Windows Security: Remote DCOM IE Iertutil.dll DLL Hijack via Network File Write (5145)

Flags network file writes of iertutil.dll under IE’s Program Files path associated with potential DCOM DLL hijacking.

FreeUnreviewedSigmahighv1

windows-security-remote-dcom-ie-iertutil-dll-dll-hijack-via-network-file-write-5-c39f0c81

title: "Windows Security: Remote DCOM IE Iertutil.dll DLL Hijack via Network File Write (5145)"
id: 8e16e159-fd6c-4edd-a342-84a7dbbe36fa
status: test
description: This rule identifies network activity that creates or writes a file named iertutil.dll in the C:\Program Files\Internet Explorer\ directory, consistent with a DCOM InternetExplorer DLL hijack attempt. Attackers may use this placement to influence how a launched component loads a malicious or replaced DLL. It relies on Windows Security auditing event 5145 and matches requests whose RelativeTargetName ends with the iertutil.dll path, excluding computer account activity where SubjectUserName ends with $.
references:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dcom_iertutil_dll_hijack.yml
author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), Huntrule Team
date: 2020-10-12
modified: 2022-11-26
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1021.003
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    RelativeTargetName|endswith: \Internet Explorer\iertutil.dll
  filter:
    SubjectUserName|endswith: $
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c39f0c81-7348-4965-ab27-2fde35a1b641
    type: derived

What it detects

This rule identifies network activity that creates or writes a file named iertutil.dll in the C:\Program Files\Internet Explorer\ directory, consistent with a DCOM InternetExplorer DLL hijack attempt. Attackers may use this placement to influence how a launched component loads a malicious or replaced DLL. It relies on Windows Security auditing event 5145 and matches requests whose RelativeTargetName ends with the iertutil.dll path, excluding computer account activity where SubjectUserName ends with $.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.