Potential SolidPDFCreator.DLL Sideloading
Detects potential DLL sideloading of "SolidPDFCreator.dll"
Sigma rule (View on GitHub)
1title: Potential SolidPDFCreator.DLL Sideloading
2id: a2edbce1-95c8-4291-8676-0d45146862b3
3status: test
4description: Detects potential DLL sideloading of "SolidPDFCreator.dll"
5references:
6 - https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/
7author: X__Junior (Nextron Systems)
8date: 2023/05/07
9tags:
10 - attack.defense_evasion
11 - attack.privilege_escalation
12 - attack.t1574.001
13 - attack.t1574.002
14logsource:
15 category: image_load
16 product: windows
17detection:
18 selection:
19 ImageLoaded|endswith: '\SolidPDFCreator.dll'
20 filter_main_path:
21 Image|endswith: '\SolidPDFCreator.exe'
22 ImageLoaded|startswith:
23 - 'C:\Program Files (x86)\SolidDocuments\SolidPDFCreator\'
24 - 'C:\Program Files\SolidDocuments\SolidPDFCreator\'
25 condition: selection and not 1 of filter_main_*
26falsepositives:
27 - Unknown
28level: medium
References
Related rules
- Potential Chrome Frame Helper DLL Sideloading
- Potential Goopdate.DLL Sideloading
- Potential RoboForm.DLL Sideloading
- Potential SmadHook.DLL Sideloading
- Potential WWlib.DLL Sideloading