Windows: Flag VMwareXferlogs.exe loading glib-2.0.dll from non-default path

title: "Windows: Flag VMwareXferlogs.exe loading glib-2.0.dll from non-default path"
id: 6a772100-64a2-4f2f-82d3-683c29580bfc
status: test
description: This rule identifies when the VMware Xfer logs utility (VMwareXferlogs.exe) loads a specific DLL (glib-2.0.dll) from a directory outside the expected default VMware installation path. Adversaries may abuse DLL search/path behavior by placing a malicious library in a non-standard location so it is loaded by a legitimate binary. The detection relies on Windows image load telemetry that records the calling image and the loaded DLL path.
references:
  - https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_vmware_xfer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-02
modified: 2023-02-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image|endswith: \VMwareXferlogs.exe
    ImageLoaded|endswith: \glib-2.0.dll
  filter:
    ImageLoaded|startswith: C:\Program Files\VMware\
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 9313dc13-d04c-46d8-af4a-a930cc55d93b
    type: derived