Windows DCOM InternetExplorer.Application DLL Hijack via iertutil.dll File Writes

Alerts when System writes iertutil.dll in the DCOM InternetExplorer.Application path, consistent with potential DLL hijacking.

FreeUnreviewedSigmacriticalv1

windows-dcom-internetexplorer-application-dll-hijack-via-iertutil-dll-file-write-2f7979ae

title: Windows DCOM InternetExplorer.Application DLL Hijack via iertutil.dll File Writes
id: 84037c5f-1304-4017-b8fc-04c515ebf1c4
related:
  - id: e554f142-5cf3-4e55-ace9-a1b59e0def65
    type: obsolete
  - id: f354eba5-623b-450f-b073-0b5b2773b6aa
    type: similar
  - id: 2f7979ae-f82b-45af-ac1d-2b10e93b0baa
    type: derived
status: test
description: This rule flags file activity where the Windows System process writes an iertutil.dll located under a DCOM InternetExplorer.Application path over the network. Attackers can use this type of DLL hijack to force a remote COM/DCOM component to load a malicious DLL and execute code. It relies on Windows file event telemetry that records the process image and the target filename.
references:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_dcom_iertutil_dll_hijack.yml
author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga, Huntrule Team
date: 2020-10-12
modified: 2022-12-18
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1021.003
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image: System
    TargetFilename|endswith: \Internet Explorer\iertutil.dll
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1

What it detects

This rule flags file activity where the Windows System process writes an iertutil.dll located under a DCOM InternetExplorer.Application path over the network. Attackers can use this type of DLL hijack to force a remote COM/DCOM component to load a malicious DLL and execute code. It relies on Windows file event telemetry that records the process image and the target filename.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.