可疑文件夹中的无签名 DLL 侧加载
编辑可疑文件夹中的无签名 DLL 侧加载
编辑识别从攻击者经常滥用以伪装成受信任程序的位置运行的 Windows 受信任程序，并加载最近丢弃的 DLL。此行为可能表示试图通过在签名进程的内存空间中侧加载恶意 DLL 来规避防御。
规则类型: eql
规则索引:
- logs-endpoint.events.library-*
严重性: 中等
风险评分: 47
每隔: 5m 运行
搜索索引自: now-9m (日期数学格式，另请参见 附加回溯时间)
每次执行的最大警报数: 100
参考:
标签:
- 域：端点
- 操作系统：Windows
- 用例：威胁检测
- 战术：防御规避
- 数据源：Elastic Defend
版本: 9
规则作者:
- Elastic
规则许可证: Elastic License v2
设置
编辑设置
如果在非 elastic-agent 索引（例如 beats）上启用 EQL 规则且版本 <8.2，则事件将不会定义 event.ingested，并且直到 8.2 版才添加 EQL 规则的默认回退。因此，为了使此规则有效，用户需要添加一个自定义摄取管道来将 event.ingested 填充到 @timestamp。有关添加自定义摄取管道的更多详细信息，请参考 - https://elastic.ac.cn/guide/en/fleet/current/data-streams-pipeline-tutorial.html
规则查询
编辑library where host.os.type == "windows" and
process.code_signature.trusted == true and
(dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and
not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*", "errorChaining") and
/* Suspicious Paths */
dll.path : ("?:\\PerfLogs\\*.dll",
"?:\\Users\\*\\Pictures\\*.dll",
"?:\\Users\\*\\Music\\*.dll",
"?:\\Users\\Public\\*.dll",
"?:\\Users\\*\\Documents\\*.dll",
"?:\\Windows\\Tasks\\*.dll",
"?:\\Windows\\System32\\Tasks\\*.dll",
"?:\\Intel\\*.dll",
"?:\\AMD\\Temp\\*.dll",
"?:\\Windows\\AppReadiness\\*.dll",
"?:\\Windows\\ServiceState\\*.dll",
"?:\\Windows\\security\\*.dll",
"?:\\Windows\\System\\*.dll",
"?:\\Windows\\IdentityCRL\\*.dll",
"?:\\Windows\\Branding\\*.dll",
"?:\\Windows\\csc\\*.dll",
"?:\\Windows\\DigitalLocker\\*.dll",
"?:\\Windows\\en-US\\*.dll",
"?:\\Windows\\wlansvc\\*.dll",
"?:\\Windows\\Prefetch\\*.dll",
"?:\\Windows\\Fonts\\*.dll",
"?:\\Windows\\diagnostics\\*.dll",
"?:\\Windows\\TAPI\\*.dll",
"?:\\Windows\\INF\\*.dll",
"?:\\windows\\tracing\\*.dll",
"?:\\windows\\IME\\*.dll",
"?:\\Windows\\Performance\\*.dll",
"?:\\windows\\intel\\*.dll",
"?:\\windows\\ms\\*.dll",
"?:\\Windows\\dot3svc\\*.dll",
"?:\\Windows\\ServiceProfiles\\*.dll",
"?:\\Windows\\panther\\*.dll",
"?:\\Windows\\RemotePackages\\*.dll",
"?:\\Windows\\OCR\\*.dll",
"?:\\Windows\\appcompat\\*.dll",
"?:\\Windows\\apppatch\\*.dll",
"?:\\Windows\\addins\\*.dll",
"?:\\Windows\\Setup\\*.dll",
"?:\\Windows\\Help\\*.dll",
"?:\\Windows\\SKB\\*.dll",
"?:\\Windows\\Vss\\*.dll",
"?:\\Windows\\Web\\*.dll",
"?:\\Windows\\servicing\\*.dll",
"?:\\Windows\\CbsTemp\\*.dll",
"?:\\Windows\\Logs\\*.dll",
"?:\\Windows\\WaaS\\*.dll",
"?:\\Windows\\twain_32\\*.dll",
"?:\\Windows\\ShellExperiences\\*.dll",
"?:\\Windows\\ShellComponents\\*.dll",
"?:\\Windows\\PLA\\*.dll",
"?:\\Windows\\Migration\\*.dll",
"?:\\Windows\\debug\\*.dll",
"?:\\Windows\\Cursors\\*.dll",
"?:\\Windows\\Containers\\*.dll",
"?:\\Windows\\Boot\\*.dll",
"?:\\Windows\\bcastdvr\\*.dll",
"?:\\Windows\\TextInput\\*.dll",
"?:\\Windows\\schemas\\*.dll",
"?:\\Windows\\SchCache\\*.dll",
"?:\\Windows\\Resources\\*.dll",
"?:\\Windows\\rescache\\*.dll",
"?:\\Windows\\Provisioning\\*.dll",
"?:\\Windows\\PrintDialog\\*.dll",
"?:\\Windows\\PolicyDefinitions\\*.dll",
"?:\\Windows\\media\\*.dll",
"?:\\Windows\\Globalization\\*.dll",
"?:\\Windows\\L2Schemas\\*.dll",
"?:\\Windows\\LiveKernelReports\\*.dll",
"?:\\Windows\\ModemLogs\\*.dll",
"?:\\Windows\\ImmersiveControlPanel\\*.dll",
"?:\\$Recycle.Bin\\*.dll") and
/* DLL loaded from the process.executable current directory */
endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))
框架: MITRE ATT&CKTM
-
战术
- 名称：防御规避
- ID：TA0005
- 参考 URL：https://attack.mitre.org/tactics/TA0005/
-
技术
- 名称：伪装
- ID：T1036
- 参考 URL：https://attack.mitre.org/techniques/T1036/
-
子技术
- 名称：无效代码签名
- ID：T1036.001
- 参考 URL：https://attack.mitre.org/techniques/T1036/001/
-
技术
- 名称：劫持执行流程
- ID：T1574
- 参考 URL：https://attack.mitre.org/techniques/T1574/
-
子技术
- 名称：DLL 侧加载
- ID：T1574.002
- 参考 URL：https://attack.mitre.org/techniques/T1574/002/