image_load

Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

Mar 4, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Clfs.SYS Loaded By Process Located In a Potential Suspicious Location

Feb 22, 2025 · attack.execution attack.t1059 ·

Share on:

Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.

Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load

Jan 19, 2025 · attack.defense-evasion attack.impact attack.t1490 ·

Share on:

Detects the image load of VSS DLL by uncommon executables

Unsigned DLL Loaded by Windows Utility

Jan 6, 2025 · attack.t1218.011 attack.t1218.010 attack.defense-evasion ·

Share on:

Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code.

PowerShell Core DLL Loaded By Non PowerShell Process

Dec 1, 2024 · attack.t1059.001 attack.execution ·

Share on:

Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter's "load powershell" extension.

System Control Panel Item Loaded From Uncommon Location

Dec 1, 2024 · attack.defense-evasion attack.t1036 ·

Share on:

Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading.

HackTool - SharpEvtMute DLL Load

Nov 25, 2024 · attack.defense-evasion attack.t1562.002 ·

Share on:

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

Potential Python DLL SideLoading

Oct 6, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of Python DLL files.

Load Of RstrtMgr.DLL By A Suspicious Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Load Of RstrtMgr.DLL By An Uncommon Process

Oct 1, 2024 · attack.impact attack.defense-evasion attack.t1486 attack.t1562.001 ·

Share on:

Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.

Windows Spooler Service Suspicious Binary Load

Sep 13, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 ·

Share on:

Detect DLL Load from Spooler Service backup folder

Potential DLL Sideloading Using Coregen.exe

Aug 29, 2024 · attack.defense-evasion attack.t1218 attack.t1055 ·

Share on:

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

Abusable DLL Potential Sideloading From Suspicious Location

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

Active Directory Kerberos DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects Kerberos DLL being loaded by an Office Product

Active Directory Parsing DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects DSParse DLL being loaded by an Office Product

Amsi.DLL Loaded Via LOLBIN Process

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack

Aruba Network Service Potential DLL Sideloading

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

CLR DLL Loaded Via Office Applications

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects CLR DLL being loaded by an Office Product

CredUI.DLL Loaded By Uncommon Process

Aug 12, 2024 · attack.credential-access attack.collection attack.t1056.002 ·

Share on:

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1202 cve.2022-30190 ·

Share on:

Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library

DLL Load By System Process From Suspicious Locations

Aug 12, 2024 · attack.defense-evasion attack.t1070 ·

Share on:

Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"

DLL Loaded From Suspicious Location Via Cmspt.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1218.003 ·

Share on:

Detects cmstp loading "dll" or "ocx" files from suspicious locations

DLL Sideloading Of ShellChromeAPI.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

DotNET Assembly DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects any assembly DLL being loaded by an Office Product

DotNet CLR DLL Loaded By Scripting Applications

Aug 12, 2024 · attack.execution attack.privilege-escalation attack.t1055 ·

Share on:

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Fax Service DLL Search Order Hijack

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 attack.t1574.002 ·

Share on:

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

GAC DLL Loaded Via Office Applications

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects any GAC DLL being loaded by an Office Product

HackTool - SILENTTRINITY Stager DLL Load

Aug 12, 2024 · attack.command-and-control attack.t1071 ·

Share on:

Detects SILENTTRINITY stager dll loading activity

Microsoft Excel Add-In Loaded From Uncommon Location

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location

Microsoft Office DLL Sideload

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Microsoft VBA For Outlook Addin Loaded Via Outlook

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process

PCRE.NET Package Image Load

Aug 12, 2024 · attack.execution attack.t1059 ·

Share on:

Detects processes loading modules related to PCRE.NET package

Potential 7za.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "7za.dll"

Potential Antivirus Software DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Potential appverifUI.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "appverifUI.dll"

Potential AVKkid.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "AVKkid.dll"

Potential Azure Browser SSO Abuse

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.002 ·

Share on:

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser. An attacker can use this to authenticate to Azure AD in a browser as that user.

Potential CCleanerDU.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Potential CCleanerReactivator.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Potential Chrome Frame Helper DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Potential DCOM InternetExplorer.Application DLL Hijack - Image Load

Aug 12, 2024 · attack.lateral-movement attack.t1021.002 attack.t1021.003 ·

Share on:

Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class

Potential DLL Sideloading Of DBGCORE.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of "dbgcore.dll"

Potential DLL Sideloading Of DBGHELP.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "dbghelp.dll"

Potential DLL Sideloading Of DbgModel.DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "DbgModel.dll"

Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Potential DLL Sideloading Of MpSvc.DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "MpSvc.dll".

Potential DLL Sideloading Of MsCorSvc.DLL

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "mscorsvc.dll".

Potential DLL Sideloading Of Non-Existent DLLs From System Folders

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories). Usually this technique is used to achieve UAC bypass or privilege escalation.

Potential DLL Sideloading Via ClassicExplorer32.dll

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Potential DLL Sideloading Via comctl32.dll

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Potential DLL Sideloading Via JsSchHlp

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Potential DLL Sideloading Via VMware Xfer

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL

Potential EACore.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "EACore.dll"

Potential Edputil.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "edputil.dll"

Potential Goopdate.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Potential Iviewers.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Potential Libvlc.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

Potential Mfdetours.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Potential Mpclient.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Potential Rcdll.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of rcdll.dll

Potential RjvPlatform.DLL Sideloading From Default Location

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Potential RjvPlatform.DLL Sideloading From Non-Default Location

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

Potential RoboForm.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Potential ShellDispatch.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "ShellDispatch.dll"

Potential SmadHook.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Potential SolidPDFCreator.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Potential System DLL Sideloading From Non System Locations

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

Potential Vivaldi_elf.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "vivaldi_elf.dll"

Potential Waveedit.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

Potential Wazuh Security Platform DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Potential WWlib.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "wwlib.dll"

PowerShell Core DLL Loaded Via Office Application

Aug 12, 2024 · attack.defense-evasion ·

Share on:

Detects PowerShell core DLL being loaded by an Office Product

Python Image Load By Non-Python Process

Aug 12, 2024 · attack.defense-evasion attack.t1027.002 ·

Share on:

Detects the image load of "Python Core" by a non-Python process. This might be indicative of a Python script bundled with Py2Exe.

Remote DLL Load Via Rundll32.EXE

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects a remote DLL load event via "rundll32.exe".

Suspicious Renamed Comsvcs DLL Loaded By Rundll32

Aug 12, 2024 · attack.credential-access attack.defense-evasion attack.t1003.001 ·

Share on:

Detects rundll32 loading a renamed comsvcs.dll to dump process memory

Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.

Suspicious Unsigned Thor Scanner Execution

Aug 12, 2024 · attack.defense-evasion attack.t1574.002 ·

Share on:

Detects loading and execution of an unsigned thor scanner binary.

Suspicious Volume Shadow Copy VSS_PS.dll Load

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1490 ·

Share on:

Detects the image load of vss_ps.dll by uncommon executables

Suspicious Volume Shadow Copy Vssapi.dll Load

Aug 12, 2024 · attack.defense-evasion attack.impact attack.t1490 ·

Share on:

Detects the image load of VSS DLL by uncommon executables

Suspicious WSMAN Provider Image Loads

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·

Share on:

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

Third Party Software DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Time Travel Debugging Utility Usage - Image

Aug 12, 2024 · attack.defense-evasion attack.credential-access attack.t1218 attack.t1003.001 ·

Share on:

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

UAC Bypass Using Iscsicpl - ImageLoad

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1548.002 ·

Share on:

Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%

UAC Bypass With Fake DLL

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1548.002 attack.t1574.002 ·

Share on:

Attempts to load dismcore.dll after dropping it

Unsigned Image Loaded Into LSASS Process

Aug 12, 2024 · attack.credential-access attack.t1003.001 ·

Share on:

Loading unsigned image (DLL, EXE) into LSASS process

Unsigned Mfdetours.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Unsigned Module Loaded by ClickOnce Application

Aug 12, 2024 · attack.persistence attack.t1574.002 ·

Share on:

Detects unsigned module load by ClickOnce application.

VBA DLL Loaded Via Office Application

Aug 12, 2024 · attack.execution attack.t1204.002 ·

Share on:

Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.

VMGuestLib DLL Sideload

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

VMMap Signed Dbghelp.DLL Potential Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

VMMap Unsigned Dbghelp.DLL Potential Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.persistence attack.t1546.003 ·

Share on:

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

WMI Persistence - Command Line Event Consumer

Aug 12, 2024 · attack.t1546.003 attack.persistence ·

Share on:

Detects WMI command line event consumers

WMIC Loading Scripting Libraries

Aug 12, 2024 · attack.defense-evasion attack.t1220 ·

Share on:

Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the /FORMAT argument switch to download and execute an XSL file (i.e js, vbs, etc).

Wmiprvse Wbemcomn DLL Hijack

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.