Windows UAC Bypass via iscsicpl.exe Loading Malicious DLL from PATH

Detects iscsicpl.exe loading iscsiexe.dll from outside C:\Windows, consistent with UAC bypass DLL hijacking.

FreeUnreviewedSigmahighv1

windows-uac-bypass-via-iscsicpl-exe-loading-malicious-dll-from-path-9ed5959a

title: Windows UAC Bypass via iscsicpl.exe Loading Malicious DLL from PATH
id: 476004b2-563b-4e46-a1c9-7c915080cf24
status: test
description: This rule flags execution of iscsicpl.exe (SysWOW64) that results in loading a DLL named iscsiexe.dll. It is intended to catch a DLL search order hijacking behavior where an attacker can force iscsicpl.exe to load a controlled DLL, including from user-controlled or temporary locations. The detection relies on Windows image load telemetry that records the parent image (iscsicpl.exe) and the loaded module path ending with \iscsiexe.dll, while excluding loads from the Windows directory.
references:
  - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC
  - https://twitter.com/wdormann/status/1547583317410607110
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_uac_bypass_iscsicpl.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-17
modified: 2022-07-25
tags:
  - attack.privilege-escalation
  - attack.t1548.002
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image: C:\Windows\SysWOW64\iscsicpl.exe
    ImageLoaded|endswith: \iscsiexe.dll
  filter:
    ImageLoaded|contains|all:
      - C:\Windows\
      - iscsiexe.dll
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9ed5959a-c43c-4c59-84e3-d28628429456
    type: derived

What it detects

This rule flags execution of iscsicpl.exe (SysWOW64) that results in loading a DLL named iscsiexe.dll. It is intended to catch a DLL search order hijacking behavior where an attacker can force iscsicpl.exe to load a controlled DLL, including from user-controlled or temporary locations. The detection relies on Windows image load telemetry that records the parent image (iscsicpl.exe) and the loaded module path ending with \iscsiexe.dll, while excluding loads from the Windows directory.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.