huntrule

Windows DLL Load: SharpEvtMute EvtMuteHook.dll Imphash

Detects DLL loads with a specific IMPHASH consistent with EvtMuteHook.dll used for event log tampering.

FreeUnreviewedSigmahighv1
title: "Windows DLL Load: SharpEvtMute EvtMuteHook.dll Imphash"
id: 458bcafa-58f5-4d94-9bfe-330769f5e9b5
related:
  - id: bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c
    type: similar
  - id: 49329257-089d-46e6-af37-4afce4290685
    type: derived
status: test
description: This rule flags a Windows DLL load event matching a specific IMPHASH associated with EvtMuteHook.dll, a component of the SharpEvtMute/EvtMute log tampering tool. Attackers may use this kind of module to interfere with Windows event logging, reducing detection and forensic visibility. The detection relies on image load telemetry that includes the DLL’s IMPHASH to match the observed module.
references:
  - https://github.com/bats3c/EvtMute
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_hktl_sharpevtmute.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-07
modified: 2024-11-23
tags:
  - attack.defense-impairment
  - attack.t1685.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Hashes|contains: IMPHASH=330768A4F172E10ACB6287B87289D83B
  condition: selection
falsepositives:
  - Other DLLs with the same Imphash
level: high
license: DRL-1.1

What it detects

This rule flags a Windows DLL load event matching a specific IMPHASH associated with EvtMuteHook.dll, a component of the SharpEvtMute/EvtMute log tampering tool. Attackers may use this kind of module to interfere with Windows event logging, reducing detection and forensic visibility. The detection relies on image load telemetry that includes the DLL’s IMPHASH to match the observed module.

Known false positives

  • Other DLLs with the same Imphash

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.