Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

 1title: Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE
 2id: e49b5745-1064-4ac1-9a2e-f687bc2dd37e
 3status: test
 4description: Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location
 5references:
 6    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2023-05-05
 9tags:
10    - attack.persistence
11    - attack.privilege-escalation
12    - attack.execution
13    - attack.stealth
14    - attack.t1574.001
15logsource:
16    category: image_load
17    product: windows
18detection:
19    selection:
20        Image|endswith: '\gup.exe'
21        ImageLoaded|endswith: '\libcurl.dll'
22    filter_main_notepad_plusplus:
23        Image|endswith: '\Notepad++\updater\GUP.exe'
24    condition: selection and not 1 of filter_main_*
25falsepositives:
26    - Unknown
27level: medium