Query: Sigma rule for Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc
Matching passage: Sigma rule: Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc. Logsource: windows / image_load. Rule: title: Potential Antivirus Software DLL Sideloading id: 552b6b65-df37-4d3e-a258-f2fc4771ae54 status: test description: Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_bitdefender: ImageLoaded|endswith: \log.dll filter_log_dll_bitdefender: ImageLoaded|startswith: - C:\Program Files\Bitdefender Antivirus Free\ - C:\Program Files (x86)\Bitdefender Antivirus Free\ filter_log_dll_dell_sar: Image: C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe ImageLoaded: - C:\Program Files\Dell\SARemediation\plugin\log.dll - C:\Program Files\Dell\SARemediation\audit\log.dll filter_log_dll_canon: ImageLoaded|startswith: C:\Program Files\Canon\MyPrinter\ filter_log_dll_avast: ImageLoaded: - C:\Program Files\AVAST Software\Avast\log.dll - C:\Program Files (x86)\AVAST Software\Avast\log.dll filter_log_dll_avg: ImageLoaded: - C:\Program Files\AVG\Antivirus\log.dll - C:\Program Files (x86)\AVG\Antivirus\log.dll selection_fsecure: ImageLoaded|endswith: \qrt.dll filter_fsecure: ImageLoaded|startswith: - C:\Program Files\F-Secure\Anti-Virus\ - C:\Program Files (x86)\F-Secure\Anti-Virus\ selection_mcafee: ImageLoaded|endswith: - \ashldres.dll - \lockdown.dll - \vsodscpl.dll filter_mcafee: ImageLoaded|startswith: - C:\Program Files\McAfee\ - C:\Program Files (x86)\McAfee\ selection_cyberark: ImageLoaded|endswith: \vftrace.dll filter_cyberark: ImageLoaded|startswith: - C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\ - C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32\ selection_avast: ImageLoaded|endswith: \wsc.dll filter_wsc_dll_avast: ImageLoaded|startswith: - C:\program Files\AVAST Software\Avast\ - C:\program Files (x86)\AVAST Software\Avast\ filter_wsc_dll_avg: ImageLoaded|startswith: - C:\Program Files\AVG\Antivirus\ - C:\Program Files (x86)\AVG\Antivirus\ selection_eset_deslock: ImageLoaded|endswith: \DLPPREM32.dll filter_eset_deslock: ImageLoaded|startswith: - C:\program Files\ESET - C:\program Files (x86)\ESET selection_titanium: ImageLoaded|endswith: \tmdbglog.dll filter_titanium: ImageLoaded|startswith: - C:\program Files\Trend
Near-miss passage: Sigma rule: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are leg. Logsource: zeek / dns. Rule: title: New Kind of Network (NKN) Detection id: fa7703d6-0ee8-4949-889c-48c84bc15b6f status: test description: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma> references: - https://github.com/nknorg/nkn-sdk-go - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/ - https://github.com/Maka8ka/NGLite author: Michael Portera (@mportatoes) date: 2022-04-21 tags: - attack.command-and-control logsource: product: zeek service: dns detection: selection: query|contains|all: - seed - .nkn.org condition: selection falsepositives: - Unknown level: low