Detection rules › Sigma

Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE

Severity
high
Author
Swachchhanda Shrawan Poudel
Source
upstream

Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1574.001 Hijack Execution Flow: DLL
Privilege EscalationT1574.001 Hijack Execution Flow: DLL
Defense EvasionT1574.001 Hijack Execution Flow: DLL

Event coverage

ProviderEvent IDTitle
Sysmon7Image loaded

Stages and Predicates

Stage 1: selection

or:
Image|endswith: '\KeyScrambler.exe'
Image|endswith: '\KeyScramblerLogon.exe'
ImageLoaded|endswith: '\KeyScramblerIE.dll'

Stage 2: not 1 of filter_main_*

or:
or:
Image|contains: 'C:\Program Files (x86)\KeyScrambler\'
Image|contains: 'C:\Program Files\KeyScrambler\'
or:
ImageLoaded|contains: 'C:\Program Files (x86)\KeyScrambler\'
ImageLoaded|contains: 'C:\Program Files\KeyScrambler\'
Signature: 'QFX Software Corporation'
SignatureStatus: Valid

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \KeyScrambler.exe
  • \KeyScramblerLogon.exe
Imagematch
  • C:\Program Files (x86)\KeyScrambler\
  • C:\Program Files\KeyScrambler\
ImageLoadedends_with
  • \KeyScramblerIE.dll
ImageLoadedmatch
  • C:\Program Files (x86)\KeyScrambler\
  • C:\Program Files\KeyScrambler\
Signatureeq
  • QFX Software Corporation
SignatureStatuseq
  • Valid corpus 4 (sigma 4)