Unsigned DLL Loaded by Windows Utility
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_imageloaded" AND PROCESSNAME endswith "\InstallUtil.exe,\RegAsm.exe,\RegSvcs.exe,\regsvr32.exe,\rundll32.exe" AND (SIGNED != "true" AND SIGNATURESTATUS != "errorChaining,errorCode_endpoint,errorExpired,trusted,Valid" AND isExist(SIGNED) AND SIGNED != ",-" AND isExist(SIGNATURESTATUS) AND SIGNATURESTATUS != ",-") select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PRODUCT_NAME,Action1.OBJECTNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Swachchhanda Shrawan Poudel
