Hijack Execution Flow - DLL Side-Loading

Back


Id	3084b487-fad6-4000-9544-6085b9657290
Rulename	Hijack Execution Flow - DLL Side-Loading
Description	This detection tries to identify all DLLs loaded by “high integrity” processes and cross-checks the DLL paths against FileCreate/FileModify events of the same DLL by a medium integrity process. Of course, we need to do some magic to filter out false positives as much as possible. So any FileCreate/FileModify done by “NT Authoriy\System” and the “RID 500” users aren’t interesting. Also, we only want to see the FileCreate/FileModify actions which are performed with a default or limited token elevation. If done with a full elevated token, the user is apparently admin already.
Severity	Medium
Tactics	Persistence PrivilegeEscalation DefenseEvasion
Techniques	T1574.002
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/DLLSideLoading.yaml
Version	1.0.1
Arm template	3084b487-fad6-4000-9544-6085b9657290.json

KQL

let imls = materialize(
    DeviceImageLoadEvents
    | where InitiatingProcessIntegrityLevel in ("High", "System") and FileName !endswith ".exe"
    | project FolderPath=tolower(FolderPath), InitiatingProcessFileName, InitiatingProcessIntegrityLevel, DeviceId, DeviceName
    | distinct FolderPath, InitiatingProcessFileName, InitiatingProcessIntegrityLevel, DeviceId, DeviceName
);
imls
| join (
    DeviceFileEvents
    | where FolderPath in~ ((imls | project FolderPath)) and ActionType in ("FileCreated", "FileModified") and
    InitiatingProcessIntegrityLevel !in ("High", "System", "") and InitiatingProcessAccountSid != "S-1-5-18" and
    InitiatingProcessTokenElevation in ("TokenElevationTypeDefault", "TokenElevationTypeLimited") and InitiatingProcessAccountSid !endswith "-500"
    | extend FolderPath=tolower(FolderPath)
) on FolderPath, DeviceId, DeviceName
| project-away FolderPath1

YAML

queryPeriod: 1h
description: |
  This detection tries to identify all DLLs loaded by "high integrity" processes and cross-checks the DLL paths against FileCreate/FileModify events of the same DLL by a medium integrity process.
  Of course, we need to do some magic to filter out false positives as much as possible. So any FileCreate/FileModify done by "NT Authoriy\System" and the "RID 500" users aren't interesting.
  Also, we only want to see the FileCreate/FileModify actions which are performed with a default or limited token elevation. If done with a full elevated token, the user is apparently admin already.  
kind: Scheduled
query: |
  let imls = materialize(
      DeviceImageLoadEvents
      | where InitiatingProcessIntegrityLevel in ("High", "System") and FileName !endswith ".exe"
      | project FolderPath=tolower(FolderPath), InitiatingProcessFileName, InitiatingProcessIntegrityLevel, DeviceId, DeviceName
      | distinct FolderPath, InitiatingProcessFileName, InitiatingProcessIntegrityLevel, DeviceId, DeviceName
  );
  imls
  | join (
      DeviceFileEvents
      | where FolderPath in~ ((imls | project FolderPath)) and ActionType in ("FileCreated", "FileModified") and
      InitiatingProcessIntegrityLevel !in ("High", "System", "") and InitiatingProcessAccountSid != "S-1-5-18" and
      InitiatingProcessTokenElevation in ("TokenElevationTypeDefault", "TokenElevationTypeLimited") and InitiatingProcessAccountSid !endswith "-500"
      | extend FolderPath=tolower(FolderPath)
  ) on FolderPath, DeviceId, DeviceName
  | project-away FolderPath1  
tactics:
- Persistence
- PrivilegeEscalation
- DefenseEvasion
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/DLLSideLoading.yaml
id: 3084b487-fad6-4000-9544-6085b9657290
version: 1.0.1
entityMappings:
- entityType: Host
  fieldMappings:
  - identifier: FullName
    columnName: DeviceName
- entityType: Account
  fieldMappings:
  - identifier: Sid
    columnName: InitiatingProcessAccountSid
  - identifier: Name
    columnName: InitiatingProcessAccountName
  - identifier: NTDomain
    columnName: InitiatingProcessAccountDomain
- entityType: Process
  fieldMappings:
  - identifier: CommandLine
    columnName: InitiatingProcessCommandLine
triggerThreshold: 0
status: Available
relevantTechniques:
- T1574.002
name: Hijack Execution Flow - DLL Side-Loading
severity: Medium
requiredDataConnectors:
- dataTypes:
  - DeviceFileEvents
  - DeviceImageLoadEvents
  connectorId: MicrosoftThreatProtection
queryFrequency: 1h

ARM