Title:
Potential Wazuh Security Platform DLL Sideloading
Status:
test
Description:Detects potential DLL side loading of DLLs that are part of the Wazuh security platform
References:
-https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
Author: X__Junior (Nextron Systems)
Date: 2023-03-13
modified:2023-05-12
Tags:
- -'attack.persistence'
- -'attack.privilege-escalation'
- -'attack.execution'
- -'attack.stealth'
- -'attack.t1574.001'
Logsource:
- category: image_load
- product: windows
Detection:
selection:
ImageLoaded|endswith:
-'\libwazuhshared.dll'
-'\libwinpthread-1.dll'
filter_main_generic:
ImageLoaded|startswith:
-'C:\Program Files\'
-'C:\Program Files (x86)\'
filter_optional_mingw64:
ImageLoaded|contains:
-'\AppData\Local\'
-'\ProgramData\'
ImageLoaded|endswith:
'\mingw64\bin\libwinpthread-1.dll'
condition:
selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
-Many legitimate applications leverage this DLL. (Visual Studio, JetBrains, Ruby, Anaconda, GithubDesktop, etc.)
Level:
medium
