Windows Chrome Frame Helper DLL Sideloading via ImageLoad of chrome_frame_helper.dll

title: Windows Chrome Frame Helper DLL Sideloading via ImageLoad of chrome_frame_helper.dll
id: b8a5b395-967a-4a54-be20-3b78c85f5bcb
status: test
description: This rule flags image loads where chrome_frame_helper.dll is loaded from a path other than the standard Google Chrome application directories. Attackers can abuse DLL sideloading by placing a malicious or unexpected DLL in a location that gets loaded by a process expecting Chrome’s component. The detection relies on Windows image load telemetry and matches the DLL filename plus include/exclude path patterns for common Chrome install locations and a user AppData location.
references:
  - https://hijacklibs.net/entries/3rd_party/google/chrome_frame_helper.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_chrome_frame_helper.yml
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research), Huntrule Team
date: 2022-08-17
modified: 2023-05-15
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \chrome_frame_helper.dll
  filter_main_path:
    ImageLoaded|startswith:
      - C:\Program Files\Google\Chrome\Application\
      - C:\Program Files (x86)\Google\Chrome\Application\
  filter_optional_user_path:
    ImageLoaded|contains: \AppData\local\Google\Chrome\Application\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 72ca7c75-bf85-45cd-aca7-255d360e423c
    type: derived