mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-08 18:23:52 +00:00
29 lines
838 B
YAML
29 lines
838 B
YAML
title: Active Directory Parsing DLL Loaded Via Office Applications
|
|
id: a2a3b925-7bb0-433b-b508-db9003263cc4
|
|
status: experimental
|
|
description: Detects DSParse DLL being loaded by an Office Product
|
|
references:
|
|
- https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
|
|
author: Antonlovesdnb
|
|
date: 2020/02/19
|
|
tags:
|
|
- attack.initial_access
|
|
- attack.t1193
|
|
logsource:
|
|
product: windows
|
|
service: sysmon
|
|
detection:
|
|
selection:
|
|
EventID: 7
|
|
Image:
|
|
- '*\winword.exe'
|
|
- '*\powerpnt.exe'
|
|
- '*\excel.exe'
|
|
- '*\outlook.exe'
|
|
ImageLoaded:
|
|
- '*\dsparse.dll*'
|
|
condition: selection
|
|
falsepositives:
|
|
- Alerts on legitimate macro usage as well, will need to filter as appropriate
|
|
level: high
|