Potential Rcdll.DLL Sideloading

 1title: Potential Rcdll.DLL Sideloading
 2id: 6e78b74f-c762-4800-82ad-f66787f10c8a
 3status: test
 4description: Detects potential DLL sideloading of rcdll.dll
 5references:
 6    - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
 7author: X__Junior (Nextron Systems)
 8date: 2023-03-13
 9modified: 2023-03-15
10tags:
11    - attack.defense-evasion
12    - attack.privilege-escalation
13    - attack.t1574.001
14    - attack.t1574.002
15logsource:
16    category: image_load
17    product: windows
18detection:
19    selection:
20        ImageLoaded|endswith: '\rcdll.dll'
21    filter:
22        ImageLoaded|startswith:
23            - 'C:\Program Files (x86)\Microsoft Visual Studio\'
24            - 'C:\Program Files (x86)\Windows Kits\'
25    condition: selection and not filter
26falsepositives:
27    - Unknown
28level: high

References

• Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting

  

  We detail the update that advanced persistent threat (APT) group Iron Tiger made on the custom malware family SysUpdate. In this version, we also found components that enable the malware to compromise Linux systems.

  
  Read More

Related rules

• Creation Of Non-Existent System DLL
• DLL Sideloading Of ShellChromeAPI.DLL
• Microsoft Office DLL Sideload
• Potential 7za.DLL Sideloading
• Potential AVKkid.DLL Sideloading