image_load

VMMap Signed Dbghelp.DLL Potential Sideloading

Sep 7, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

VMMap Unsigned Dbghelp.DLL Potential Sideloading

Sep 7, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Unsigned Mfdetours.DLL Sideloading

Aug 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

WMI Module Loaded By Non Uncommon Process

Aug 8, 2023 · attack.execution attack.t1047 ·

Share on:

Detects a WMI modules being loaded by an uncommon process

Potential Mpclient.DLL Sideloading

Aug 7, 2023 · attack.defense_evasion attack.t1574.002 ·

Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Potential AVKkid.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "AVKkid.dll"

Potential EACore.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "EACore.dll"

Potential Mfdetours.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Potential Vivaldi_elf.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "vivaldi_elf.dll"

CredUI.DLL Loaded By Uncommon Process

Jul 31, 2023 · attack.credential_access attack.collection attack.t1056.002 ·

Share on:

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

Abusable DLL Potential Sideloading From Suspicious Location

Jul 24, 2023 · attack.execution attack.t1059 ·

Share on:

Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

Potential CCleanerDU.DLL Sideloading

Jul 24, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Potential CCleanerReactivator.DLL Sideloading

Jul 20, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Potential appverifUI.DLL Sideloading

Jul 13, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "appverifUI.dll"

Potential ShellDispatch.DLL Sideloading

Jul 13, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "ShellDispatch.dll"

Possible Process Hollowing Image Loading

Jun 26, 2023 · attack.defense_evasion attack.t1574.002 ·

Share on:

Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz

WMIC Loading Scripting Libraries

Jun 26, 2023 · attack.defense_evasion attack.t1220 ·

Share on:

Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the /FORMAT argument switch to download and execute an XSL file (i.e js, vbs, etc).

Potential Waveedit.DLL Sideloading

Jun 15, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

Unsigned Module Loaded by ClickOnce Application

Jun 12, 2023 · attack.persistence attack.t1574.002 ·

Share on:

Detects unsigned module load by ClickOnce application.

Potential Edputil.DLL Sideloading

Jun 11, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "edputil.dll"

Potential 7za.DLL Sideloading

Jun 11, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "7za.dll"

Potential RjvPlatform.DLL Sideloading From Default Location

Jun 11, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Potential RjvPlatform.DLL Sideloading From Non-Default Location

Jun 11, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

Potential SmadHook.DLL Sideloading

Jun 2, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Amsi.DLL Load By Uncommon Process

Jun 1, 2023 · attack.defense_evasion attack.impact attack.t1490 ·

Share on:

Detects loading of Amsi.dll by uncommon processes

Amsi.DLL Loaded Via LOLBIN Process

Jun 1, 2023 · attack.defense_evasion ·

Share on:

Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack

PCRE.NET Package Image Load

Jun 1, 2023 · attack.execution attack.t1059 ·

Share on:

Detects processes loading modules related to PCRE.NET package

Potential Azure Browser SSO Abuse

Jun 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.002 ·

Share on:

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

Potential DCOM InternetExplorer.Application DLL Hijack - Image Load

Jun 1, 2023 · attack.lateral_movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class

PowerShell Core DLL Loaded By Non PowerShell Process

Jun 1, 2023 · attack.t1059.001 attack.execution ·

Share on:

Detects loading of essential DLLs used by PowerShell, but not by the process powershell.exe. Detects behaviour similar to meterpreter's "load powershell" extension.

PowerShell Core DLL Loaded Via Office Application

Jun 1, 2023 · attack.defense_evasion ·

Share on:

Detects PowerShell core DLL being loaded by an Office Product

Suspicious Volume Shadow Copy VSS_PS.dll Load

May 23, 2023 · attack.defense_evasion attack.impact attack.t1490 ·

Share on:

Detects the image load of vss_ps.dll by uncommon executables

Potential Goopdate.DLL Sideloading

May 20, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Potential WWlib.DLL Sideloading

May 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "wwlib.dll"

Potential System DLL Sideloading From Non System Locations

May 16, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.)

Potential RoboForm.DLL Sideloading

May 15, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Microsoft Excel Add-In Loaded From Uncommon Location

May 15, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location

Potential Chrome Frame Helper DLL Sideloading

May 15, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Potential Wazuh Security Platform DLL Sideloading

May 15, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

May 9, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Potential SolidPDFCreator.DLL Sideloading

May 8, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Potential DLL Sideloading Of DBGCORE.DLL

May 5, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of "dbgcore.dll"

Potential DLL Sideloading Of DBGHELP.DLL

May 5, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of "dbghelp.dll"

Suspicious Volume Shadow Copy Vssapi.dll Load

May 3, 2023 · attack.defense_evasion attack.impact attack.t1490 ·

Share on:

Detects the image load of VSS DLL by uncommon executables

Potential Libvlc.DLL Sideloading

Apr 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

Potential Iviewers.DLL Sideloading

Apr 12, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Potential Rcdll.DLL Sideloading

Apr 12, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of rcdll.dll

Active Directory Kerberos DLL Loaded Via Office Application

Apr 3, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects Kerberos DLL being loaded by an Office Product

Active Directory Parsing DLL Loaded Via Office Application

Apr 3, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects DSParse DLL being loaded by an Office Product

CLR DLL Loaded Via Office Applications

Apr 3, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects CLR DLL being loaded by an Office Product

DLL Load By System Process From Suspicious Locations

Apr 3, 2023 · attack.defense_evasion attack.t1070 ·

Share on:

Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location such as C:\Users\Public

DotNET Assembly DLL Loaded Via Office Application

Apr 3, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects any assembly DLL being loaded by an Office Product

Suspicious Volume Shadow Copy Vsstrace.dll Load

Mar 28, 2023 · attack.defense_evasion attack.impact attack.t1490 ·

Share on:

Detects the image load of VSS DLL by uncommon executables

Aruba Network Service Potential DLL Sideloading

Mar 15, 2023 · attack.privilege_escalation attack.persistence attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Microsoft Office DLL Sideload

Mar 15, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Potential DLL Sideloading Using Coregen.exe

Mar 15, 2023 · attack.defense_evasion attack.t1218 attack.t1055 ·

Share on:

Detect usage of DLL "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Potential Antivirus Software DLL Sideloading

Mar 13, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Load Of Dbghelp/Dbgcore DLL From Suspicious Process

Mar 9, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecraft use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.

DotNet CLR DLL Loaded By Scripting Applications

Feb 23, 2023 · attack.execution attack.privilege_escalation attack.t1055 ·

Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

System Drawing DLL Load

Feb 23, 2023 · attack.collection attack.t1113 ·

Share on:

Detects processes loading "System.Drawing.ni.dll". This could be an indicator of potential Screen Capture.

WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Feb 23, 2023 · attack.lateral_movement attack.privilege_escalation attack.persistence attack.t1546.003 ·

Share on:

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indciates WMI ActiveScriptEventConsumers EventConsumers activity.

Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE

Feb 20, 2023 · attack.defense_evasion attack.t1202 cve.2022.30190 ·

Share on:

Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library

HackTool - SharpEvtMute DLL Load

Feb 20, 2023 · attack.defense_evasion attack.t1562.002 ·

Share on:

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

DLL Loaded From Suspicious Location Via Cmspt.EXE

Feb 17, 2023 · attack.defense_evasion attack.t1218.003 ·

Share on:

Detects cmstp loading "dll" or "ocx" files from suspicious locations

HackTool - SILENTTRINITY Stager DLL Load

Feb 17, 2023 · attack.command_and_control attack.t1071 ·

Share on:

Detects SILENTTRINITY stager dll loading activity

Potential DLL Sideloading Via VMware Xfer

Feb 17, 2023 · attack.defense_evasion attack.t1574.002 ·

Share on:

Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL

Suspicious Renamed Comsvcs DLL Loaded By Rundll32

Feb 17, 2023 · attack.credential_access attack.defense_evasion attack.t1003.001 ·

Share on:

Detects rundll32 loading a renamed comsvcs.dll to dump process memory

Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded

Feb 17, 2023 · attack.credential_access attack.t1003.001 ·

Share on:

Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.

Potential DLL Sideloading Of Non-Existent DLLs From System Folders

Feb 14, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation

Svchost DLL Search Order Hijack

Feb 14, 2023 · attack.persistence attack.defense_evasion attack.t1574.002 attack.t1574.001 ·

Share on:

Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default. An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote machine.

GAC DLL Loaded Via Office Applications

Feb 9, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects any GAC DLL being loaded by an Office Product

Microsoft VBA For Outlook Addin Loaded Via Outlook

Feb 9, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process

VBA DLL Loaded Via Office Application

Feb 9, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.

Fax Service DLL Search Order Hijack

Feb 8, 2023 · attack.persistence attack.defense_evasion attack.t1574.001 attack.t1574.002 ·

Share on:

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

Wmiprvse Wbemcomn DLL Hijack

Feb 7, 2023 · attack.execution attack.t1047 attack.lateral_movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

VMGuestLib DLL Sideload

Feb 6, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

DLL Sideloading Of ShellChromeAPI.DLL

Feb 5, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Potential DLL Sideloading Via comctl32.dll

Feb 1, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Third Party Software DLL Sideloading

Feb 1, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

UAC Bypass Using Iscsicpl - ImageLoad

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1548.002 ·

Share on:

Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%