Detection rules › Sigma

Potential DLL Sideloading Of Non-Existent DLLs From System Folders

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems), SBousseaden
Source
upstream

Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts. Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1574.001 Hijack Execution Flow: DLL
Privilege EscalationT1574.001 Hijack Execution Flow: DLL
Defense EvasionT1574.001 Hijack Execution Flow: DLL

Event coverage

ProviderEvent IDTitle
Sysmon7Image loaded

Stages and Predicates

Stage 1: selection

or:
ImageLoaded|endswith: ':\Windows\System32\TSMSISrv.dll'
ImageLoaded|endswith: ':\Windows\System32\TSVIPSrv.dll'
ImageLoaded|endswith: ':\Windows\System32\WLBSCTRL.dll'
ImageLoaded|endswith: ':\Windows\System32\WptsExtensions.dll'
ImageLoaded|endswith: ':\Windows\System32\axeonoffhelper.dll'
ImageLoaded|endswith: ':\Windows\System32\cdpsgshims.dll'
ImageLoaded|endswith: ':\Windows\System32\oci.dll'
ImageLoaded|endswith: ':\Windows\System32\offdmpsvc.dll'
ImageLoaded|endswith: ':\Windows\System32\shellchromeapi.dll'
ImageLoaded|endswith: ':\Windows\System32\wbem\wbemcomn.dll'
ImageLoaded|endswith: ':\Windows\System32\wow64log.dll'

Stage 2: not 1 of filter_main_ms_signed

Signature: 'Microsoft Windows'
SignatureStatus: Valid
Signed: true

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ImageLoadedends_with
  • :\Windows\System32\TSMSISrv.dll
  • :\Windows\System32\TSVIPSrv.dll
  • :\Windows\System32\WLBSCTRL.dll
  • :\Windows\System32\WptsExtensions.dll
  • :\Windows\System32\axeonoffhelper.dll
  • :\Windows\System32\cdpsgshims.dll
  • :\Windows\System32\oci.dll
  • :\Windows\System32\offdmpsvc.dll
  • :\Windows\System32\shellchromeapi.dll
  • :\Windows\System32\wbem\wbemcomn.dll
  • :\Windows\System32\wow64log.dll
Signatureeq
  • Microsoft Windows
SignatureStatuseq
  • Valid corpus 4 (sigma 4)
Signedeq
  • true corpus 8 (sigma 8)