Potential Vivaldi_elf.DLL Sideloading
Detects potential DLL sideloading of "vivaldi_elf.dll"
Sigma rule (View on GitHub)
1title: Potential Vivaldi_elf.DLL Sideloading
2id: 2092cacb-d77b-4f98-ab0d-32b32f99a054
3status: test
4description: Detects potential DLL sideloading of "vivaldi_elf.dll"
5references:
6 - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
7author: X__Junior (Nextron Systems)
8date: 2023-08-03
9tags:
10 - attack.defense-evasion
11 - attack.privilege-escalation
12 - attack.t1574.001
13logsource:
14 category: image_load
15 product: windows
16detection:
17 selection:
18 ImageLoaded|endswith: '\vivaldi_elf.dll'
19 filter_main_legit_path:
20 Image|endswith: '\Vivaldi\Application\vivaldi.exe'
21 ImageLoaded|contains: '\Vivaldi\Application\'
22 condition: selection and not 1 of filter_main_*
23falsepositives:
24 - Unknown
25level: medium
References
-
Executive summary Introduction In early 2023, CPIRT investigated an incident at a European hospital. The investigation showed that the malicious activity observed was likely not targeted but was simply collateral damage from Camaro Dragon’s self-propagating malware infections spreading via USB drives. Camaro Dragon is a Chinese-based espionage threat actor whose operations are actively focused on […]
Read More
Related rules
- Creation Of Non-Existent System DLL
- DLL Search Order Hijackig Via Additional Space in Path
- DLL Sideloading Of ShellChromeAPI.DLL
- Lazarus APT DLL Sideloading Activity
- Malicious DLL File Dropped in the Teams or OneDrive Folder