Detectionmediumtest

Potential Wazuh Security Platform DLL Sideloading

Detects potential DLL side loading of DLLs that are part of the Wazuh security platform

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

X__Junior (Nextron Systems)Created Mon Mar 13Updated Fri May 12db77ce78-7e28-4188-9337-cf30e2b3ba9fwindows

Log Source

WindowsImage Load (DLL)

ProductWindows← raw: windows

CategoryImage Load (DLL)← raw: image_load

Detection Logic

detection:
    selection:
        ImageLoaded|endswith:
            - '\libwazuhshared.dll'
            - '\libwinpthread-1.dll'
    filter_main_generic:
        ImageLoaded|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    filter_optional_mingw64:
        # Note: Many third party apps installed in "AppData" or "ProgramData" and leverage "mingw64" make use of "libwinpthread-1.dll"
        # In production its best to make a list of these apps and replace this filter with a specific one.
        ImageLoaded|contains:
            - '\AppData\Local\'
            - '\ProgramData\'
        ImageLoaded|endswith: '\mingw64\bin\libwinpthread-1.dll'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*