Query: rule covering Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can by
Matching passage: Sigma rule: Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can by. Logsource: windows / image_load. Rule: title: Trusted Path Bypass via Windows Directory Spoofing id: 0cbe38c0-270c-41d9-ab79-6e5a9a669290 related: - id: 4ac47ed3-44c2-4b1f-9d51-bf46e8914126 type: similar status: experimental description: 'Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC. ' references: - https://x.com/Wietze/status/1933495426952421843 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.007 - attack.t1548.002 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains: - :\Windows \System32\ - :\Windows \SysWOW64\ condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicio. Logsource: windows / process_creation. Rule: title: Suspicious Microsoft OneNote Child Process id: c27515df-97a9-4162-8a60-dc0eeb51b775 related: - id: 438025f9-5856-4663-83f7-52f878a70a50 type: derived status: test description: Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file. references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-e34e43eb5666427602ddf488b2bf3b545bd9aae81af3e6f6c7949f9652abdf18 - https://micahbabinski.medium.com/detecting-onenote-one-malware-delivery-407e9321ecf0 author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea) date: 2022-10-21 modified: 2023-02-10 tags: - attack.t1566 - attack.t1566.001 - attack.initial-access logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \onenote.exe selection_opt_img: - OriginalFileName: - bitsadmin.exe - CertOC.exe - CertUtil.exe - Cmd.Exe - CMSTP.EXE - cscript.exe - curl.exe - HH.exe - IEExec.exe - InstallUtil.exe - javaw.exe - Microsoft.Workflow.Compiler.exe - msdt.exe - MSHTA.EXE - msiexec.exe - Msxsl.exe - odbcconf.exe - pcalua.exe - PowerShell.EXE - RegAsm.exe - RegSvcs.exe - REGSVR32.exe - RUNDLL32.exe - schtasks.exe - ScriptRunner.exe - wmic.exe - WorkFolders.exe - wscript.exe - Image|endswith: - \AppVLP.exe - \bash.exe - \bitsadmin.exe - \certoc.exe - \certutil.exe - \cmd.exe - \cmstp.exe - \control.exe - \cscript.exe - \curl.exe - \forfiles.exe - \hh.exe - \ieexec.exe - \installutil.exe - \javaw.exe - \mftrace.exe - \Microsoft.Workflow.Compiler.exe - \msbuild.exe - \msdt.exe - \mshta.exe - \msidb.exe - \msiexec.exe - \msxsl.exe - \odbcconf.exe - \pcalua.exe - \powershell.exe - \pwsh.exe - \regasm.exe - \regsvcs.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \svchost.exe - \verclsid.exe - \wmic.exe - \workfolders.exe - \wscript.exe selection_opt_explorer: Image|endswith: \explorer.exe CommandLine|contains: - .hta - .vb - .wsh - .js - .ps - .scr - .pif - .bat - .cmd selection_opt_paths: Image|contains: - \AppData\ - \Users\Public\ - \ProgramData\ - \Windows\Tasks\ - \Windows\Temp\ - \Windows\System32\Tasks\ filter_teams: Image|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe CommandLine|endswith: -Embedding filter_onedrive: Image|contains: \AppData\Local\Microsoft\OneDrive\ Image|endswith: \FileCoAuth.exe CommandLine|endswith