DCOM InternetExplorer.Application Iertutil DLL Hijack - Security

calendar Feb 7, 2023 · attack.lateral_movement attack.t1021.002 attack.t1021.003  ·
Share on: linkedin copy

Detects a threat actor creating a file named iertutil.dll in the C:\Program Files\Internet Explorer\ directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

Sigma rule (View on GitHub)

 1title: DCOM InternetExplorer.Application Iertutil DLL Hijack - Security
 2id: c39f0c81-7348-4965-ab27-2fde35a1b641
 3status: test
 4description: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.
 5references:
 6    - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html
 7author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)
 8date: 2020/10/12
 9modified: 2022/11/26
10tags:
11    - attack.lateral_movement
12    - attack.t1021.002
13    - attack.t1021.003
14logsource:
15    product: windows
16    service: security
17detection:
18    selection:
19        EventID: 5145
20        RelativeTargetName|endswith: '\Internet Explorer\iertutil.dll'
21    filter:
22        SubjectUserName|endswith: '$'
23    condition: selection and not filter
24falsepositives:
25    - Unknown
26level: high

References

Related rules

to-top