Windows DLL Side-Loading via ClassicExplorer32.dll Loaded from Non-Classic Shell Path

title: Windows DLL Side-Loading via ClassicExplorer32.dll Loaded from Non-Classic Shell Path
id: f3b91c9b-1a0d-4227-a5e2-03e960275199
status: test
description: This rule flags Windows processes that load ClassicExplorer32.dll when the DLL is not loaded from the expected Classic Shell installation directory. DLL sideloading is a common technique for gaining persistence or executing attacker-controlled code by abusing how Windows searches and loads libraries. The detection relies on image load telemetry indicating the loaded DLL path and filename, specifically matching ClassicExplorer32.dll while excluding loads from C:\Program Files\Classic Shell\.
references:
  - https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets
  - https://app.any.run/tasks/6d8cabb0-dcda-44b6-8050-28d6ce281687/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_classicexplorer32.yml
author: frack113, Huntrule Team
date: 2022-12-13
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection_classicexplorer:
    ImageLoaded|endswith: \ClassicExplorer32.dll
  filter_classicexplorer:
    ImageLoaded|startswith: C:\Program Files\Classic Shell\
  condition: selection_classicexplorer and not filter_classicexplorer
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: caa02837-f659-466f-bca6-48bde2826ab4
    type: derived