Detectionmediumtest

Third Party Software DLL Sideloading

Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)Created Wed Aug 17f9df325d-d7bc-4a32-8a1a-2cc61dcefc63windows

Log Source

WindowsImage Load (DLL)

ProductWindows← raw: windows

CategoryImage Load (DLL)← raw: image_load

Detection Logic

detection:
    # Lenovo
    selection_lenovo:
        ImageLoaded|endswith: '\commfunc.dll'
    filter_lenovo:
        - ImageLoaded|contains: '\AppData\local\Google\Chrome\Application\'
        - ImageLoaded|startswith:
              - 'C:\Program Files\Lenovo\Communications Utility\'
              - 'C:\Program Files (x86)\Lenovo\Communications Utility\'
    # Toshiba
    selection_toshiba:
        ImageLoaded|endswith: '\tosbtkbd.dll'
    filter_toshiba:
        ImageLoaded|startswith:
            - 'C:\Program Files\Toshiba\Bluetooth Toshiba Stack\'
            - 'C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\'
    # Zoom (FP with System32)
    # selection_zoom:
    #     ImageLoaded|endswith: '\version.dll'
    # filter_zoom:
    #     ImageLoaded|startswith: 'C:\Users\'
    #     ImageLoaded|contains: '\AppData\Roaming\Zoom\bin\'
    condition: (selection_lenovo and not filter_lenovo) or (selection_toshiba and not filter_toshiba)