpoint response is unavailable, hand off the preserved process, DLL, host, and user identifiers to the team that can contain the system or share.
105- Eradicate only artifacts tied to the investigation: remove the malicious DLL, recovered lure document, and staged WPS abuse files after scope review for the same `dll.hash.sha256`, `dll.path`, WPS parentage, `host.id`, and `user.id`. Upgrade WPS Office to a vendor-supported release that remediates both CVE-2024-7262 and CVE-2024-7263.
106- Post-incident hardening: restrict WPS Office library loads from user-writable and UNC paths where feasible, retain process and library-load telemetry, and document any adjacent variant observed during triage, such as alternate WPS protocol arguments or related "promecefpluginhost.exe" load paths.
107"""
108
109setup = """## Setup
110
111This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
112
113Setup instructions: https://ela.st/install-elastic-defend
114
115### Additional data sources
116
117This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
118
119- [Sysmon Event ID 7 - Image Loaded](https://ela.st/sysmon-event-7-setup)
120"""
121
122[rule.investigation_fields]
123field_names = [
124    "@timestamp",
125    "host.name",
126    "host.id",
127    "user.id",
128    "process.executable",
129    "process.command_line",
130    "process.entity_id",
131    "process.code_signature.subject_name",
132    "process.code_signature.trusted",
133    "process.parent.executable",
134    "process.parent.command_line",
135    "dll.path",
136    "dll.hash.sha256",
137    "dll.code_signature.subject_name",
138    "dll.code_signature.trusted",
139]
140
141[transform]
142
143[[transform.investigate]]
144label = "Alerts associated with the user"
145description = ""
146providers = [
147  [
148    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
149    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
150  ]
151]
152relativeFrom = "now-48h/h"
153relativeTo = "now"
154
155[[transform.investigate]]
156label = "Alerts associated with the host"
157description = ""
158providers = [
159  [
160    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
161    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
162  ]
163]
164relativeFrom = "now-48h/h"
165relativeTo = "now"
166
167[[transform.investigate]]
168label = "Process events for the WPS loader"
169description = ""
170providers = [
171  [
172    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
173    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
174    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
175  ]
176]
177relativeFrom = "now-1h"
178relativeTo = "now"
179
180[[transform.investigate]]
181label = "Child process events from the WPS loader"
182description = ""
183providers = [
184  [
185    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" },
186    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
187    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" }
188  ]
189]
190relativeFrom = "now-1h"
191relativeTo = "now"
192
193[[transform.investigate]]
194label = "File events for the loaded DLL path"
195description = ""
196providers = [
197  [
198    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" },
199    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
200    { excluded = false, field = "file.path", queryType = "phrase", value = "{{dll.path}}", valueType = "string" }
201  ]
202]
203relativeFrom = "now-1h"
204relativeTo = "now"
205
206[[rule.threat]]
207framework = "MITRE ATT&CK"
208
209[[rule.threat.technique]]
210id = "T1129"
211name = "Shared Modules"
212reference = "https://attack.mitre.org/techniques/T1129/"
213
214[[rule.threat.technique]]
215id = "T1203"
216name = "Exploitation for Client Execution"
217reference = "https://attack.mitre.org/techniques/T1203/"
218
219[rule.threat.tactic]
220id = "TA0002"
221name = "Execution"
222reference = "https://attack.mitre.org/tactics/TA0002/"
223
224[[rule.threat]]
225framework = "MITRE ATT&CK"
226
227[[rule.threat.technique]]
228id = "T1189"
229name = "Drive-by Compromise"
230reference = "https://attack.mitre.org/techniques/T1189/"
231
232[rule.threat.tactic]
233id = "TA0001"
234name = "Initial Access"
235reference = "https://attack.mitre.org/tactics/TA0001/"
236
237[[rule.threat]]
238framework = "MITRE ATT&CK"
239
240[[rule.threat.technique]]
241id = "T1574"
242name = "Hijack Execution Flow"
243reference = "https://attack.mitre.org/techniques/T1574/"
244
245[[rule.threat.technique.subtechnique]]
246id = "T1574.001"
247name = "DLL"
248reference = "https://attack.mitre.org/techniques/T1574/001/"
249
250[rule.threat.tactic]
251id = "TA0005"
252name = "Defense Evasion"
253reference = "https://attack.mitre.org/tactics/TA0005/"