attack.t1574.001

Potential DLL Sideloading Of Non-Existent DLLs From System Folders

Dec 1, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Detects DLL sideloading of system dlls that are not present on the system by default. Usually to achieve techniques such as UAC bypass and privilege escalation

Lazarus APT DLL Sideloading Activity

Nov 28, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 attack.g0032 detection.emerging_threats ·

Share on:

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Use Of Hidden Paths Or Files

Nov 2, 2023 · attack.defense_evasion attack.t1574.001 ·

Share on:

Detects calls to hidden files or files located in hidden directories in NIX systems.

Potential System DLL Sideloading From Non System Locations

Oct 28, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.)

Creation Of Non-Existent System DLL

Oct 18, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects the creation of system dlls that are not present on the system. Usually to achieve dll hijacking

Potential Initial Access via DLL Search Order Hijacking

Oct 18, 2023 · attack.t1566 attack.t1566.001 attack.initial_access attack.t1574 attack.t1574.001 attack.defense_evasion ·

Share on:

Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Potential ShellDispatch.DLL Sideloading

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "ShellDispatch.dll"

Potential WWlib.DLL Sideloading

Oct 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "wwlib.dll"

Third Party Software DLL Sideloading

Oct 18, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Creation of an WerFault.exe in Unusual Folder

Oct 17, 2023 · attack.persistence attack.defense_evasion attack.t1574.001 ·

Share on:

Detects WerFault copoed to a suspicious folder, which could be a sign of WerFault DLL hijacking

DLL Sideloading Of ShellChromeAPI.DLL

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Potential DLL Sideloading Via ClassicExplorer32.dll

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Potential DLL Sideloading Via comctl32.dll

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using comctl32.dll to obtain system privileges

Potential DLL Sideloading Via JsSchHlp

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

VMGuestLib DLL Sideload

Oct 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.

Pingback Backdoor DLL Loading Activity

Sep 7, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

VMMap Signed Dbghelp.DLL Potential Sideloading

Sep 7, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.

VMMap Unsigned Dbghelp.DLL Potential Sideloading

Sep 7, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Shrpubw Execution from Unexpected File Path

Sep 1, 2023 · attack.persistence attack.t1574 attack.t1574.001 ·

Share on:

Looks for the execution of svchost without the normal -k parameter. Inspired by the 2022 Red Canary Threat Detection report.

Unsigned Mfdetours.DLL Sideloading

Aug 18, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Potential AVKkid.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "AVKkid.dll"

Potential EACore.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "EACore.dll"

Potential Mfdetours.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Potential Vivaldi_elf.DLL Sideloading

Aug 3, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "vivaldi_elf.dll"

Pingback Backdoor Activity

Aug 2, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Potential CCleanerDU.DLL Sideloading

Jul 24, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "CCleanerDU.dll"

Potential CCleanerReactivator.DLL Sideloading

Jul 20, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "CCleanerReactivator.dll"

Potential appverifUI.DLL Sideloading

Jul 13, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "appverifUI.dll"

Pingback Backdoor File Indicators

Jun 20, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·

Share on:

Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Small Sieve Malware CommandLine Indicator

Jun 20, 2023 · attack.persistence attack.t1574.001 detection.emerging_threats ·

Share on:

Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

Potential Waveedit.DLL Sideloading

Jun 15, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.

Potential Edputil.DLL Sideloading

Jun 11, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "edputil.dll"

Potential 7za.DLL Sideloading

Jun 11, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "7za.dll"

Potential RjvPlatform.DLL Sideloading From Default Location

Jun 11, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Potential RjvPlatform.DLL Sideloading From Non-Default Location

Jun 11, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

Potential SmadHook.DLL Sideloading

Jun 2, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Potential Goopdate.DLL Sideloading

May 20, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe

Potential RoboForm.DLL Sideloading

May 15, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Potential Chrome Frame Helper DLL Sideloading

May 15, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "chrome_frame_helper.dll"

Potential Wazuh Security Platform DLL Sideloading

May 15, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE

May 9, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Potential SolidPDFCreator.DLL Sideloading

May 8, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "SolidPDFCreator.dll"

Potential DLL Sideloading Of DBGCORE.DLL

May 5, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of "dbgcore.dll"

Potential DLL Sideloading Of DBGHELP.DLL

May 5, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of "dbghelp.dll"

Potential Libvlc.DLL Sideloading

Apr 17, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

Potential Iviewers.DLL Sideloading

Apr 12, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)

Potential Rcdll.DLL Sideloading

Apr 12, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of rcdll.dll

Aruba Network Service Potential DLL Sideloading

Mar 15, 2023 · attack.privilege_escalation attack.persistence attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Microsoft Office DLL Sideload

Mar 15, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location

Potential Antivirus Software DLL Sideloading

Mar 13, 2023 · attack.defense_evasion attack.persistence attack.privilege_escalation attack.t1574.001 attack.t1574.002 ·

Share on:

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Powerup Write Hijack DLL

Feb 17, 2023 · attack.persistence attack.privilege_escalation attack.defense_evasion attack.t1574.001 ·

Share on:

Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default).

Svchost DLL Search Order Hijack

Feb 14, 2023 · attack.persistence attack.defense_evasion attack.t1574.002 attack.t1574.001 ·

Share on:

Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default. An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote machine.

Fax Service DLL Search Order Hijack

Feb 8, 2023 · attack.persistence attack.defense_evasion attack.t1574.001 attack.t1574.002 ·

Share on:

The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.