attack.t1574.001

Lazarus APT DLL Sideloading Activity

Sep 2, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 attack.g0032 detection.emerging-threats ·

Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Aruba Network Service Potential DLL Sideloading

Aug 12, 2024 · attack.privilege-escalation attack.persistence attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Creation of an WerFault.exe in Unusual Folder

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 ·

Share on:

Detects WerFault copoed to a suspicious folder, which could be a sign of WerFault DLL hijacking

Creation Of Non-Existent System DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). Usually this technique is used to achieve DLL hijacking.

DLL Sideloading Of ShellChromeAPI.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Fax Service DLL Search Order Hijack

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1574.001 attack.t1574.002 ·

Share on:

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

HackTool - Powerup Write Hijack DLL

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1574.001 ·

Share on:

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

Microsoft Office DLL Sideload

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Pingback Backdoor Activity

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Pingback Backdoor DLL Loading Activity

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Pingback Backdoor File Indicators

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Potential 7za.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "7za.dll"

Potential Antivirus Software DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Potential appverifUI.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "appverifUI.dll"

Potential AVKkid.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "AVKkid.dll"

Potential CCleanerDU.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Potential CCleanerReactivator.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Potential Chrome Frame Helper DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Potential DLL Sideloading Of DBGCORE.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of "dbgcore.dll"

Potential DLL Sideloading Of DBGHELP.DLL

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "dbghelp.dll"

Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Potential DLL Sideloading Of Non-Existent DLLs From System Folders

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories). Usually this technique is used to achieve UAC bypass or privilege escalation.

Potential DLL Sideloading Via ClassicExplorer32.dll

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Potential DLL Sideloading Via comctl32.dll

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Potential DLL Sideloading Via JsSchHlp

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Potential EACore.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "EACore.dll"

Potential Edputil.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "edputil.dll"

Potential Goopdate.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Potential Initial Access via DLL Search Order Hijacking

Aug 12, 2024 · attack.t1566 attack.t1566.001 attack.initial-access attack.t1574 attack.t1574.001 attack.defense-evasion ·

Share on:

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Potential Iviewers.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Potential Libvlc.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

Potential Mfdetours.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Potential Raspberry Robin Aclui Dll SideLoading

Aug 12, 2024 · detection.emerging-threats attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.

Potential Rcdll.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of rcdll.dll

Potential RjvPlatform.DLL Sideloading From Default Location

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Potential RjvPlatform.DLL Sideloading From Non-Default Location

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

Potential RoboForm.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Potential ShellDispatch.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "ShellDispatch.dll"

Potential SmadHook.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Potential SolidPDFCreator.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Potential System DLL Sideloading From Non System Locations

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

Potential Vivaldi_elf.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "vivaldi_elf.dll"

Potential Waveedit.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

Potential Wazuh Security Platform DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Potential WWlib.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "wwlib.dll"

Small Sieve Malware CommandLine Indicator

Aug 12, 2024 · attack.persistence attack.t1574.001 detection.emerging-threats ·

Share on:

Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

Third Party Software DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Unsigned Mfdetours.DLL Sideloading

Aug 12, 2024 · attack.defense-evasion attack.privilege-escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.