Query: write Sigma for Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy executio
Matching passage: Sigma rule: Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy executio. Logsource: windows / image_load. Rule: title: Unsigned DLL Loaded by Windows Utility id: b5de0c9a-6f19-43e0-af4e-55ad01f550af status: test description: 'Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code. ' references: - https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion - https://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql - https://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true author: Swachchhanda Shrawan Poudel date: 2024-02-28 modified: 2025-10-07 tags: - attack.stealth - attack.t1218.011 - attack.t1218.010 logsource: product: windows category: image_load detection: selection: Image|endswith: - \InstallUtil.exe - \RegAsm.exe - \RegSvcs.exe - \regsvr32.exe - \rundll32.exe filter_main_signed: Signed: 'true' filter_main_sig_status: SignatureStatus: - errorChaining - errorCode_endpoint - errorExpired - trusted - Valid filter_main_signed_null: Signed: null filter_main_signed_empty: Signed: - '' - '-' filter_main_sig_status_null: SignatureStatus: null filter_main_sig_status_empty: SignatureStatus: - '' - '-' filter_main_windows_installer: Image: - C:\Windows\SysWOW64\rundll32.exe - C:\Windows\System32\rundll32.exe ImageLoaded|startswith: C:\Windows\Installer\ ImageLoaded|endswith: - .tmp-\Microsoft.Deployment.WindowsInstaller.dll - .tmp-\Avira.OE.Setup.CustomActions.dll filter_main_assembly: Image|startswith: - C:\Windows\SysWOW64\ - C:\Windows\System32\ - C:\Windows\Microsoft.NET\Framework64 Image|endswith: \RegAsm.exe ImageLoaded|endswith: .dll ImageLoaded|startswith: C:\Windows\assembly\NativeImages filter_optional_klite_codec: Image: - C:\Windows\SysWOW64\regsvr32.exe - C:\Windows\System32\regsvr32.exe ImageLoaded|startswith: - C:\Program Files (x86)\K-Lite Codec Pack\ - C:\Program Files\K-Lite Codec Pack\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the addition of new root, CA or AuthRoot certificates to the Windows registry. Logsource: windows / registry_set. Rule: title: New Root or CA or AuthRoot Certificate to Store id: d223b46b-5621-4037-88fe-fda32eead684 status: test description: Detects the addition of new root, CA or AuthRoot certificates to the Windows registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec author: frack113 date: 2022-04-04 modified: 2023-08-17 tags: - attack.impact - attack.t1490 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\ - \SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\ - \SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\AuthRoot\Certificates\ TargetObject|endswith: \Blob Details: Binary Data condition: selection falsepositives: - Unknown level: medium