huntrule

Windows ImageLoad: Potential EACore.dll Sideloading via EA Desktop

Alerts on Windows loading of EACore.dll that may indicate DLL sideloading, excluding a specific EA Desktop legitimate case.

FreeUnreviewedSigmahighv1
title: "Windows ImageLoad: Potential EACore.dll Sideloading via EA Desktop"
id: 552a14c0-f4d6-4676-b92f-9f9db8109733
status: test
description: This rule flags Windows image load events where the loaded file path ends with EACore.dll, a potential indicator of DLL sideloading. Attackers may place or redirect a malicious DLL so it is loaded by a trusted executable, enabling stealthy execution, persistence, or privilege escalation. It relies on image-load telemetry that records the loaded module path (ImageLoaded) and the originating image path (Image) to exclude a specific known legitimate EA Desktop/EACoreServer.exe context.
references:
  - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_eacore.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-08-03
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \EACore.dll
  filter_main_legit_path:
    Image|contains|all:
      - C:\Program Files\Electronic Arts\EA Desktop\
      - \EACoreServer.exe
    ImageLoaded|startswith: C:\Program Files\Electronic Arts\EA Desktop\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5
    type: derived

What it detects

This rule flags Windows image load events where the loaded file path ends with EACore.dll, a potential indicator of DLL sideloading. Attackers may place or redirect a malicious DLL so it is loaded by a trusted executable, enabling stealthy execution, persistence, or privilege escalation. It relies on image-load telemetry that records the loaded module path (ImageLoaded) and the originating image path (Image) to exclude a specific known legitimate EA Desktop/EACoreServer.exe context.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.