Windows DLL sideloading: GUP.EXE loading libcurl.dll from uncommon path

title: "Windows DLL sideloading: GUP.EXE loading libcurl.dll from uncommon path"
id: 890a6c9d-1f95-4c04-9df2-7f1b1c48b65c
status: test
description: This rule flags cases where gup.exe loads libcurl.dll, specifically when both process and DLL paths end with gup.exe and libcurl.dll. DLL sideloading can allow attackers to execute malicious code or influence a legitimate application’s behavior by abusing Windows DLL search/loading order. It relies on image load telemetry that records the loaded DLL path and can correlate it to the loading process image.
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_gup_libcurl.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \gup.exe
    ImageLoaded|endswith: \libcurl.dll
  filter_main_notepad_plusplus:
    Image|endswith: \Notepad++\updater\GUP.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e49b5745-1064-4ac1-9a2e-f687bc2dd37e
    type: derived