[[prebuilt-rule-8-3-3-potential-dll-sideloading-via-trusted-microsoft-programs]]
=== Potential DLL SideLoading via Trusted Microsoft Programs

Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes.

*Rule type*: eql

*Rule indices*: 

* winlogbeat-*
* logs-endpoint.events.*
* logs-windows.*
* endgame-*

*Severity*: high

*Risk score*: 73

*Runs every*: 5m

*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)

*Maximum alerts per execution*: 100

*References*: None

*Tags*: 

* Elastic
* Host
* Windows
* Threat Detection
* Defense Evasion
* Elastic Endgame

*Version*: 102

*Rule authors*: 

* Elastic

*Rule license*: Elastic License v2


==== Investigation guide


[source, markdown]
----------------------------------

----------------------------------

==== Rule query


[source, js]
----------------------------------
process where event.type == "start" and
  process.pe.original_file_name in ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE") and
  not (process.name : ("winword.exe", "explorer.exe", "w3wp.exe", "Dism.exe") or
         process.executable : ("?:\\Windows\\explorer.exe",
                               "?:\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE",
                               "?:\\Program Files?(x86)\\Microsoft Office\\root\\Office*\\WINWORD.EXE",
                               "?:\\Windows\\System32\\Dism.exe",
                               "?:\\Windows\\SysWOW64\\Dism.exe",
                               "?:\\Windows\\System32\\inetsrv\\w3wp.exe")
         )

----------------------------------

*Framework*: MITRE ATT&CK^TM^

* Tactic:
** Name: Defense Evasion
** ID: TA0005
** Reference URL: https://attack.mitre.org/tactics/TA0005/
* Technique:
** Name: Masquerading
** ID: T1036
** Reference URL: https://attack.mitre.org/techniques/T1036/