Windows DLL sideloading attempts: CCleanerReactivator.dll loaded by CCleanerReactivator.exe

Identifies potential CCleanerReactivator.dll DLL sideloading when loaded by CCleanerReactivator.exe outside expected CCleaner paths.

FreeUnreviewedSigmamediumv1

windows-dll-sideloading-attempts-ccleanerreactivator-dll-loaded-by-ccleanerreact-3735d5ac

title: "Windows DLL sideloading attempts: CCleanerReactivator.dll loaded by CCleanerReactivator.exe"
id: 269c3465-100b-43a9-8a91-06d101e1e1fe
status: test
description: This rule flags cases where a process loads CCleanerReactivator.dll while the executable loaded is CCleanerReactivator.exe, with the DLL load path not restricted to the expected CCleaner installation directories. DLL sideloading is a stealthy persistence and execution technique because it can cause trusted executables to load attacker-controlled libraries. It relies on Windows image-load telemetry that provides the loaded image path and the corresponding parent process image path.
references:
  - https://lab52.io/blog/2344-2/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_ccleaner_reactivator.yml
author: X__Junior, Huntrule Team
date: 2023-07-13
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \CCleanerReactivator.dll
  filter_main_path:
    Image|startswith:
      - C:\Program Files\CCleaner\
      - C:\Program Files (x86)\CCleaner\
    Image|endswith: \CCleanerReactivator.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - False positives could occur from other custom installation paths. Apply additional filters accordingly.
level: medium
license: DRL-1.1
related:
  - id: 3735d5ac-d770-4da0-99ff-156b180bc600
    type: derived

What it detects

This rule flags cases where a process loads CCleanerReactivator.dll while the executable loaded is CCleanerReactivator.exe, with the DLL load path not restricted to the expected CCleaner installation directories. DLL sideloading is a stealthy persistence and execution technique because it can cause trusted executables to load attacker-controlled libraries. It relies on Windows image-load telemetry that provides the loaded image path and the corresponding parent process image path.

Known false positives

False positives could occur from other custom installation paths. Apply additional filters accordingly.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.