Detection rules › Splunk

Windows BitDefender Submission Wizard DLL Sideloading

Author
Michael Haag, Splunk
Source
upstream

Detects DLL side-loading of Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe, or renamed BluetoothService.exe) when a malicious log.dll is loaded from a non-standard path via Sysmon ImageLoad events.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1574 Hijack Execution Flow
Privilege EscalationT1574 Hijack Execution Flow
Defense EvasionT1574 Hijack Execution Flow

Event coverage

ProviderEvent IDTitle
Sysmon7Image loaded

Stages and Predicates

Stage 1: search

search (Image IN ("*\\BDSubmit.exe", "*\\BluetoothService.exe", "*\\bdsw.exe") OR OriginalFileName IN ("BDSubmit.exe", "bdsw.exe")) NOT ImageLoaded IN ("*:\\Program Files (x86)\\*", "*:\\Program Files\\*", "*:\\Windows\\SysWOW64\\*", "*:\\Windows\\System32\\*") EventCode=7 ImageLoaded="*\\log.dll"

Stage 2: stats

stats BY dest, Image, ImageLoaded, Signed, SignatureStatus, User, OriginalFileName, loaded_file, loaded_file_path, process_exec, process_guid, process_hash, process_id, process_name, process_path, service_dll_signature_exists, service_dll_signature_verified, signature, signature_id, user_id, vendor_product

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

StageFieldKindExcluded values
1ImageLoadedin"*:\\Program Files (x86)\\*", "*:\\Program Files\\*", "*:\\Windows\\SysWOW64\\*", "*:\\Windows\\System32\\*"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 7 corpus 35 (splunk 35)
Imagein
  • "*\\BDSubmit.exe"
  • "*\\BluetoothService.exe"
  • "*\\bdsw.exe"
ImageLoadedeq
  • "*\\log.dll"
OriginalFileNamein
  • "BDSubmit.exe"
  • "bdsw.exe"

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.