DLL Names Used By SVR For GraphicalProton Backdoor
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Hunts known SVR-specific DLL names.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_imageloaded" AND OBJECTNAME endswith "\AclNumsInvertHost.dll,\AddressResourcesSpec.dll,\BlendMonitorStringBuild.dll,\ChildPaletteConnected.dll,\DeregisterSeekUsers.dll,\HandleFrequencyAll.dll,\HardSwapColor.dll,\LengthInMemoryActivate.dll,\ModeBitmapNumericAnimate.dll,\ModeFolderSignMove.dll,\ParametersNamesPopup.dll,\PerformanceCaptionApi.dll,\ScrollbarHandleGet.dll,\UnregisterAncestorAppendAuto.dll,\WowIcmpRemoveReg.dll" select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PRODUCT_NAME,Action1.OBJECTNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
CISA
