Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_imageloaded" AND (PROCESSNAME endswith "\KeyScrambler.exe,\KeyScramblerLogon.exe" AND OBJECTNAME endswith "\KeyScramblerIE.dll") AND ((PROCESSNAME notcontains "C:\Program Files (x86)\KeyScrambler\,C:\Program Files\KeyScrambler" OR OBJECTNAME notcontains "C:\Program Files (x86)\KeyScrambler\,C:\Program Files\KeyScrambler") AND (SIGNATURE != "QFX Software Corporation" OR SIGNATURESTATUS != "Valid")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PRODUCT_NAME,Action1.OBJECTNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Swachchhanda Shrawan Poudel
