Windows DLL Sideloading via SmadHook32c.dll or SmadHook64c.dll Image Load

title: Windows DLL Sideloading via SmadHook32c.dll or SmadHook64c.dll Image Load
id: 1a08f74d-a85a-4d0a-b48b-36096fe630ac
status: test
description: This rule flags Windows image loads of SmadHook32c.dll or SmadHook64c.dll when the loaded DLL path is not within the expected SMADAV program directories. DLL sideloading is a common attacker technique to execute malicious code by forcing a trusted process to load an unintended library. The detection relies on image_load telemetry, using DLL filename suffix matches and exclusions for known legitimate SmadavProtect32/64 locations.
references:
  - https://research.checkpoint.com/2023/malware-spotlight-camaro-dragons-tinynote-backdoor/
  - https://www.qurium.org/alerts/targeted-malware-against-crph/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_smadhook.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-01
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - \SmadHook32c.dll
      - \SmadHook64c.dll
  filter_main_legit_path:
    Image:
      - C:\Program Files (x86)\SMADAV\SmadavProtect32.exe
      - C:\Program Files (x86)\SMADAV\SmadavProtect64.exe
      - C:\Program Files\SMADAV\SmadavProtect32.exe
      - C:\Program Files\SMADAV\SmadavProtect64.exe
    ImageLoaded|startswith:
      - C:\Program Files (x86)\SMADAV\
      - C:\Program Files\SMADAV\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 24b6cf51-6122-469e-861a-22974e9c1e5b
    type: derived