Query: detection rule: Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor
Matching passage: Sigma rule: Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via JsSchHlp id: 68654bf0-4412-43d5-bfe8-5eaa393cd939 status: test description: Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor references: - https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/ - http://www.windowexe.com/bbs/board.php?q=jsschhlp-exe-c-program-files-common-files-justsystem-jsschhlp-jsschhlp author: frack113 date: 2022-12-14 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \JSESPR.dll filter: ImageLoaded|startswith: C:\Program Files\Common Files\Justsystem\JsSchHlp\ condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects uncommon processes creating remote threads.. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation By Uncommon Source Image id: 66d31e5f-52d6-40a4-9615-002d3789a119 related: - id: 02d1d718-dd13-41af-989d-ea85c7fab93f type: derived status: test description: Detects uncommon processes creating remote threads. references: - Personal research, statistical analysis - https://lolbas-project.github.io author: Perez Diego (@darkquassar), oscd.community date: 2019-10-27 modified: 2025-07-08 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \explorer.exe - \iexplore.exe - \msiexec.exe - \powerpnt.exe - \schtasks.exe - \winlogon.exe filter_main_winlogon_1: SourceImage: C:\Windows\System32\winlogon.exe TargetImage: - C:\Windows\System32\services.exe - C:\Windows\System32\wininit.exe - C:\Windows\System32\csrss.exe - C:\Windows\System32\LogonUI.exe - C:\Windows\System32\wlrmdr.exe - C:\Windows\System32\AtBroker.exe - C:\Windows\System32\dwm.exe - C:\Windows\System32\fontdrvhost.exe - C:\Windows\System32\userinit.exe filter_main_winlogon_2: SourceImage: C:\Windows\System32\winlogon.exe TargetParentProcessId: 4 filter_main_schtasks_conhost: SourceImage: - C:\Windows\System32\schtasks.exe - C:\Windows\SysWOW64\schtasks.exe TargetImage: C:\Windows\System32\conhost.exe filter_main_explorer: SourceImage: C:\Windows\explorer.exe TargetImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ filter_main_system: TargetImage: System filter_main_msiexec_1: SourceImage|endswith: \msiexec.exe TargetImage|contains: - \AppData\Local\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\Microsoft.NET\Framework64\ filter_main_msiexec_2: SourceImage|endswith: \msiexec.exe TargetImage: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe filter_main_iexplore: SourceImage: C:\Program Files\Internet Explorer\iexplore.exe TargetImage: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Windows\System32\rundll32.exe filter_main_powerpnt: SourceImage|endswith: \POWERPNT.EXE TargetImage|contains: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ filter_optional_aurora_smartconsole1: SourceImage: C:\Program Files\internet explorer\iexplore.exe SourceCommandLine|contains|all: - https:// - .checkpoint.com/documents/ - SmartConsole_OLH/ - default.htm#cshid= filter_optional_aurora_smartconsole2: SourceImage: C:\Program Files\internet