Windows DLL Sideloading Attempts via comctl32.dll in .local Directories

title: Windows DLL Sideloading Attempts via comctl32.dll in .local Directories
id: f06463b8-c359-4123-a1fc-325994989c5a
status: test
description: This rule flags image loads where comctl32.dll is resolved from a .local subdirectory under System32, associated with known executable names. Such behavior can indicate DLL sideloading, where a malicious DLL is placed in a search path to run attacker-controlled code with the privileges of the importing process. It relies on Windows image load telemetry capturing the full loaded path for the DLL.
references:
  - https://github.com/binderlabs/DirCreate2System
  - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_comctl32.yml
author: Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash), Huntrule Team
date: 2022-12-16
modified: 2022-12-19
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|startswith:
      - C:\Windows\System32\logonUI.exe.local\
      - C:\Windows\System32\werFault.exe.local\
      - C:\Windows\System32\consent.exe.local\
      - C:\Windows\System32\narrator.exe.local\
      - C:\windows\system32\wermgr.exe.local\
    ImageLoaded|endswith: \comctl32.dll
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 6360757a-d460-456c-8b13-74cf0e60cceb
    type: derived