Suspicious WINWORD.exe DLL loading via /l flag and .dll path on Windows

Flags WINWORD.exe runs that include /l and a .dll indicator, suggesting potential DLL sideloading on Windows.

FreeUnreviewedSigmamediumv1

suspicious-winword-exe-dll-loading-via-l-flag-and-dll-path-on-windows-f7375e28

title: Suspicious WINWORD.exe DLL loading via /l flag and .dll path on Windows
id: 64c8d3e3-6fc8-4338-ad75-957e579c21b6
related:
  - id: 2621b3a6-3840-4810-ac14-a02426086171
    type: obsolete
  - id: f7375e28-5c14-432f-b8d1-1db26c832df3
    type: derived
status: test
description: This rule flags process creation events where WINWORD.exe is invoked with a command line containing the /l flag and a .dll reference, indicating potential DLL sideloading behavior. Attackers may use Office application loading mechanisms to execute attacker-controlled code stealthily through a malicious DLL. The detection relies on Windows process creation telemetry, specifically the executable path/name and the full command line content.
references:
  - https://github.com/D4Vinci/One-Lin3r/blob/9fdfa5f0b9c698dfbd4cdfe7d2473192777ae1c6/one_lin3r/core/liners/windows/cmd/dll_loader_word.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_winword_dll_load.yml
author: Victor Sergeev, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2023-03-29
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \WINWORD.exe
    - OriginalFileName: WinWord.exe
  selection_dll:
    CommandLine|contains|all:
      - "/l "
      - .dll
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags process creation events where WINWORD.exe is invoked with a command line containing the /l flag and a .dll reference, indicating potential DLL sideloading behavior. Attackers may use Office application loading mechanisms to execute attacker-controlled code stealthily through a malicious DLL. The detection relies on Windows process creation telemetry, specifically the executable path/name and the full command line content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.