Potential Antivirus Software DLL Sideloading

Last updated on:

About the rule

Rule Type

Standard

Rule Description

Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Severity

Trouble

Rule Requirement

Criteria

Action1: actionname = "sa_imageloaded" AND (OBJECTNAME endswith "\log.dll" AND (OBJECTNAME notstartswith "C:\Program Files\Bitdefender Antivirus Free\,C:\Program Files (x86)\Bitdefender Antivirus Free" AND (PROCESSNAME != "C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe" OR OBJECTNAME != "C:\Program Files\Dell\SARemediation\plugin\log.dll,C:\Program Files\Dell\SARemediation\audit\log.dll") AND OBJECTNAME notstartswith "C:\Program Files\Canon\MyPrinter")) OR (OBJECTNAME endswith "\qrt.dll" AND OBJECTNAME notstartswith "C:\Program Files\F-Secure\Anti-Virus\,C:\Program Files (x86)\F-Secure\Anti-Virus") OR (OBJECTNAME endswith "\ashldres.dll,\lockdown.dll,\vsodscpl.dll" AND OBJECTNAME notstartswith "C:\Program Files\McAfee\,C:\Program Files (x86)\McAfee") OR (OBJECTNAME endswith "\vftrace.dll" AND OBJECTNAME notstartswith "C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\,C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32") OR (OBJECTNAME endswith "\wsc.dll" AND OBJECTNAME notstartswith "C:\program Files\AVAST Software\Avast\,C:\program Files (x86)\AVAST Software\Avast") OR (OBJECTNAME endswith "\tmdbglog.dll" AND OBJECTNAME notstartswith "C:\program Files\Trend Micro\Titanium\,C:\program Files (x86)\Trend Micro\Titanium") OR (OBJECTNAME endswith "\DLPPREM32.dll" AND OBJECTNAME notstartswith "C:\program Files\ESET,C:\program Files (x86)\ESET") select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PRODUCT_NAME,Action1.OBJECTNAME

Detection

Execution Mode

realtime

Log Sources

Windows

Author

Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)