Windows DLL Search Order Hijacking: Suspicious DLL Writes to AppData/OneDrive/Teams Paths

title: "Windows DLL Search Order Hijacking: Suspicious DLL Writes to AppData/OneDrive/Teams Paths"
id: 29f9d3d3-0f97-4a39-9ee3-bd07095e1b4e
status: test
description: This rule flags Windows events where a process ending in common Office/command scripting utilities or PowerShell creates a .dll file under user AppData and related OneDrive/Teams/Slack/VS Code directories. Writing a DLL into these dependency-related locations can be used to influence DLL search order and cause a legitimate application to load an attacker-controlled module. The detection relies on file creation telemetry, matching the writer process name, and the target DLL path and filename characteristics.
references:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc
  - https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml
author: Tim Rauch (rule), Elastic (idea), Huntrule Team
date: 2022-10-21
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1566
  - attack.t1566.001
  - attack.initial-access
  - attack.t1574
  - attack.t1574.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \winword.exe
      - \excel.exe
      - \powerpnt.exe
      - \MSACCESS.EXE
      - \MSPUB.EXE
      - \fltldr.exe
      - \cmd.exe
      - \certutil.exe
      - \mshta.exe
      - \cscript.exe
      - \wscript.exe
      - \curl.exe
      - \powershell.exe
      - \pwsh.exe
    TargetFilename|endswith: .dll
    TargetFilename|contains|all:
      - \Users\
      - \AppData\
    TargetFilename|contains:
      - \Microsoft\OneDrive\
      - \Microsoft OneDrive\
      - \Microsoft\Teams\
      - \Local\slack\app-
      - \Local\Programs\Microsoft VS Code\
  filter:
    Image|endswith: \cmd.exe
    TargetFilename|contains|all:
      - \Users\
      - \AppData\
      - \Microsoft\OneDrive\
      - \api-ms-win-core-
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
    type: derived