Windows Process Creation: Extexport.exe Execution Indicative of DLL Sideloading

title: "Windows Process Creation: Extexport.exe Execution Indicative of DLL Sideloading"
id: 6de63986-c43d-4d9a-8df9-15838be7c385
status: test
description: This rule flags Windows process creation events where Extexport.exe is executed, including matches on the executable path ending with \Extexport.exe and the OriginalFileName value of extexport.exe. Extexport.exe is a legitimate utility, but attackers can misuse it to side-load DLLs under certain command-line conditions. The detection relies on process start telemetry that includes the image filename or original file name.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Extexport/
  - https://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/
  - https://www.microsoft.com/en-us/security/blog/2020/03/23/latest-astaroth-living-off-the-land-attacks-are-even-more-invisible-but-not-less-observable/
  - https://res.armor.com/resources/threat-intelligence/astaroth-banking-trojan/
  - https://securelist.com/the-tetrade-brazilian-banking-malware/97779/
  - https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_extexport_execution.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-11-26
modified: 2024-08-26
tags:
  - attack.stealth
  - attack.t1218
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \Extexport.exe
    - OriginalFileName: extexport.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: fb0b815b-f5f6-4f50-970f-ffe21f253f7a
    type: derived