Windows: Potential RoboForm DLL sideloading via image load of roboform.dll

title: "Windows: Potential RoboForm DLL sideloading via image load of roboform.dll"
id: 7846ccb1-3d23-4808-8579-bcdfef6c555c
status: test
description: This rule flags Windows image loads of RoboForm-specific DLLs (roboform.dll or roboform-x64.dll) when they are not consistent with expected parent executables. Such DLL sideloading can allow an attacker to execute malicious code by placing or forcing a DLL load path. The detection relies on Windows image_load telemetry that captures the loaded module path and filters by the expected RoboForm installation directory and robotaskbaricon* executables.
references:
  - https://twitter.com/StopMalvertisin/status/1648604148848549888
  - https://twitter.com/t3ft3lb/status/1656194831830401024
  - https://www.roboform.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_robform.yml
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-14
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - \roboform.dll
      - \roboform-x64.dll
  filter_main_path:
    Image|startswith:
      - " C:\\Program Files (x86)\\Siber Systems\\AI RoboForm\\"
      - " C:\\Program Files\\Siber Systems\\AI RoboForm\\"
    Image|endswith:
      - \robotaskbaricon.exe
      - \robotaskbaricon-x64.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - If installed on a per-user level, the path would be located in "AppData\Local". Add additional filters to reflect this mode of installation
level: medium
license: DRL-1.1
related:
  - id: f64c9b2d-b0ad-481d-9d03-7fc75020892a
    type: derived