Windows: FoggyWeb backdoor DLL hijacking via loading version.dll

Alert on loading C:\Windows\ADFS\version.dll, a DLL hijacking indicator consistent with the FoggyWeb technique.

FreeUnreviewedSigmacriticalv1

windows-foggyweb-backdoor-dll-hijacking-via-loading-version-dll-640dc51c

title: "Windows: FoggyWeb backdoor DLL hijacking via loading version.dll"
id: 1ed072ee-5e5c-4826-9d1e-cb49345fdf5e
status: test
description: This rule flags a Windows process that loads a specific DLL path, C:\Windows\ADFS\version.dll. Loading an unexpected or replaced DLL can indicate DLL hijacking used to run malicious code under a legitimate process context. The detection relies on image-load telemetry that records the exact DLL file path being loaded.
references:
  - https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/FoggyWeb/image_load_malware_foggyweb_nobelium.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-09-27
modified: 2022-12-09
tags:
  - attack.resource-development
  - attack.t1587
  - detection.emerging-threats
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded: C:\Windows\ADFS\version.dll
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 640dc51c-7713-4faa-8a0e-e7c0d9d4654c
    type: derived

What it detects

This rule flags a Windows process that loads a specific DLL path, C:\Windows\ADFS\version.dll. Loading an unexpected or replaced DLL can indicate DLL hijacking used to run malicious code under a legitimate process context. The detection relies on image-load telemetry that records the exact DLL file path being loaded.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.