Detection rules › Splunk
Windows BitDefender Submission Wizard DLL Sideloading
Detects DLL side-loading of Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe, or renamed BluetoothService.exe) when a malicious log.dll is loaded from a non-standard path via Sysmon ImageLoad events.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1574 Hijack Execution Flow |
| Privilege Escalation | T1574 Hijack Execution Flow |
| Defense Evasion | T1574 Hijack Execution Flow |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 7 | Image loaded |
Stages and Predicates
Stage 1: search
search (Image IN ("*\\BDSubmit.exe", "*\\BluetoothService.exe", "*\\bdsw.exe") OR OriginalFileName IN ("BDSubmit.exe", "bdsw.exe")) NOT ImageLoaded IN ("*:\\Program Files (x86)\\*", "*:\\Program Files\\*", "*:\\Windows\\SysWOW64\\*", "*:\\Windows\\System32\\*") EventCode=7 ImageLoaded="*\\log.dll"
Stage 2: stats
stats BY dest, Image, ImageLoaded, Signed, SignatureStatus, User, OriginalFileName, loaded_file, loaded_file_path, process_exec, process_guid, process_hash, process_id, process_name, process_path, service_dll_signature_exists, service_dll_signature_verified, signature, signature_id, user_id, vendor_product
Stage 3: search
search
Stage 4: search
search
Stage 5: search
search `macro`
Exclusions
Top-level NOT(...) conjuncts — predicates this rule actively suppresses.
| Stage | Field | Kind | Excluded values |
|---|---|---|---|
| 1 | ImageLoaded | in | "*:\\Program Files (x86)\\*", "*:\\Program Files\\*", "*:\\Windows\\SysWOW64\\*", "*:\\Windows\\System32\\*" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Image | in |
|
ImageLoaded | eq |
|
OriginalFileName | in |
|
Neighbors
Broader alternatives (more inclusive than this rule)
These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.
- Windows Remote Access Software BRC4 Loaded Dll (drops 3 filters this rule applies)