Potential Antivirus Software DLL Sideloading

Last updated on:

Applies to: Log360Log360 Cloud

About the rule

Rule Type

Standard

Rule Description

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Severity

Trouble

Rule Requirement

Criteria

Action1: actionname = "Image Loaded" AND (OBJECTNAME endswith "\log.dll" AND (OBJECTNAME notstartswith "C:\Program Files\Bitdefender Antivirus Free\,C:\Program Files (x86)\Bitdefender Antivirus Free" AND (PROCESSNAME != "C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe" OR OBJECTNAME != "C:\Program Files\Dell\SARemediation\plugin\log.dll,C:\Program Files\Dell\SARemediation\audit\log.dll") AND OBJECTNAME notstartswith "C:\Program Files\Canon\MyPrinter")) OR (OBJECTNAME endswith "\qrt.dll" AND OBJECTNAME notstartswith "C:\Program Files\F-Secure\Anti-Virus\,C:\Program Files (x86)\F-Secure\Anti-Virus") OR (OBJECTNAME endswith "\ashldres.dll,\lockdown.dll,\vsodscpl.dll" AND OBJECTNAME notstartswith "C:\Program Files\McAfee\,C:\Program Files (x86)\McAfee") OR (OBJECTNAME endswith "\vftrace.dll" AND OBJECTNAME notstartswith "C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\,C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32") OR (OBJECTNAME endswith "\wsc.dll" AND OBJECTNAME notstartswith "C:\program Files\AVAST Software\Avast\,C:\program Files (x86)\AVAST Software\Avast") OR (OBJECTNAME endswith "\tmdbglog.dll" AND OBJECTNAME notstartswith "C:\program Files\Trend Micro\Titanium\,C:\program Files (x86)\Trend Micro\Titanium") OR (OBJECTNAME endswith "\DLPPREM32.dll" AND OBJECTNAME notstartswith "C:\program Files\ESET,C:\program Files (x86)\ESET") select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PRODUCT_NAME,Action1.OBJECTNAME,Action1.SIGNATURE,Action1.SIGNATURESTATUS

Detection

Execution Mode

realtime

Log Sources

Windows

Author

Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)