Windows DLL Load of oci.dll by msdtc.exe for Pingback backdoor ICMP tunneling

title: Windows DLL Load of oci.dll by msdtc.exe for Pingback backdoor ICMP tunneling
id: 6088fb5b-a151-4b58-901e-b9df88a14080
related:
  - id: 35a7dc42-bc6f-46e0-9f83-81f8e56c8d4b
    type: similar
  - id: b2400ffb-7680-47c0-b08a-098a7de7e7a9
    type: similar
  - id: 35a7dc42-bc6f-46e0-9f83-81f8e56c8d4b
    type: derived
status: test
description: This rule identifies a specific Windows image-loading behavior where msdtc.exe loads C:\Windows\oci.dll. Malware and backdoors may use DLL loading from a normal Windows-sounding process to stage functionality while blending into legitimate activity. Detection relies on Windows image load telemetry capturing the loaded DLL path and the initiating image name, matching these exact values.
references:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/backdoor-at-the-end-of-the-icmp-tunnel
  - https://app.any.run/tasks/4a54c651-b70b-4b72-84d7-f34d301d6406
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Pingback/image_load_malware_pingback_backdoor.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-05-05
modified: 2023-02-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
  - detection.emerging-threats
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image|endswith: \msdtc.exe
    ImageLoaded: C:\Windows\oci.dll
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1