Potential Vivaldi_elf.DLL Sideloading
Detects potential DLL sideloading of "vivaldi_elf.dll"
Sigma rule (View on GitHub)
1title: Potential Vivaldi_elf.DLL Sideloading
2id: 2092cacb-d77b-4f98-ab0d-32b32f99a054
3status: test
4description: Detects potential DLL sideloading of "vivaldi_elf.dll"
5references:
6 - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
7author: X__Junior (Nextron Systems)
8date: 2023-08-03
9tags:
10 - attack.defense-evasion
11 - attack.privilege-escalation
12 - attack.t1574.001
13 - attack.t1574.002
14logsource:
15 category: image_load
16 product: windows
17detection:
18 selection:
19 ImageLoaded|endswith: '\vivaldi_elf.dll'
20 filter_main_legit_path:
21 Image|endswith: '\Vivaldi\Application\vivaldi.exe'
22 ImageLoaded|contains: '\Vivaldi\Application\'
23 condition: selection and not 1 of filter_main_*
24falsepositives:
25 - Unknown
26level: medium
References
-
Executive summary Introduction In early 2023, CPIRT investigated an incident at a European hospital. The investigation showed that the malicious activity observed was likely not targeted but was simply collateral damage from Camaro Dragon’s self-propagating malware infections spreading via USB drives. Camaro Dragon is a Chinese-based espionage threat actor whose operations are actively focused on […]
Read More
Related rules
- Creation Of Non-Existent System DLL
- DLL Sideloading Of ShellChromeAPI.DLL
- Microsoft Office DLL Sideload
- Potential 7za.DLL Sideloading
- Potential AVKkid.DLL Sideloading