Try in Splunk Security Cloud

Description

The following analysis identifies potential DLL side-loading instances involving unsigned DLLs with a company detail signature mimicking Microsoft. This technique is frequently exploited by adversaries to execute malicious code automatically by running a legitimate process. The analytics involves searching Sysmon logs for Event Code 7, where both the Image and ImageLoaded paths do not match system directories (system32, syswow64, and programfiles). Additionally, it verifies whether the loaded DLL is signed and checks if the folder paths of the Image and ImageLoaded are identical. This anomaly detection mechanism serves as a valuable indicator for identifying suspicious processes that load unsigned DLLs. Add other paths based on org hunting.

  • Type: Anomaly

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2024-04-05
  • Author: Teoderick Contreras, Splunk
  • ID: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1574.002 DLL Side-Loading Persistence, Privilege Escalation, Defense Evasion
T1547 Boot or Logon Autostart Execution Persistence, Privilege Escalation
Kill Chain Phase
  • Installation
  • Exploitation
NIST
  • DE.AE
CIS20
  • CIS 10
CVE 


1
2
3
4
5
6
7
8
9



`sysmon` EventCode=7 Company="Microsoft Corporation" Signed=false SignatureStatus != Valid NOT (Image IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*", "C:\\Program Files*")) NOT (ImageLoaded IN("C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*", "C:\\Program Files*")) 
| rex field=Image "(?<ImageFolderPath>.+\\\)" 
| rex field=ImageLoaded "(?<ImageLoadedFolderPath>.+\\\)" 
| where ImageFolderPath = ImageLoadedFolderPath 
| stats count min(_time) as firstTime max(_time) as lastTime by Image ProcessGuid ImageLoaded user Computer EventCode ImageFolderPath ImageLoadedFolderPath Company Description Product Signed SignatureStatus 
| rename Computer as dest 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_unsigned_ms_dll_side_loading_filter`

Macros

The SPL above uses the following Macros:

:information_source: windows_unsigned_ms_dll_side-loading_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • Image
  • ImageLoaded
  • user
  • Computer
  • EventCode

How To Implement

The analytic is designed to be run against Sysmon event logs collected from endpoints. The analytic requires the Sysmon event logs to be ingested into Splunk. The analytic searches for EventCode 7 where the Image is either SQLDumper.exe or SQLWriter.exe and the ImageLoaded is vcruntime140.dll. The search also filters out the legitimate loading of vcruntime140.dll from the System32 directory to reduce false positives. The analytic can be modified to include additional known good paths for vcruntime140.dll to further reduce false positives.

Known False Positives

False positives are possible if legitimate processes are loading vcruntime140.dll from non-standard directories. It is recommended to investigate the context of the process loading vcruntime140.dll to determine if it is malicious or not. Modify the search to include additional known good paths for vcruntime140.dll to reduce false positives.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
9.0 30 30 An instance of $Image$ loading Unsigned $ImageLoaded$ was detected on $dest$.

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1