Windows VMGuestLib.dll Sideloading via WmiApSrv ImageLoad

Flags WmiApSrv.exe loading VMGuestLib.dll from VMware Tools vmStatsProvider on Windows.

FreeUnreviewedSigmamediumv1

windows-vmguestlib-dll-sideloading-via-wmiapsrv-imageload-70e8e9b4

title: Windows VMGuestLib.dll Sideloading via WmiApSrv ImageLoad
id: ae66ab4d-8608-415e-88d9-72b3a9b4044d
status: test
description: This rule identifies DLL sideloading where vmGuestLib.dll is loaded from the VMware Tools vmStatsProvider path during execution of WmiApSrv.exe (Windows\System32\wbem). Such behavior matters because it can allow an attacker to influence what code is loaded and executed in a trusted process context. The detection relies on image-load telemetry that records the loaded DLL path and the parent executable path, and it filters for signed activity.
references:
  - https://decoded.avast.io/martinchlumecky/png-steganography/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_vmguestlib.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-01
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|contains|all:
      - \VMware\VMware Tools\vmStatsProvider\win32
      - \vmGuestLib.dll
    Image|endswith: \Windows\System32\wbem\WmiApSrv.exe
  filter:
    Signed: "true"
  condition: selection and not filter
falsepositives:
  - FP could occur if the legitimate version of vmGuestLib already exists on the system
level: medium
license: DRL-1.1
related:
  - id: 70e8e9b4-6a93-4cb7-8cde-da69502e7aff
    type: derived

What it detects

This rule identifies DLL sideloading where vmGuestLib.dll is loaded from the VMware Tools vmStatsProvider path during execution of WmiApSrv.exe (Windows\System32\wbem). Such behavior matters because it can allow an attacker to influence what code is loaded and executed in a trusted process context. The detection relies on image-load telemetry that records the loaded DLL path and the parent executable path, and it filters for signed activity.

Known false positives

FP could occur if the legitimate version of vmGuestLib already exists on the system

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.