Query: detection rule: Detects potential DLL sideloading of "AVKkid.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "AVKkid.dll". Logsource: windows / image_load. Rule: title: Potential AVKkid.DLL Sideloading id: 952ed57c-8f99-453d-aee0-53a49c22f95d status: test description: Detects potential DLL sideloading of "AVKkid.dll" references: - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/ author: X__Junior (Nextron Systems) date: 2023-08-03 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \AVKkid.dll filter_main_legit_path: Image|contains: - C:\Program Files (x86)\G DATA\ - C:\Program Files\G DATA\ Image|endswith: \AVKKid.exe ImageLoaded|startswith: - C:\Program Files (x86)\G DATA\ - C:\Program Files\G DATA\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potentially suspicious processes being spawned by a web server process which could be the result of a successful. Logsource: windows / process_creation. Rule: title: Suspicious Process By Web Server Process id: 8202070f-edeb-4d31-a010-a26c72ac5600 status: test description: 'Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation ' references: - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2024-11-26 tags: - attack.persistence - attack.initial-access - attack.t1505.003 - attack.t1190 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \caddy.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \php.exe - \tomcat.exe - \UMWorkerProcess.exe - \w3wp.exe - \ws_TomcatService.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe ParentCommandLine|contains: - CATALINA_HOME - catalina.home - catalina.jar selection_anomaly_children: Image|endswith: - \arp.exe - \at.exe - \bash.exe - \bitsadmin.exe - \certutil.exe - \cmd.exe - \cscript.exe - \dsget.exe - \hostname.exe - \nbtstat.exe - \net.exe - \net1.exe - \netdom.exe - \netsh.exe - \nltest.exe - \ntdsutil.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \qprocess.exe - \query.exe - \qwinsta.exe - \reg.exe - \rundll32.exe - \sc.exe - \sh.exe - \wmic.exe - \wscript.exe - \wusa.exe filter_main_fp_1: ParentImage|endswith: \java.exe CommandLine|endswith: Windows\system32\cmd.exe /c C:\ManageEngine\ADManager "Plus\ES\bin\elasticsearch.bat -Enode.name=RMP-NODE1 -pelasticsearch-pid.txt filter_main_fp_2: ParentImage|endswith: \java.exe CommandLine|contains|all: - sc query - ADManager Plus condition: 1 of selection_webserver_* and selection_anomaly_children and not 1 of filter_main_* falsepositives: - Particular web applications may spawn a shell process legitimately level: high