Sigma high test sigma

Aruba Network Service Potential DLL Sideloading

Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": "\\arubanetsvc.exe",
    "ImageLoaded
| endswith": [
      "\\wtsapi32.dll",
      "\\msvcr100.dll",
      "\\msvcp100.dll",
      "\\dbghelp.dll",
      "\\dbgcore.dll",
      "\\wininet.dll",
      "\\iphlpapi.dll",
      "\\version.dll",
      "\\cryptsp.dll",
      "\\cryptbase.dll",
      "\\wldp.dll",
      "\\profapi.dll",
      "\\sspicli.dll",
      "\\winsta.dll",
      "\\dpapi.dll"
    ]
  },
  "filter": {
    "ImageLoaded
| startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not filter"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...