Threat Huntmediumtest

Potential DLL Sideloading Activity Via ExtExport.EXE

Detects the execution of "Extexport.exe".A utility that is part of the Internet Explorer browser and is used to export and import various settings and data, particularly when switching between Internet Explorer and other web browsers like Firefox. It allows users to transfer bookmarks, browsing history, and other preferences from Internet Explorer to Firefox or vice versa. It can be abused as a tool to side load any DLL. If a folder is provided in the command line it'll load any DLL with one of the following names "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll". Arbitrary DLLs can also be loaded if a specific number of flags was provided.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François Hubaut, Nasreddine Bencherchali (Nextron Systems)Created Fri Nov 26Updated Mon Aug 26fb0b815b-f5f6-4f50-970f-ffe21f253f7awindows
Hunting Hypothesis
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        - Image|endswith: '\Extexport.exe'
        - OriginalFileName: 'extexport.exe'
    condition: selection
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

MITRE ATT&CK

Other

detection.threat-hunting
Rule Metadata
Rule ID
fb0b815b-f5f6-4f50-970f-ffe21f253f7a
Status
test
Level
medium
Type
Threat Hunt
Created
Fri Nov 26
Modified
Mon Aug 26
Path
rules-threat-hunting/windows/process_creation/proc_creation_win_extexport_execution.yml
Raw Tags
attack.defense-evasionattack.t1218detection.threat-hunting
View on GitHub