ServiceDll Hijack

{
  "registry_set": {
    "EventID": 13,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "TargetObject
| contains
| all": [
      "\\System\\",
      "ControlSet",
      "\\Services\\"
    ],
    "TargetObject
| endswith": "\\Parameters\\ServiceDll"
  },
  "filter_main_printextensionmanger_1": {
    "Details": "C:\\Windows\\system32\\spool\\drivers\\x64\\3\\PrintConfig.dll"
  },
  "filter_main_printextensionmanger_2": {
    "Image
| endswith": "\\regsvr32.exe",
    "TargetObject
| endswith": "\\Services\\PrintNotify\\Parameters\\ServiceDll",
    "Details
| startswith": "C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\",
    "Details
| endswith": "\\arm64\\PrintConfig.dll"
  },
  "filter_main_domain_controller": {
    "Image": "C:\\Windows\\system32\\lsass.exe",
    "TargetObject
| endswith": "\\Services\\NTDS\\Parameters\\ServiceDll",
    "Details": "%%systemroot%%\\system32\\ntdsa.dll"
  },
  "filter_main_poqexec": {
    "Image": "C:\\Windows\\System32\\poqexec.exe"
  },
  "filter_optional_safetica": {
    "Image
| endswith": "\\regsvr32.exe",
    "Details": "C:\\Windows\\System32\\STAgent.dll"
  },
  "condition": "registry_set and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Administrative scripts
• ⚠ Installation of a service