Windows: Malicious DLL dropped to OneDrive/Teams AppData path containing iphlpapi.dll

title: "Windows: Malicious DLL dropped to OneDrive/Teams AppData path containing iphlpapi.dll"
id: 2b31c722-4c0d-4428-9a3f-57274f76086c
status: test
description: This rule identifies the creation of a DLL file named iphlpapi.dll within a Windows user AppData path under the Microsoft OneDrive or Teams application directories. Attackers may use a DLL sideloading technique so that when the legitimate application starts, it loads the attacker-controlled DLL instead of the expected one. The detection relies on file creation telemetry with filename and directory path matching to the specific AppData location.
references:
  - https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_iphlpapi_dll_sideloading.yml
author: frack113, Huntrule Team
date: 2022-08-12
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains|all:
      - iphlpapi.dll
      - \AppData\Local\Microsoft
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1908fcc1-1b92-4272-8214-0fbaf2fa5163
    type: derived