Windows Office Apps Loading GAC .NET DLLs via Image Load Events

title: Windows Office Apps Loading GAC .NET DLLs via Image Load Events
id: d406c424-a5e4-4ff7-bc4c-0672111b1a5c
status: test
description: This rule flags image load events where an Office application process (Excel, Outlook, PowerPoint, Word, OneNote, or Publisher) loads a DLL from the .NET GAC_MSIL path under C:\Windows\Microsoft.NET\assembly\GAC_MSIL. Attackers may abuse Office-hosted execution to load .NET components from the Global Assembly Cache. The detection relies on Windows image load telemetry that records both the loading process path and the loaded DLL path.
references:
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_dotnet_gac_dll_load.yml
author: Antonlovesdnb, Huntrule Team
date: 2020-02-19
modified: 2023-02-10
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - \excel.exe
      - \mspub.exe
      - \onenote.exe
      - \onenoteim.exe
      - \outlook.exe
      - \powerpnt.exe
      - \winword.exe
    ImageLoaded|startswith: C:\Windows\Microsoft.NET\assembly\GAC_MSIL
  condition: selection
falsepositives:
  - Legitimate macro usage. Add the appropriate filter according to your environment
level: high
license: DRL-1.1
related:
  - id: 90217a70-13fc-48e4-b3db-0d836c5824ac
    type: derived