Malicious DLL File Dropped in the Teams or OneDrive Folder
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "File Created or Modified" AND (FILENAME contains "iphlpapi.dll" AND FILENAME contains "\AppData\Local\Microsoft") OR (OBJECTNAME contains "iphlpapi.dll" AND OBJECTNAME contains "\AppData\Local\Microsoft") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.OBJECTNAME,Action1.FILENAME,Action1.PROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
