Windows Office Apps Load .NET DLLs from C:\Windows\assembly

title: Windows Office Apps Load .NET DLLs from C:\Windows\assembly
id: 5cf5b92f-68ce-4b3d-8b1c-7af2dece080d
status: test
description: This rule flags image load events where Microsoft Office executables (Excel, Outlook, PowerPoint, OneNote, Word, and Publisher) load a DLL from the C:\Windows\assembly\ directory. Loading assemblies from this location can be used to execute or extend code within the Office process context. The detection relies on Windows image load telemetry capturing the loading process path and the loaded DLL path.
references:
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_dotnet_assembly_dll_load.yml
author: Antonlovesdnb, Huntrule Team
date: 2020-02-19
modified: 2023-03-29
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - \excel.exe
      - \mspub.exe
      - \onenote.exe
      - \onenoteim.exe
      - \outlook.exe
      - \powerpnt.exe
      - \winword.exe
    ImageLoaded|startswith: C:\Windows\assembly\
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ff0f2b05-09db-4095-b96d-1b75ca24894a
    type: derived