Windows DLL Sideloading via coregen.exe

Identifies potential DLL sideloading when coregen.exe loads DLLs outside expected system and Silverlight locations.

FreeUnreviewedSigmamediumv1

windows-dll-sideloading-via-coregen-exe-0fa66f66

title: Windows DLL Sideloading via coregen.exe
id: 2124fed4-a776-4cc8-a296-7e1cd8ee3ae7
status: test
description: This rule flags executions where coregen.exe loads a DLL, consistent with DLL sideloading behavior. Attackers may use coregen.exe to cause a trusted binary to load an attacker-controlled library, which can help with stealth and privilege escalation. The detection relies on image-load telemetry matching coregen.exe and excluding known legitimate load paths.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Coregen/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_coregen.yml
author: frack113, Huntrule Team
date: 2022-12-31
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1218
  - attack.t1055
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \coregen.exe
  filter_main_legit_paths:
    ImageLoaded|startswith:
      - C:\Program Files (x86)\Microsoft Silverlight\
      - C:\Program Files\Microsoft Silverlight\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0fa66f66-e3f6-4a9c-93f8-4f2610b00171
    type: derived

What it detects

This rule flags executions where coregen.exe loads a DLL, consistent with DLL sideloading behavior. Attackers may use coregen.exe to cause a trusted binary to load an attacker-controlled library, which can help with stealth and privilege escalation. The detection relies on image-load telemetry matching coregen.exe and excluding known legitimate load paths.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.