Windows ImageLoad of vivaldi_elf.dll Suggesting Potential DLL Sideloading

title: Windows ImageLoad of vivaldi_elf.dll Suggesting Potential DLL Sideloading
id: ea452673-fa85-4c81-bb3d-19d191abe3ee
status: test
description: This rule flags Windows image loads where the loaded module name ends with vivaldi_elf.dll. It matters because loading a DLL from an attacker-controlled location or unexpected path can enable execution of malicious code via DLL search order and sideloading. The detection relies on image load telemetry indicating the loaded DLL filename and checks for a specific legitimate Vivaldi application path to reduce benign matches.
references:
  - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_vivaldi_elf.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-08-03
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \vivaldi_elf.dll
  filter_main_legit_path:
    Image|endswith: \Vivaldi\Application\vivaldi.exe
    ImageLoaded|contains: \Vivaldi\Application\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2092cacb-d77b-4f98-ab0d-32b32f99a054
    type: derived