Unsigned DLL Loaded by Windows Utility

Severity: medium
Author: Swachchhanda Shrawan Poudel
Source: upstream

Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1218.010` System Binary Proxy Execution: Regsvr32, `T1218.011` System Binary Proxy Execution: Rundll32

Event coverage

Provider	Event ID	Title
Sysmon	7	Image loaded

Stages and Predicates

Stage 1: `selection`

or:
Image|endswith: '\InstallUtil.exe'
Image|endswith: '\RegAsm.exe'
Image|endswith: '\RegSvcs.exe'
Image|endswith: '\regsvr32.exe'
Image|endswith: '\rundll32.exe'

Stage 2: `not 1 of filter_main_*`

or:
Image: ['C:\Windows\SysWOW64\rundll32.exe', 'C:\Windows\System32\rundll32.exe']
or:
ImageLoaded|endswith: '.tmp-\Avira.OE.Setup.CustomActions.dll'
ImageLoaded|endswith: '.tmp-\Microsoft.Deployment.WindowsInstaller.dll'
ImageLoaded|startswith: 'C:\Windows\Installer\'
or:
Image|startswith: 'C:\Windows\Microsoft.NET\Framework64'
Image|startswith: 'C:\Windows\SysWOW64\'
Image|startswith: 'C:\Windows\System32\'
Image|endswith: '\RegAsm.exe'
ImageLoaded|endswith: .dll
ImageLoaded|startswith: 'C:\Windows\assembly\NativeImages'
SignatureStatus: ''
SignatureStatus: -
SignatureStatus: Valid
SignatureStatus: errorChaining
SignatureStatus: errorCode_endpoint
SignatureStatus: errorExpired
SignatureStatus: trusted
SignatureStatus: null
Signed: ''
Signed: -
Signed: true
Signed: null

Stage 3: `not 1 of filter_optional_klite_codec`

Image: ['C:\Windows\SysWOW64\regsvr32.exe', 'C:\Windows\System32\regsvr32.exe']
or:
ImageLoaded|startswith: 'C:\Program Files (x86)\K-Lite Codec Pack\'
ImageLoaded|startswith: 'C:\Program Files\K-Lite Codec Pack\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Image`	ends_with	`\InstallUtil.exe` corpus 5 (sigma 5) `\RegAsm.exe` corpus 3 (sigma 3) `\RegSvcs.exe` corpus 2 (sigma 2) `\regsvr32.exe` corpus 57 (sigma 57) `\rundll32.exe` corpus 76 (sigma 76)
`Image`	eq	`C:\Windows\SysWOW64\regsvr32.exe` corpus 2 (sigma 2) `C:\Windows\SysWOW64\rundll32.exe` `C:\Windows\System32\regsvr32.exe` corpus 2 (sigma 2) `C:\Windows\System32\rundll32.exe`
`Image`	starts_with	`C:\Windows\Microsoft.NET\Framework64` `C:\Windows\SysWOW64\` corpus 16 (sigma 16) `C:\Windows\System32\` corpus 16 (sigma 16)
`ImageLoaded`	ends_with	`.dll` corpus 3 (sigma 3) `.tmp-\Avira.OE.Setup.CustomActions.dll` `.tmp-\Microsoft.Deployment.WindowsInstaller.dll`
`ImageLoaded`	starts_with	`C:\Program Files (x86)\K-Lite Codec Pack\` `C:\Program Files\K-Lite Codec Pack\` `C:\Windows\Installer\` `C:\Windows\assembly\NativeImages`
`SignatureStatus`	eq	`-` `Valid` corpus 4 (sigma 4) `errorChaining` `errorCode_endpoint` `errorExpired` `trusted`
`Signed`	eq	`-` `true` corpus 8 (sigma 8)