Windows Office DLL sideloading via outllib.dll image load outside expected Office paths

title: Windows Office DLL sideloading via outllib.dll image load outside expected Office paths
id: db8a6b41-6e07-4ced-ba27-5628dc8095e2
status: test
description: This rule flags processes that load a DLL named outllib.dll while the file path is not within common Microsoft Office directories. DLL sideloading is a stealthy technique attackers use to make a malicious or unexpected DLL load under the context of legitimate Office-related binaries. The detection relies on Windows image-load telemetry that records the loaded module path.
references:
  - https://hijacklibs.net/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_office_dlls.yml
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research), Huntrule Team
date: 2022-08-17
modified: 2023-03-15
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \outllib.dll
  filter:
    ImageLoaded|startswith:
      - C:\Program Files\Microsoft Office\OFFICE
      - C:\Program Files (x86)\Microsoft Office\OFFICE
      - C:\Program Files\Microsoft Office\Root\OFFICE
      - C:\Program Files (x86)\Microsoft Office\Root\OFFICE
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 829a3bdf-34da-4051-9cf4-8ed221a8ae4f
    type: derived