Windows DLL Sideloading via ProgramData clip.exe/wsmprovhost.exe ImageLoad

title: Windows DLL Sideloading via ProgramData clip.exe/wsmprovhost.exe ImageLoad
id: 253e06ab-52a1-44db-b744-e5d973a78ca3
status: test
description: This rule identifies Windows image loads indicative of DLL sideloading by executing clip.exe and wsmprovhost.exe from ProgramData and loading specific companion DLLs from the same directory. DLL sideloading can help attackers persist and execute malicious code by causing a process to load attacker-controlled libraries. Telemetry relies on process image load events that include the Image path and the ImageLoaded DLL path ending in the targeted filenames and locations.
references:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Diamond-Sleet/image_load_apt_diamond_sleet_side_load.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-24
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
  - detection.emerging-threats
logsource:
  product: windows
  category: image_load
detection:
  selection_1:
    Image|endswith: :\ProgramData\clip.exe
    ImageLoaded|endswith: :\ProgramData\Version.dll
  selection_2:
    Image|endswith: :\ProgramData\wsmprovhost.exe
    ImageLoaded|endswith: :\ProgramData\DSROLE.dll
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: d1b65d98-37d7-4ff6-b139-2d87c1af3042
    type: derived