Windows Cloud Files Filter Loaded by Uncommon Process

name: Windows Cloud Files Filter Loaded by Uncommon Process
id: 77b85062-274e-43a5-9dab-c25862b85291
version: 1
creation_date: '2026-05-18'
modification_date: '2026-05-18'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects cldapi.dll being loaded by a process not associated with legitimate cloud sync activity.
    The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits.
data_source:
    - Sysmon EventID 7
search: |-
    `sysmon`
    EventID=7
    ImageLoaded="*\\cldapi.dll"
    NOT Image IN (
      "*\\box.exe",
      "*\\dropbox.exe",
      "*\\googledrivefs.exe",
      "*\\icloud.exe",
      "*\\onedrive*.exe",
      "*\\Windows\\explorer.exe"
      "*\\Windows\\System32\\*",
      "*\\Windows\\Syswow64\\*",
      "*\\Windows\\WinSxS\\*"
    )
    | stats count min(_time) as firstTime
                    max(_time) as lastTime
        by Computer ImageLoaded EventID dest loaded_file loaded_file_path process_exec
           process_guid process_hash process_id process_name process_path
           service_dll_signature_exists service_dll_signature_verified signature_id user_id
           vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_cloud_files_filter_loaded_by_uncommon_process_filter`
how_to_implement: |-
    To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: |-
    False positives may include other third-party cloud-based file storage software.
    Filter as necessary for your environment.
references:
    - https://www.huntress.com/blog/nightmare-eclipse-intrusion
    - https://www.threatlocker.com/blog/miniplasma-windows-privilege-escalation-zero-day-affects-fully-patched-systems
drilldown_searches:
    - name: View the detection results for - "$dest$"
      search: '%original_detection_search% | search  dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Cloud Files Filter ($ImageLoaded$) loaded by suspicious process $Image$ on $dest$
analytic_story:
    - RedSun
    - BlueHammer
asset_type: Endpoint
mitre_attack_id:
    - T1543.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/redsun/windows-sysmon.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog
      test_type: unit