Potential Chrome Frame Helper DLL Sideloading
Detects potential DLL sideloading of "chrome_frame_helper.dll"
Sigma rule (View on GitHub)
1title: Potential Chrome Frame Helper DLL Sideloading
2id: 72ca7c75-bf85-45cd-aca7-255d360e423c
3status: experimental
4description: Detects potential DLL sideloading of "chrome_frame_helper.dll"
5references:
6 - https://hijacklibs.net/entries/3rd_party/google/chrome_frame_helper.html
7author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
8date: 2022/08/17
9modified: 2023/05/15
10tags:
11 - attack.defense_evasion
12 - attack.persistence
13 - attack.privilege_escalation
14 - attack.t1574.001
15 - attack.t1574.002
16logsource:
17 category: image_load
18 product: windows
19detection:
20 selection:
21 ImageLoaded|endswith: '\chrome_frame_helper.dll'
22 filter_main_path:
23 ImageLoaded|startswith:
24 - 'C:\Program Files\Google\Chrome\Application\'
25 - 'C:\Program Files (x86)\Google\Chrome\Application\'
26 filter_optional_user_path:
27 ImageLoaded|contains: '\AppData\local\Google\Chrome\Application\'
28 condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
29falsepositives:
30 - Unknown
31level: medium
References
Related rules
- Potential Wazuh Security Platform DLL Sideloading
- Potential SolidPDFCreator.DLL Sideloading
- Powerup Write Hijack DLL
- Fax Service DLL Search Order Hijack
- UAC Bypass With Fake DLL