huntrule

Windows Suspicious DLL Side-Loading: KeyScramblerIE.dll Loaded by KeyScrambler.exe

Alerts on KeyScrambler.exe loading KeyScramblerIE.dll, a common DLL side-loading pattern that may indicate malicious library execution.

FreeUnreviewedSigmahighv1
title: "Windows Suspicious DLL Side-Loading: KeyScramblerIE.dll Loaded by KeyScrambler.exe"
id: 322c335f-d5a5-49aa-95b8-59a1236a02ba
related:
  - id: ca5583e9-8f80-46ac-ab91-7f314d13b984
    type: similar
  - id: d2451be2-b582-4e15-8701-4196ac180260
    type: derived
status: test
description: This rule flags cases where KeyScrambler.exe (or KeyScramblerLogon.exe) loads KeyScramblerIE.dll, which can indicate DLL side-loading behavior. Attackers abuse this technique to execute malicious or tampered libraries by making a legitimate-looking executable load an unexpected DLL. The detection relies on Windows image load telemetry, including the loaded module path and (when available) signature details used to exclude apparently legitimate signed library loads.
references:
  - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html
  - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/
  - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/
  - https://twitter.com/Max_Mal_/status/1775222576639291859
  - https://twitter.com/DTCERT/status/1712785426895839339
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_keyscrambler.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-04-15
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - \KeyScrambler.exe
      - \KeyScramblerLogon.exe
    ImageLoaded|endswith: \KeyScramblerIE.dll
  filter_main_legitimate_path:
    Image|contains:
      - C:\Program Files (x86)\KeyScrambler\
      - C:\Program Files\KeyScrambler\
    ImageLoaded|contains:
      - C:\Program Files (x86)\KeyScrambler\
      - C:\Program Files\KeyScrambler\
  filter_main_signature:
    Signature: QFX Software Corporation
    SignatureStatus: Valid
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags cases where KeyScrambler.exe (or KeyScramblerLogon.exe) loads KeyScramblerIE.dll, which can indicate DLL side-loading behavior. Attackers abuse this technique to execute malicious or tampered libraries by making a legitimate-looking executable load an unexpected DLL. The detection relies on Windows image load telemetry, including the loaded module path and (when available) signature details used to exclude apparently legitimate signed library loads.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.