huntrule

Windows ImageLoad of SVR GraphicalProton Backdoor DLL Names

Flags Windows DLL loads matching known GraphicalProton/SVR DLL filename suffixes.

FreeUnreviewedSigmamediumv1
title: Windows ImageLoad of SVR GraphicalProton Backdoor DLL Names
id: 5a892d2a-8511-4066-8963-af05f6bd4c42
status: test
description: This rule identifies Windows processes that load a set of specific DLL filenames associated with the GraphicalProton backdoor naming used by SVR. Loading these known DLLs can indicate malicious execution or persistence through DLL-based behavior. The detection relies on image-load telemetry that records the full DLL path and matches it by filename suffix.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Cozy-Bear/image_load_apt_cozy_bear_graphical_proton_dlls.yml
author: CISA, Huntrule Team
date: 2023-12-18
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
  - detection.emerging-threats
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - \AclNumsInvertHost.dll
      - \AddressResourcesSpec.dll
      - \BlendMonitorStringBuild.dll
      - \ChildPaletteConnected.dll
      - \DeregisterSeekUsers.dll
      - \HandleFrequencyAll.dll
      - \HardSwapColor.dll
      - \LengthInMemoryActivate.dll
      - \ModeBitmapNumericAnimate.dll
      - \ModeFolderSignMove.dll
      - \ParametersNamesPopup.dll
      - \PerformanceCaptionApi.dll
      - \ScrollbarHandleGet.dll
      - \UnregisterAncestorAppendAuto.dll
      - \WowIcmpRemoveReg.dll
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e64c8ef3-9f98-40c8-b71e-96110991cb4c
    type: derived

What it detects

This rule identifies Windows processes that load a set of specific DLL filenames associated with the GraphicalProton backdoor naming used by SVR. Loading these known DLLs can indicate malicious execution or persistence through DLL-based behavior. The detection relies on image-load telemetry that records the full DLL path and matches it by filename suffix.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.