Query: write Sigma for Detects loading of specific system DLL files that are usually not present on the system (or at least not in system direc
Matching passage: Sigma rule: Detects loading of specific system DLL files that are usually not present on the system (or at least not in system direc. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of Non-Existent DLLs From System Folders id: 6b98b92b-4f00-4f62-b4fe-4d1920215771 related: - id: df6ecb8b-7822-4f4b-b412-08f524b4576c type: similar - id: 602a1f13-c640-4d73-b053-be9a2fa58b77 type: obsolete status: test description: 'Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs. ' references: - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/ - https://decoded.avast.io/martinchlumecky/png-steganography/ - https://github.com/Wh04m1001/SysmonEoP - https://itm4n.github.io/cdpsvc-dll-hijacking/ - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992 - https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/ - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ - https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/ - https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/ - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/ - https://x.com/0gtweet/status/1564131230941122561 author: Nasreddine Bencherchali (Nextron Systems), SBousseaden date: 2022-12-09 modified: 2026-01-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - :\Windows\System32\axeonoffhelper.dll - :\Windows\System32\cdpsgshims.dll - :\Windows\System32\oci.dll - :\Windows\System32\offdmpsvc.dll - :\Windows\System32\shellchromeapi.dll - :\Windows\System32\TSMSISrv.dll - :\Windows\System32\TSVIPSrv.dll - :\Windows\System32\wbem\wbemcomn.dll - :\Windows\System32\WLBSCTRL.dll - :\Windows\System32\wow64log.dll - :\Windows\System32\WptsExtensions.dll filter_main_ms_signed: Signed: 'true' SignatureStatus: Valid Signature: Microsoft Windows condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Identifies when a DNS Zone is modified or deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud DNS Zone Modified or Deleted id: 28268a8f-191f-4c17-85b2-f5aa4fa829c3 status: test description: Identifies when a DNS Zone is modified or deleted in Google Cloud. references: - https://cloud.google.com/dns/docs/reference/v1/managedZones author: Austin Songer @austinsonger date: 2021-08-15 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - Dns.ManagedZones.Delete - Dns.ManagedZones.Update - Dns.ManagedZones.Patch condition: selection falsepositives: - Unknown level: medium