Windows ImageLoad: Potential 7za.dll Sideloading via Untrusted Image Paths

Alerts when a process loads 7za.dll from a non-Program Files path, indicating potential DLL sideloading.

FreeUnreviewedSigmalowv1

windows-imageload-potential-7za-dll-sideloading-via-untrusted-image-paths-4f6edb78

title: "Windows ImageLoad: Potential 7za.dll Sideloading via Untrusted Image Paths"
id: 276d2005-6713-4b44-9a5b-1001de808242
status: test
description: This rule flags Windows processes that load a DLL named "7za.dll" when the loaded image path does not begin with common Microsoft Program Files directories. DLL sideloading can allow an attacker to run malicious code under the context of a legitimate process by forcing it to load a crafted dependency. It relies on image load telemetry capturing the loaded DLL path (ImageLoaded).
references:
  - https://www.gov.pl/attachment/ee91f24d-3e67-436d-aa50-7fa56acf789d
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_7za.yml
author: X__Junior, Huntrule Team
date: 2023-06-09
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \7za.dll
  filter_main_legit_path:
    Image|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
    ImageLoaded|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate third party application located in "AppData" may leverage this DLL to offer 7z compression functionality and may generate false positives. Apply additional filters as needed.
level: low
license: DRL-1.1
related:
  - id: 4f6edb78-5c21-42ab-a558-fd2a6fc1fd57
    type: derived

What it detects

This rule flags Windows processes that load a DLL named "7za.dll" when the loaded image path does not begin with common Microsoft Program Files directories. DLL sideloading can allow an attacker to run malicious code under the context of a legitimate process by forcing it to load a crafted dependency. It relies on image load telemetry capturing the loaded DLL path (ImageLoaded).

Known false positives

Legitimate third party application located in "AppData" may leverage this DLL to offer 7z compression functionality and may generate false positives. Apply additional filters as needed.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.