Potential EACore.DLL Sideloading
Detects potential DLL sideloading of "EACore.dll"
Sigma rule (View on GitHub)
1title: Potential EACore.DLL Sideloading
2id: edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5
3status: test
4description: Detects potential DLL sideloading of "EACore.dll"
5references:
6 - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
7author: X__Junior (Nextron Systems)
8date: 2023-08-03
9tags:
10 - attack.defense-evasion
11 - attack.privilege-escalation
12 - attack.t1574.001
13logsource:
14 category: image_load
15 product: windows
16detection:
17 selection:
18 ImageLoaded|endswith: '\EACore.dll'
19 filter_main_legit_path:
20 Image|contains|all:
21 - 'C:\Program Files\Electronic Arts\EA Desktop\'
22 - '\EACoreServer.exe'
23 ImageLoaded|startswith: 'C:\Program Files\Electronic Arts\EA Desktop\'
24 condition: selection and not 1 of filter_main_*
25falsepositives:
26 - Unlikely
27level: high
References
-
Executive summary Introduction In early 2023, CPIRT investigated an incident at a European hospital. The investigation showed that the malicious activity observed was likely not targeted but was simply collateral damage from Camaro Dragon’s self-propagating malware infections spreading via USB drives. Camaro Dragon is a Chinese-based espionage threat actor whose operations are actively focused on […]
Read More
Related rules
- Creation Of Non-Existent System DLL
- DLL Search Order Hijackig Via Additional Space in Path
- DLL Sideloading Of ShellChromeAPI.DLL
- Lazarus APT DLL Sideloading Activity
- Malicious DLL File Dropped in the Teams or OneDrive Folder