Exclude Common DLL Loading
Description
Exclude Common DLL Loading
Query · wazuh
field win.eventdata.image="mscorsvw.exe$" AND field win.eventdata.imageLoaded="System.Management.Automation.dll$|System.Management.Automation.ni.dll$"
No license declared
socfortress/Wazuh-Rules publishes no license, and without an express grant the default is all rights reserved. The query above is synthesized from the rule rather than copied out of it, so you can see what the rule matches on; the rule as written stays upstream.
Read the full rule at Exclusion Rules/900000-exclusion_rules.xml ↗. Why this rule is treated this way.
Rule dependencies
Depends on
-
composes · Wazuh if_group
sysmon_eid7_detections- Binary loaded PowerShell automation library - Possible unmanaged Powershell execution by suspicious process
- Printer spooler service loaded a dll file. Possible PrintNightmare exploit: CVE-2021-34527
- Suspicious process loaded VaultCli.dll module. Possible use to dump stored passwords.
- Process loaded taskschd.dll module. May be used to create delayed malware execution
- Mshta loaded taskschd.dll module. May be used to create delayed malware execution
- Office application loaded vbeui.dll module. May be used to execute scripting code
- An executable - - loaded from the Temp directory. · win.eventdata.imageLoaded = (?i)[c-z]:\\\\Windows\\\\Temp\\\\.+\.dll