Sigma high test sigma

Lazarus APT DLL Sideloading Activity

Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

View Source

Detection Logic

{
  "selection_mscoree": {
    "Image": "C:\\ProgramShared\\PresentationHost.exe",
    "ImageLoaded": ":\\ProgramShared\\mscoree.dll"
  },
  "selection_colorui": {
    "Image": "C:\\ProgramData\\Adobe\\colorcpl.exe",
    "ImageLoaded": "C:\\ProgramData\\Adobe\\colorui.dll"
  },
  "selection_mapistub": {
    "Image": "C:\\ProgramData\\Oracle\\Java\\fixmapi.exe",
    "ImageLoaded": "C:\\ProgramData\\Oracle\\Java\\mapistub.dll"
  },
  "selection_hid": {
    "Image": "C:\\ProgramData\\Adobe\\ARM\\tabcal.exe",
    "ImageLoaded": "C:\\ProgramData\\Adobe\\ARM\\HID.dll"
  },
  "condition": "1 of selection_*"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...