huntrule

Windows DLL Search Order Hijacking via arubanetsvc.exe DLL Loads

Flags arubanetsvc.exe loading targeted DLLs outside standard system paths, suggesting possible DLL search order hijacking.

FreeUnreviewedSigmahighv1
title: Windows DLL Search Order Hijacking via arubanetsvc.exe DLL Loads
id: 1a4c64d6-aa92-454b-8f08-5535213cd96c
status: test
description: This rule identifies potential DLL sideloading by flagging DLL load events where arubanetsvc.exe loads specific DLLs that may indicate DLL search order hijacking. Such activity can be used by an attacker to execute malicious code in the context of a legitimate process. The detection relies on Windows DLL image load telemetry, specifically process image paths ending with arubanetsvc.exe and the loaded DLL names, excluding DLLs loaded from common Windows directories.
references:
  - https://twitter.com/wdormann/status/1616581559892545537?t=XLCBO9BziGzD7Bmbt8oMEQ&s=09
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_aruba_networks_virtual_intranet_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-22
modified: 2023-03-15
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \arubanetsvc.exe
    ImageLoaded|endswith:
      - \wtsapi32.dll
      - \msvcr100.dll
      - \msvcp100.dll
      - \dbghelp.dll
      - \dbgcore.dll
      - \wininet.dll
      - \iphlpapi.dll
      - \version.dll
      - \cryptsp.dll
      - \cryptbase.dll
      - \wldp.dll
      - \profapi.dll
      - \sspicli.dll
      - \winsta.dll
      - \dpapi.dll
  filter:
    ImageLoaded|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 90ae0469-0cee-4509-b67f-e5efcef040f7
    type: derived

What it detects

This rule identifies potential DLL sideloading by flagging DLL load events where arubanetsvc.exe loads specific DLLs that may indicate DLL search order hijacking. Such activity can be used by an attacker to execute malicious code in the context of a legitimate process. The detection relies on Windows DLL image load telemetry, specifically process image paths ending with arubanetsvc.exe and the loaded DLL names, excluding DLLs loaded from common Windows directories.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.