300. Same Name, Wrong Path
Hello everyone! We talked about how adversaries masquarade malicious files a few times already, but let's look at another qurious case of COM Hijacking (T1546.015). By adding a malicious entry under HKCU that points a CLSID to their DLL, attackers cause normal system processes to load that malicious DLL. In this case, overrode the CLSID for twinapi.dll ( {AA509086-5Ca9-4C25-8F95-589D3C07B48A} ), forcing system processes and web browsers to load the attacker’s DLL. We can hunt for loading twinapi.dll from uncommon locations: event_type: "imageloadwin" AND file_name: "twinapi.dll" AND NOT file_path: ("windows\\system32" OR "windows\\syswow64") See you tomorrow!