huntrule

Windows image load monitoring: potential waveedit.dll DLL sideloading

Alerts when waveedit.dll is loaded from an unexpected path, suggesting possible DLL sideloading on Windows.

FreeUnreviewedSigmahighv1
title: "Windows image load monitoring: potential waveedit.dll DLL sideloading"
id: 760028cb-f833-43e4-8284-c9610e7f835d
status: test
description: This rule flags processes loading waveedit.dll via Windows image-load telemetry when the DLL load path is not from the expected Nero WaveEditor installation directories. DLL sideloading matters because attackers can execute malicious code by forcing a search/load of a legitimate-named DLL from an unexpected location. The detection relies on ImageLoaded events and compares the loaded DLL path against the known waveedit.exe locations for Nero WaveEditor.
references:
  - https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_waveedit.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-14
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \waveedit.dll
  filter_main_legit_path:
    Image:
      - C:\Program Files (x86)\Nero\Nero Apps\Nero WaveEditor\waveedit.exe
      - C:\Program Files\Nero\Nero Apps\Nero WaveEditor\waveedit.exe
    ImageLoaded|startswith:
      - C:\Program Files (x86)\Nero\Nero Apps\Nero WaveEditor\
      - C:\Program Files\Nero\Nero Apps\Nero WaveEditor\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb
    type: derived

What it detects

This rule flags processes loading waveedit.dll via Windows image-load telemetry when the DLL load path is not from the expected Nero WaveEditor installation directories. DLL sideloading matters because attackers can execute malicious code by forcing a search/load of a legitimate-named DLL from an unexpected location. The detection relies on ImageLoaded events and compares the loaded DLL path against the known waveedit.exe locations for Nero WaveEditor.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.