huntrule

Windows SolidPDFCreator.dll Sideloading via ImageLoad Events

Alerts when SolidPDFCreator.dll is loaded from a non-standard process or path, consistent with potential DLL sideloading.

FreeUnreviewedSigmamediumv1
title: Windows SolidPDFCreator.dll Sideloading via ImageLoad Events
id: 68420b74-8c83-4fe0-88cb-7a74a6d85ab4
status: test
description: This rule flags cases where SolidPDFCreator.dll is loaded by a Windows process, while the loading binary path does not match SolidPDFCreator.exe located under the expected SolidDocuments installation directories. DLL sideloading can allow an attacker to execute malicious code in the context of a legitimate application by forcing it to load a spoofed dependency. It relies on image load telemetry that includes the loaded DLL path and the loading process image path.
references:
  - https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_solidpdfcreator.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-07
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \SolidPDFCreator.dll
  filter_main_path:
    Image|endswith: \SolidPDFCreator.exe
    ImageLoaded|startswith:
      - C:\Program Files (x86)\SolidDocuments\SolidPDFCreator\
      - C:\Program Files\SolidDocuments\SolidPDFCreator\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a2edbce1-95c8-4291-8676-0d45146862b3
    type: derived

What it detects

This rule flags cases where SolidPDFCreator.dll is loaded by a Windows process, while the loading binary path does not match SolidPDFCreator.exe located under the expected SolidDocuments installation directories. DLL sideloading can allow an attacker to execute malicious code in the context of a legitimate application by forcing it to load a spoofed dependency. It relies on image load telemetry that includes the loaded DLL path and the loading process image path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.