295. Hunting for Phantom DLL Hijacking
Hello everyone! Adversaries always want to masquerade malicious files to look like legitimate. In some cases it may enable them to persist as well. Let's look at an example of Hijack Execution Flow: DLL (T1574.001) . For example, adversaries may leverage phantom DLL hijacking by targeting references to non-existent DLL files. Let's look at the report on PassiveNeuron . The threat actors placed malicious DLLs under the following paths: C:\Windows\System32\wlbsctrl.dll C:\Windows\System32\TSMSISrv.dll C:\Windows\System32\oci.dll If present on the system, the first two DLLs are loaded into the svchost.exe process, the other one is loaded into msdtc.exe . For example, we can hunt for file creation events related to these DLLs: event_type: "filecreatewin" AND file_path: "windows\\system32" AND file_name: ("wlbsctrl.dll" OR "tsmsisrv.dll" OR "oci.dll") See you tomorrow!