Query: rule covering Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)
Matching passage: Sigma rule: Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc). Logsource: windows / image_load. Rule: title: Third Party Software DLL Sideloading id: f9df325d-d7bc-4a32-8a1a-2cc61dcefc63 status: test description: Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc) references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_lenovo: ImageLoaded|endswith: \commfunc.dll filter_lenovo: - ImageLoaded|contains: \AppData\local\Google\Chrome\Application\ - ImageLoaded|startswith: - C:\Program Files\Lenovo\Communications Utility\ - C:\Program Files (x86)\Lenovo\Communications Utility\ selection_toshiba: ImageLoaded|endswith: \tosbtkbd.dll filter_toshiba: ImageLoaded|startswith: - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\ - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\ condition: (selection_lenovo and not filter_lenovo) or (selection_toshiba and not filter_toshiba) falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the exe. Logsource: windows / process_creation. Rule: title: Potential Binary Impersonating Sysinternals Tools id: 7cce6fc8-a07f-4d84-a53e-96e1879843c9 status: test description: 'Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the execution of binaries that are named similarly to Sysinternals tools. Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-12-20 modified: 2025-04-12 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection_exe: Image|endswith: - \accesschk.exe - \accesschk64.exe - \AccessEnum.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADInsight.exe - \ADInsight64.exe - \adrestore.exe - \adrestore64.exe - \Autologon.exe - \Autologon64.exe - \Autoruns.exe - \Autoruns64.exe - \autorunsc.exe - \autorunsc64.exe - \Bginfo.exe - \Bginfo64.exe - \Cacheset.exe - \Cacheset64.exe - \Clockres.exe - \Clockres64.exe - \Contig.exe - \Contig64.exe - \Coreinfo.exe - \Coreinfo64.exe - \CPUSTRES.EXE - \CPUSTRES64.EXE - \ctrl2cap.exe - \Dbgview.exe - \dbgview64.exe - \Desktops.exe - \Desktops64.exe - \disk2vhd.exe - \disk2vhd64.exe - \diskext.exe - \diskext64.exe - \Diskmon.exe - \Diskmon64.exe - \DiskView.exe - \DiskView64.exe - \du.exe - \du64.exe - \efsdump.exe - \FindLinks.exe - \FindLinks64.exe - \handle.exe - \handle64.exe - \hex2dec.exe - \hex2dec64.exe - \junction.exe - \junction64.exe - \ldmdump.exe - \listdlls.exe - \listdlls64.exe - \livekd.exe - \livekd64.exe - \loadOrd.exe - \loadOrd64.exe - \loadOrdC.exe - \loadOrdC64.exe - \logonsessions.exe - \logonsessions64.exe - \movefile.exe - \movefile64.exe - \notmyfault.exe - \notmyfault64.exe - \notmyfaultc.exe - \notmyfaultc64.exe - \ntfsinfo.exe - \ntfsinfo64.exe - \pendmoves.exe - \pendmoves64.exe - \pipelist.exe - \pipelist64.exe - \portmon.exe - \procdump.exe - \procdump64.exe - \procexp.exe - \procexp64.exe - \Procmon.exe - \Procmon64.exe - \psExec.exe - \psExec64.exe - \psfile.exe - \psfile64.exe - \psGetsid.exe - \psGetsid64.exe - \psInfo.exe - \psInfo64.exe - \pskill.exe - \pskill64.exe - \pslist.exe - \pslist64.exe - \psLoggedon.exe - \psLoggedon64.exe - \psloglist.exe - \psloglist64.exe - \pspasswd.exe - \pspasswd64.exe - \psping.exe - \psping64.exe - \psService.exe - \p