Untrusted DLL Loaded by a Persistent Program

Description

Identifies the load of an untrusted DLL by a persistent trusted binary. This behavior may indicate that an existing persistent program is sideloading a malicious DLL.

Query · eql

sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  (
    /* programs started shortly after user logon like startup items */
   (process.parent.executable : "?:\\Windows\\Explorer.exe" and process.Ext.session_info.relative_logon_time <= 100) or

   /* scheduled tasks */
   (process.parent.name : "svchost.exe" and process.parent.args : "Schedule") or

    /* services */
    process.parent.executable : "?:\\Windows\\System32\\services.exe"
   ) and
  not (process.executable :
             ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe", "?:\\Windows\\Explorer.exe",
              "?:\\Windows\\SysWOW64\\*", "?:\\Windows\\System32\\*", "?:\\Windows\\splwow64.exe", "?:\\Windows\\Microsoft.NET\\*") and
              not process.name : ("rundll32.exe", "regsvr32.exe")) and
  process.executable : "C:\\*"]
[library where

   (dll.Ext.relative_file_creation_time < 5000 or dll.Ext.relative_file_name_modify_time < 5000 ) and dll.name : "*.dll" and

   process.code_signature.status :"trusted" and not dll.code_signature.status : ("trusted", "errorCode_endpoint*") and
   dll.hash.sha256 != null and
   not (dll.path : ("?:\\Windows\\Installer\\*",
                   "?:\\Windows\\System32\\DriverStore\\FileRepository\\*",
                   "?:\\Windows\\SysWOW64\\DriverStore\\FileRepository\\*",
                   "?:\\Program Files\\*", "?:\\Program Files (x86)\\*",
                   "?:\\Windows\\assembly\\*",
                   "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*") and not process.name : ("regsvr32.exe", "rundll32.exe")) and
   not process.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe", "?:\\Windows\\System32\\msiexec.exe") and
   not dll.hash.sha256 :
             ("8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8",
              "06cad1e73c3e0976d3b85df7299891a6bf3fadd166972af431e74673305ea12a",
              "5b175330539eb0911e1cce8c94892fdf728ad67fc593866a7efe80e68b92d86a",
              "2120b986bed79dba90c3fa91f0d1e577e500e9674d9a329307872bfc9eb7db95",
              "c923980eab8e1a02608fa5e01f7658fd4a036180fe2c292cbf886e8a7813e9e6",
              "d6dd5739fc1a02f7cc284b8957d7412800ded255f2c5b5a736f3a2742c046de6",
              "35e5768a738ff9d172bc75261a31dba48b7718c5c71fabffbba7fb1ed5427cb6", 
              "917aa103ee56f1a7929b24b06678aadf15809601bd07ac711c2f1dafb3ecb909", 
              "05fdd60cb09e1d43c0a0097f7ff683d81dfaad2653637686b1668a7d2acc6df9", 
              "fc2b6d0f9e4af39e3892ddbdc08ac13640042112e6188482a7c1fb94454e8f52",
              "63588b11dfee771e6114188883bee4310872a7ebfb8b4c45db8307f9e1791e55",
              "76f19b52423774932831dcba0596989ec56213f9b217a0432fbc122f99704a2a",
              "26dad78da7bfb24d2046f3aa86f6fe779844fb3681baaeeca08404f4ab9fdbf0",
              "33e70c386def674726997fc0a8df13febc54c5aa3338dd20f0b72bc1aa1d9a90",
              "a5a8987d32bde392688bf8edba95b6ba2b6489d9caf7a039ae5b3494db7d0bee",
              "b83d2753d39343fb75f1ce3b81664569a5558fd097ca8d75a43c7adee544ed1f",
              "87adacbb25035066422d22c327516dc1916624b8967dca1bfa271b94e2a7af97",
              "c64d6ce488c9f9b00cda6cdfd2de2a6fa30b40315ac818247d237a925059d7ea",
              "19be195104c5b277f91b05664b192a3be17173bab68d7300098dc7db16538398",
              "d2e14ef693f6a663c2ad657c75b048e4d6febd85b860c652be8711b95ee129aa",
              "b515718a183a845b043c80e6c2647f4ec3620bdf231b7dc5662c96d06ded9290",
              "35bcddf8c134e26faad82ddf7c29c8d043a730b11c1014c66731998be041bd76",
              "7b873201c26858d889cf891464e77b1f3fc478d025e56b75f07ff2b3f64eb209",
              "0cde7b49bc46cc5d2e25e760709431c3ade1c5bf9e1bc5acec239760aff03ccf",
              "ac7c6f8091f06f99ebc9aedd0e6e5d60509e174746510c5c2f6466e9f29d547a",
              "6e0063b9bbf38556325669d975707499add784bd47c7d053b75eb4f076685d1c", 
              "51b82e3994b6ac4279914579bb75d06121e211d24b54a9ce5ad64101778f6fbb", 
              "a6f2eaba3d776ee23976579c83486057b457d2ea17d2555fe2841b7d178237e4", 
              "483e1f8314839fe1280db4c4c74a20d66868535856a8a64da542fee09adeac12", 
              "75b1359a24ea27a8798e0a0ef43ea9ad93e5cdfaf3872d40cb8292a0c8c2c3da", 
              "7bc542b772dd5fe2efdd84b6262eeadf4c03976af4860c9431027f7a26ba20dd", 
              "9c5e11214b88feeefa0649ec267951ec193fd67a3cc0ea08efe83c2542f0465f", 
              "2250edf8968f04eefc1b10502a7a6f5a70461127e892c9f8cdb460d16065b01b", 
              "e2908dec495cc6e621358eb7c5d41403f25eb4bdbf3802866eadea378422d412", 
              "adfe16ce618fd1be24fe5764934f118d4b7d248eb838bc9dedca5114d8f94199") and
   not dll.pe.imphash :
              ("c1c7505e1e6e929ebb6b9100e55b050a",
               "6ed82d3226365ffafff2c57c1935d352",
               "4c12041ee3b1492f5ec25875e818c034",
               "d41d8cd98f00b204e9800998ecf8427e",
               "14338d2168d869b1b53d66354179e8c5",
               "2708b225750647f95ffa2ede70f97f32",
               "dae02f32a21e03ce65412f6e56942daa") and
   not (process.executable :
             ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe", "?:\\Windows\\Explorer.exe",
              "?:\\Windows\\SysWOW64\\*", "?:\\Windows\\System32\\*", "?:\\Windows\\splwow64.exe", "?:\\Windows\\Microsoft.NET\\*") and
              not process.name : ("rundll32.exe", "regsvr32.exe")) and
   not (dll.name : "*.tmp" and not process.name : ("regsvr32.exe", "rundll32.exe")) and

   /* DLL loaded from the process.executable current directory */
   (endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1))) and
    not process.name : ("regsvr32.exe", "rundll32.exe")) and

    not (process.code_signature.subject_name:
                        ("Johannes Schindelin",
                         "Datto Inc",
                         "IFS World Operations AB",
                         "RingCentral, Inc.", "Net Health Systems, Inc.",
                         "Mobatek",
                         "Red Gate Software Ltd",
                         "Signal Messenger, LLC",
                         "KYLIN INC.",
                         "Cricut, Inc.",
                         "Clevercontrol LLC",
                         "VNG CORPORATION",
                         "Connectwise, LLC",
                         "PreVeil, Inc",
                         "RICOH COMPANY,LTD.",
                         "ONELAUNCH TECHNOLOGIES INC.",
                         "Overjet, Inc.",
                         "BANDAI NAMCO Online Inc.",
                         "Jade Software Corporation Limited",
                         "Freshworks Inc",
                         "8bit Solutions LLC",
                         "Canon Electronics Inc.",
                         "OPERIS SAS",
                         "TD Ameritrade",
                         "INTEGRATED COMPUTER SYSTEMS, INC.",
                         "KYOCERA Document Solutions Inc.",
                         "Conexant Systems LLC",
                         "Lenovo",
                         "Paessler AG",
                         "Rainberry Inc",
                         "Fibocom Wireless Inc.",
                         "Fiserv",
                         "Rocket.Chat Technologies Corp.",
                         "Solarwinds Worldwide, LLC",
                         "Milsoft Utility Solutions, Inc.",
                         "Talkdesk, Inc.",
                         "Amazon.com Services LLC",
                         "Canva",
                         "Wondershare Technology Group Co.,Ltd",
                         "Jade Software Corporation Ltd",
                         "Ivanti, Inc.",
                         "The Reynolds and Reynolds Company",
                         "Brother Industries, Ltd.",
                         "FrontApp, Inc.",
                         "The Neat Company, Inc.",
                         "Environmental Systems Research Institute, Inc.",
                         "CANON INC.",
                         "Micro Focus International plc",
                         "Mattermost, Inc.",
                         "PFU Limited",
                         "Poised Inc",
                         "Loom, Inc.",
                         "NUUO Inc.",
                         "Tencent Technology(Shenzhen) Company Limited",
                         "TEDDYSOFT OOD",
                         "The MathWorks, Inc.",
                         "Exclaimer Ltd") and process.code_signature.trusted == true)]
Raw source Untrusted DLL Loaded by a Persistent Program · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = """
Identifies the load of an untrusted DLL by a persistent trusted binary. This behavior may indicate that an existing
persistent program is sideloading a malicious DLL.
"""
id = "29007eb1-40d9-47fa-82c0-d862db0586b4"
license = "Elastic License v2"
name = "Untrusted DLL Loaded by a Persistent Program"
os_list = ["windows"]
version = "1.0.29"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  (
    /* programs started shortly after user logon like startup items */
   (process.parent.executable : "?:\\Windows\\Explorer.exe" and process.Ext.session_info.relative_logon_time <= 100) or

   /* scheduled tasks */
   (process.parent.name : "svchost.exe" and process.parent.args : "Schedule") or

    /* services */
    process.parent.executable : "?:\\Windows\\System32\\services.exe"
   ) and
  not (process.executable :
             ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe", "?:\\Windows\\Explorer.exe",
              "?:\\Windows\\SysWOW64\\*", "?:\\Windows\\System32\\*", "?:\\Windows\\splwow64.exe", "?:\\Windows\\Microsoft.NET\\*") and
              not process.name : ("rundll32.exe", "regsvr32.exe")) and
  process.executable : "C:\\*"]
[library where

   (dll.Ext.relative_file_creation_time < 5000 or dll.Ext.relative_file_name_modify_time < 5000 ) and dll.name : "*.dll" and

   process.code_signature.status :"trusted" and not dll.code_signature.status : ("trusted", "errorCode_endpoint*") and
   dll.hash.sha256 != null and
   not (dll.path : ("?:\\Windows\\Installer\\*",
                   "?:\\Windows\\System32\\DriverStore\\FileRepository\\*",
                   "?:\\Windows\\SysWOW64\\DriverStore\\FileRepository\\*",
                   "?:\\Program Files\\*", "?:\\Program Files (x86)\\*",
                   "?:\\Windows\\assembly\\*",
                   "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*") and not process.name : ("regsvr32.exe", "rundll32.exe")) and
   not process.executable : ("?:\\Windows\\SysWOW64\\msiexec.exe", "?:\\Windows\\System32\\msiexec.exe") and
   not dll.hash.sha256 :
             ("8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8",
              "06cad1e73c3e0976d3b85df7299891a6bf3fadd166972af431e74673305ea12a",
              "5b175330539eb0911e1cce8c94892fdf728ad67fc593866a7efe80e68b92d86a",
              "2120b986bed79dba90c3fa91f0d1e577e500e9674d9a329307872bfc9eb7db95",
              "c923980eab8e1a02608fa5e01f7658fd4a036180fe2c292cbf886e8a7813e9e6",
              "d6dd5739fc1a02f7cc284b8957d7412800ded255f2c5b5a736f3a2742c046de6",
              "35e5768a738ff9d172bc75261a31dba48b7718c5c71fabffbba7fb1ed5427cb6", 
              "917aa103ee56f1a7929b24b06678aadf15809601bd07ac711c2f1dafb3ecb909", 
              "05fdd60cb09e1d43c0a0097f7ff683d81dfaad2653637686b1668a7d2acc6df9", 
              "fc2b6d0f9e4af39e3892ddbdc08ac13640042112e6188482a7c1fb94454e8f52",
              "63588b11dfee771e6114188883bee4310872a7ebfb8b4c45db8307f9e1791e55",
              "76f19b52423774932831dcba0596989ec56213f9b217a0432fbc122f99704a2a",
              "26dad78da7bfb24d2046f3aa86f6fe779844fb3681baaeeca08404f4ab9fdbf0",
              "33e70c386def674726997fc0a8df13febc54c5aa3338dd20f0b72bc1aa1d9a90",
              "a5a8987d32bde392688bf8edba95b6ba2b6489d9caf7a039ae5b3494db7d0bee",
              "b83d2753d39343fb75f1ce3b81664569a5558fd097ca8d75a43c7adee544ed1f",
              "87adacbb25035066422d22c327516dc1916624b8967dca1bfa271b94e2a7af97",
              "c64d6ce488c9f9b00cda6cdfd2de2a6fa30b40315ac818247d237a925059d7ea",
              "19be195104c5b277f91b05664b192a3be17173bab68d7300098dc7db16538398",
              "d2e14ef693f6a663c2ad657c75b048e4d6febd85b860c652be8711b95ee129aa",
              "b515718a183a845b043c80e6c2647f4ec3620bdf231b7dc5662c96d06ded9290",
              "35bcddf8c134e26faad82ddf7c29c8d043a730b11c1014c66731998be041bd76",
              "7b873201c26858d889cf891464e77b1f3fc478d025e56b75f07ff2b3f64eb209",
              "0cde7b49bc46cc5d2e25e760709431c3ade1c5bf9e1bc5acec239760aff03ccf",
              "ac7c6f8091f06f99ebc9aedd0e6e5d60509e174746510c5c2f6466e9f29d547a",
              "6e0063b9bbf38556325669d975707499add784bd47c7d053b75eb4f076685d1c", 
              "51b82e3994b6ac4279914579bb75d06121e211d24b54a9ce5ad64101778f6fbb", 
              "a6f2eaba3d776ee23976579c83486057b457d2ea17d2555fe2841b7d178237e4", 
              "483e1f8314839fe1280db4c4c74a20d66868535856a8a64da542fee09adeac12", 
              "75b1359a24ea27a8798e0a0ef43ea9ad93e5cdfaf3872d40cb8292a0c8c2c3da", 
              "7bc542b772dd5fe2efdd84b6262eeadf4c03976af4860c9431027f7a26ba20dd", 
              "9c5e11214b88feeefa0649ec267951ec193fd67a3cc0ea08efe83c2542f0465f", 
              "2250edf8968f04eefc1b10502a7a6f5a70461127e892c9f8cdb460d16065b01b", 
              "e2908dec495cc6e621358eb7c5d41403f25eb4bdbf3802866eadea378422d412", 
              "adfe16ce618fd1be24fe5764934f118d4b7d248eb838bc9dedca5114d8f94199") and
   not dll.pe.imphash :
              ("c1c7505e1e6e929ebb6b9100e55b050a",
               "6ed82d3226365ffafff2c57c1935d352",
               "4c12041ee3b1492f5ec25875e818c034",
               "d41d8cd98f00b204e9800998ecf8427e",
               "14338d2168d869b1b53d66354179e8c5",
               "2708b225750647f95ffa2ede70f97f32",
               "dae02f32a21e03ce65412f6e56942daa") and
   not (process.executable :
             ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe", "?:\\Windows\\Explorer.exe",
              "?:\\Windows\\SysWOW64\\*", "?:\\Windows\\System32\\*", "?:\\Windows\\splwow64.exe", "?:\\Windows\\Microsoft.NET\\*") and
              not process.name : ("rundll32.exe", "regsvr32.exe")) and
   not (dll.name : "*.tmp" and not process.name : ("regsvr32.exe", "rundll32.exe")) and

   /* DLL loaded from the process.executable current directory */
   (endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1))) and
    not process.name : ("regsvr32.exe", "rundll32.exe")) and

    not (process.code_signature.subject_name:
                        ("Johannes Schindelin",
                         "Datto Inc",
                         "IFS World Operations AB",
                         "RingCentral, Inc.", "Net Health Systems, Inc.",
                         "Mobatek",
                         "Red Gate Software Ltd",
                         "Signal Messenger, LLC",
                         "KYLIN INC.",
                         "Cricut, Inc.",
                         "Clevercontrol LLC",
                         "VNG CORPORATION",
                         "Connectwise, LLC",
                         "PreVeil, Inc",
                         "RICOH COMPANY,LTD.",
                         "ONELAUNCH TECHNOLOGIES INC.",
                         "Overjet, Inc.",
                         "BANDAI NAMCO Online Inc.",
                         "Jade Software Corporation Limited",
                         "Freshworks Inc",
                         "8bit Solutions LLC",
                         "Canon Electronics Inc.",
                         "OPERIS SAS",
                         "TD Ameritrade",
                         "INTEGRATED COMPUTER SYSTEMS, INC.",
                         "KYOCERA Document Solutions Inc.",
                         "Conexant Systems LLC",
                         "Lenovo",
                         "Paessler AG",
                         "Rainberry Inc",
                         "Fibocom Wireless Inc.",
                         "Fiserv",
                         "Rocket.Chat Technologies Corp.",
                         "Solarwinds Worldwide, LLC",
                         "Milsoft Utility Solutions, Inc.",
                         "Talkdesk, Inc.",
                         "Amazon.com Services LLC",
                         "Canva",
                         "Wondershare Technology Group Co.,Ltd",
                         "Jade Software Corporation Ltd",
                         "Ivanti, Inc.",
                         "The Reynolds and Reynolds Company",
                         "Brother Industries, Ltd.",
                         "FrontApp, Inc.",
                         "The Neat Company, Inc.",
                         "Environmental Systems Research Institute, Inc.",
                         "CANON INC.",
                         "Micro Focus International plc",
                         "Mattermost, Inc.",
                         "PFU Limited",
                         "Poised Inc",
                         "Loom, Inc.",
                         "NUUO Inc.",
                         "Tencent Technology(Shenzhen) Company Limited",
                         "TEDDYSOFT OOD",
                         "The MathWorks, Inc.",
                         "Exclaimer Ltd") and process.code_signature.trusted == true)]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1574"
name = "Hijack Execution Flow"
reference = "https://attack.mitre.org/techniques/T1574/"
[[threat.technique.subtechnique]]
id = "T1574.001"
name = "DLL"
reference = "https://attack.mitre.org/techniques/T1574/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.