Windows DLL Sideloading: ImageLoaded 'wwlib.dll' Associated with Winword

title: "Windows DLL Sideloading: ImageLoaded 'wwlib.dll' Associated with Winword"
id: 8abe153c-e537-4282-8b0d-5c6a8221b794
status: test
description: This rule flags Windows processes loading a DLL named wwlib.dll where the loaded image path ends with '\wwlib.dll', but the event is not tied to common Microsoft Office main paths. DLL sideloading can allow an attacker to run code under the trust context of a legitimate application such as Winword by placing or triggering a malicious DLL load. Telemetry relies on image-load events that include both the main process image path and the loaded DLL path.
references:
  - https://twitter.com/WhichbufferArda/status/1658829954182774784
  - https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/
  - https://securelist.com/apt-luminousmoth/103332/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_wwlib.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-18
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \wwlib.dll
  filter_main_path:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft Office\
      - C:\Program Files\Microsoft Office\
    Image|endswith: \winword.exe
    ImageLoaded|startswith:
      - C:\Program Files (x86)\Microsoft Office\
      - C:\Program Files\Microsoft Office\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e2e01011-5910-4267-9c3b-4149ed5479cf
    type: derived