Windows DLL sideloading suspicion via image load of JsSchHlp DLL

title: Windows DLL sideloading suspicion via image load of JsSchHlp DLL
id: 34d7869c-9343-48d0-8ebb-c7eb248db864
status: test
description: This rule flags Windows image loads where the loaded DLL name ends with '\JSESPR.dll' but is not loaded from the expected Justsystem JsSchHlp installation directory. Attackers may sideload a malicious DLL to hijack execution flow of a trusted component, enabling persistence or privilege escalation. The detection relies on image load telemetry, specifically the loaded DLL path and filename from image_load events.
references:
  - https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/
  - http://www.windowexe.com/bbs/board.php?q=jsschhlp-exe-c-program-files-common-files-justsystem-jsschhlp-jsschhlp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_jsschhlp.yml
author: frack113, Huntrule Team
date: 2022-12-14
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \JSESPR.dll
  filter:
    ImageLoaded|startswith: C:\Program Files\Common Files\Justsystem\JsSchHlp\
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 68654bf0-4412-43d5-bfe8-5eaa393cd939
    type: derived