title: Potential COLDSTEEL Persistence Service DLL Load
id: 1d7a57da-02e0-4f7f-92b1-c7b486ccfed5
status: test
description: |
    Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-02
tags:
    - attack.persistence
    - detection.emerging-threats
    - attack.stealth
logsource:
    product: windows
    category: image_load
detection:
    selection:
        Image|endswith: '\svchost.exe'
        ImageLoaded|endswith: '\AppData\Roaming\newdev.dll'
    condition: selection
falsepositives:
    - Unlikely
level: high