278. Hunting for Suspicious XLL Files
Hello everyone! Adverasries keep experimenting with file types they use for phishing. And this time we'll look at UAC-0245 and XLL files. According to the report , the adversary leverarage malicious XLL files to deliver CABINETRAT . Such files had some very interesting behaviors. For example, the file created another XLL file in "%APPDATA%\Microsoft\Excel\XLSTART\" enabling the adversary to use Office Template Macros (T1137.001) for persistence. First of all, we can hunt for any suspicious XLL files: event_type: "processcreatewin" AND cmdline: *.xll Another detection opportunity is to look for suspicious XLL file creation events related to XLSTART folder: event_type: "filecreatewin" AND file_path: "xlstart" AND file_extension: "xll" See you tomorrow!