Potential DLL Sideloading Activity Via ExtExport.EXE
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the execution of "Extexport.exe".A utility that is part of the Internet Explorer browser and is used to export and import various settings and data, particularly when switching between Internet Explorer and other web browsers like Firefox. It allows users to transfer bookmarks, browsing history, and other preferences from Internet Explorer to Firefox or vice versa. It can be abused as a tool to side load any DLL. If a folder is provided in the command line it'll load any DLL with one of the following names "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll". Arbitrary DLLs can also be loaded if a specific number of flags was provided.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND PROCESSNAME endswith "\Extexport.exe" OR ORIGINALFILENAME = "extexport.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113, Nasreddine Bencherchali (Nextron Systems)
