Detectionhightest

HackTool - SharpEvtMute DLL Load

Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Wed Sep 07Updated Sat Nov 2349329257-089d-46e6-af37-4afce4290685windows

Log Source

WindowsImage Load (DLL)

ProductWindows← raw: windows

CategoryImage Load (DLL)← raw: image_load

Detection Logic

detection:
    selection:
        Hashes|contains: 'IMPHASH=330768A4F172E10ACB6287B87289D83B'
    condition: selection

False Positives

Other DLLs with the same Imphash

References

MITRE ATT&CK

Tactics

Sub-techniques

Related Rules

HackTool - SharpEvtMute Execution

Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

49329257-089d-46e6-af37-4afce4290685

Status

test

Level

high

Type

Detection

Created

Wed Sep 07

Modified

Sat Nov 23

Author

Path

rules/windows/image_load/image_load_hktl_sharpevtmute.yml

Raw Tags

attack.defense-evasionattack.t1562.002