Query: detect Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc in logs
Matching passage: Sigma rule: Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc. Logsource: windows / image_load. Rule: title: Potential Antivirus Software DLL Sideloading id: 552b6b65-df37-4d3e-a258-f2fc4771ae54 status: test description: Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_bitdefender: ImageLoaded|endswith: \log.dll filter_log_dll_bitdefender: ImageLoaded|startswith: - C:\Program Files\Bitdefender Antivirus Free\ - C:\Program Files (x86)\Bitdefender Antivirus Free\ filter_log_dll_dell_sar: Image: C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe ImageLoaded: - C:\Program Files\Dell\SARemediation\plugin\log.dll - C:\Program Files\Dell\SARemediation\audit\log.dll filter_log_dll_canon: ImageLoaded|startswith: C:\Program Files\Canon\MyPrinter\ filter_log_dll_avast: ImageLoaded: - C:\Program Files\AVAST Software\Avast\log.dll - C:\Program Files (x86)\AVAST Software\Avast\log.dll filter_log_dll_avg: ImageLoaded: - C:\Program Files\AVG\Antivirus\log.dll - C:\Program Files (x86)\AVG\Antivirus\log.dll selection_fsecure: ImageLoaded|endswith: \qrt.dll filter_fsecure: ImageLoaded|startswith: - C:\Program Files\F-Secure\Anti-Virus\ - C:\Program Files (x86)\F-Secure\Anti-Virus\ selection_mcafee: ImageLoaded|endswith: - \ashldres.dll - \lockdown.dll - \vsodscpl.dll filter_mcafee: ImageLoaded|startswith: - C:\Program Files\McAfee\ - C:\Program Files (x86)\McAfee\ selection_cyberark: ImageLoaded|endswith: \vftrace.dll filter_cyberark: ImageLoaded|startswith: - C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\ - C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32\ selection_avast: ImageLoaded|endswith: \wsc.dll filter_wsc_dll_avast: ImageLoaded|startswith: - C:\program Files\AVAST Software\Avast\ - C:\program Files (x86)\AVAST Software\Avast\ filter_wsc_dll_avg: ImageLoaded|startswith: - C:\Program Files\AVG\Antivirus\ - C:\Program Files (x86)\AVG\Antivirus\ selection_eset_deslock: ImageLoaded|endswith: \DLPPREM32.dll filter_eset_deslock: ImageLoaded|startswith: - C:\program Files\ESET - C:\program Files (x86)\ESET selection_titanium: ImageLoaded|endswith: \tmdbglog.dll filter_titanium: ImageLoaded|startswith: - C:\program Files\Trend
Near-miss passage: Sigma rule: Detects activity when a member is removed from a security-enabled global group. Logsource: windows / security. Rule: title: A Member Was Removed From a Security-Enabled Global Group id: 02c39d30-02b5-45d2-b435-8aebfe5a8629 related: - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e type: obsolete status: stable description: Detects activity when a member is removed from a security-enabled global group references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633 author: Alexandr Yampolskyi, SOC Prime date: 2023-04-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: - 633 - 4729 condition: selection falsepositives: - Unknown level: low