Query: Sigma rule for Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
Matching passage: Sigma rule: Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location. Logsource: windows / image_load. Rule: title: Microsoft Office DLL Sideload id: 829a3bdf-34da-4051-9cf4-8ed221a8ae4f status: test description: Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 modified: 2023-03-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \outllib.dll filter: ImageLoaded|startswith: - C:\Program Files\Microsoft Office\OFFICE - C:\Program Files (x86)\Microsoft Office\OFFICE - C:\Program Files\Microsoft Office\Root\OFFICE - C:\Program Files (x86)\Microsoft Office\Root\OFFICE condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects AdFind execution with common flags seen used during attacks. Logsource: windows / process_creation. Rule: title: PUA - AdFind Suspicious Execution id: 9a132afa-654e-11eb-ae93-0242ac130002 related: - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b type: similar - id: 75df3b17-8bcc-4565-b89b-c9898acef911 type: obsolete status: test description: Detects AdFind execution with common flags seen used during attacks references: - https://www.joeware.net/freetools/tools/adfind/ - https://thedfirreport.com/2020/05/08/adfind-recon/ - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx - https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community date: 2021-02-02 modified: 2025-10-24 tags: - attack.discovery - attack.t1018 - attack.t1087.002 - attack.t1482 - attack.t1069.002 - stp.1u logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - domainlist - trustdmp - dcmodes - adinfo - -sc dclist - computer_pwdnotreqd - objectcategory= - -subnets -f - name="Domain Admins" - '-sc u:' - domainncs - dompol - ' oudmp ' - subnetdmp - gpodmp - fspdmp - users_noexpire - computers_active - computers_pwdnotreqd condition: selection falsepositives: - Legitimate admin activity level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage/info.yml simulation: - type: atomic-red-team name: Adfind - Enumerate Active Directory Computer Objects technique: T1018 atomic_guid: a889f5be-2d54-4050-bd05-884578748bb4 - type: atomic-red-team name: Adfind - Enumerate Active Directory Domain Controller Objects technique: T1018 atomic_guid: 5838c31e-a0e2-4b9f-b60a-d79d2cb7995e