Potential Mpclient.DLL Sideloading

Title: Potential Mpclient.DLL Sideloading
Status: test
Description:Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.
References:
  -https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
Author: Bhabesh Raj
Date: 2022-08-02
modified:2023-08-04
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• product: windows
• category: image_load

Detection:
  selection:
    ImageLoaded|endswith: '\mpclient.dll'
    Image|endswith:
      -'\MpCmdRun.exe'
      -'\NisSrv.exe'

  filter_main_known_locations:
    Image|startswith:
      -'C:\Program Files (x86)\Windows Defender\'
      -'C:\Program Files\Microsoft Security Client\'
      -'C:\Program Files\Windows Defender\'
      -'C:\ProgramData\Microsoft\Windows Defender\Platform\'
      -'C:\Windows\WinSxS\'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unlikely
Level: high