Windows DCOM InternetExplorer.Application DLL Hijack via iertutil.dll Image Load

title: Windows DCOM InternetExplorer.Application DLL Hijack via iertutil.dll Image Load
id: 61ebdf69-72d6-4872-8c34-06c708bf402a
related:
  - id: e554f142-5cf3-4e55-ace9-a1b59e0def65
    type: obsolete
  - id: 2f7979ae-f82b-45af-ac1d-2b10e93b0baa
    type: similar
  - id: f354eba5-623b-450f-b073-0b5b2773b6aa
    type: derived
status: test
description: This rule flags executions where iexplore.exe loads iertutil.dll from a path under an Internet Explorer directory. Attackers can abuse this DLL-loading behavior to hijack execution flow in components tied to DCOM InternetExplorer.Application. The detection relies on Windows image load telemetry capturing the loaded DLL path and the initiating process image path.
references:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_iexplore_dcom_iertutil_dll_hijack.yml
author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga, Huntrule Team
date: 2020-10-12
modified: 2022-12-18
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1021.003
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image|endswith: \Internet Explorer\iexplore.exe
    ImageLoaded|endswith: \Internet Explorer\iertutil.dll
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1