Windows mpclient.dll Side-Loading via MpCmdRun.exe or NisSrv.exe from Non-Default Directories

title: Windows mpclient.dll Side-Loading via MpCmdRun.exe or NisSrv.exe from Non-Default Directories
id: fd48707b-194e-406a-bcb8-d088c938a0d3
related:
  - id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9
    type: similar
  - id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc
    type: derived
status: test
description: This rule flags Windows image loads where mpclient.dll is loaded by the Windows Defender-related processes MpCmdRun.exe and NisSrv.exe from a directory other than the known default locations. Sideloading a DLL in this way can help attackers execute malicious code under the context of trusted system components. The detection relies on image load telemetry indicating the loaded module path and the parent process image path.
references:
  - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_windows_defender.yml
author: Bhabesh Raj, Huntrule Team
date: 2022-08-02
modified: 2023-08-04
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|endswith: \mpclient.dll
    Image|endswith:
      - \MpCmdRun.exe
      - \NisSrv.exe
  filter_main_known_locations:
    Image|startswith:
      - C:\Program Files (x86)\Windows Defender\
      - C:\Program Files\Microsoft Security Client\
      - C:\Program Files\Windows Defender\
      - C:\ProgramData\Microsoft\Windows Defender\Platform\
      - C:\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1