Windows: Flag .exe.local DLL sideload attempts targeting System32 comctl32.dll

title: "Windows: Flag .exe.local DLL sideload attempts targeting System32 comctl32.dll"
id: 1e3cea34-01a6-4f0c-86c0-1a68286e2744
status: test
description: This rule flags creation or presence of files with paths under C:\Windows\System32\*.exe.local that include a trailing \comctl32.dll. This pattern indicates an attempt to sideload a DLL via the Windows .exe.local mechanism for specific signed executables in System32. It matters because DLL sideloading can enable privilege escalation and stealthy persistence. The detection relies on Windows file event telemetry capturing the TargetFilename path.
references:
  - https://github.com/binderlabs/DirCreate2System
  - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_system32_local_folder_privilege_escalation.yml
author: Nasreddine Bencherchali (Nextron Systems), Subhash P (@pbssubhash), Huntrule Team
date: 2022-12-16
modified: 2022-12-19
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith:
      - C:\Windows\System32\logonUI.exe.local
      - C:\Windows\System32\werFault.exe.local
      - C:\Windows\System32\consent.exe.local
      - C:\Windows\System32\narrator.exe.local
      - C:\Windows\System32\wermgr.exe.local
    TargetFilename|endswith: \comctl32.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 07a99744-56ac-40d2-97b7-2095967b0e03
    type: derived