Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ImageLoad detections from hijacklibs.net #195

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

ImageLoad detections from hijacklibs.net #195

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d25c142
hijacklibs includes
nterl0k Jan 28, 2024
e5c3f3a
Update include_hijacklibs.xml
nterl0k Jan 29, 2024
ddbdd34
Add files via upload
nterl0k Jan 29, 2024
5d59f9a
Update exclude_hijacklibs.xml
nterl0k Jan 29, 2024
2664809
Update exclude_hijacklibs.xml
nterl0k Feb 16, 2024
b44494a
Update include_hijacklibs.xml
nterl0k Feb 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions 7_image_load/exclude_hijacklibs.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
<Sysmon schemaversion="4.40">
<EventFiltering>
<RuleGroup name="" groupRelation="or">
<ImageLoad onmatch="exclude">
<Rule groupRelation="and">
<OriginalFileName condition="is">wdscore.dll</OriginalFileName>
<Image condition="is">C:\Windows\servicing\TrustedInstaller.exe</Image> <!-- Windows Updates Installer -->
</Rule>
<Rule groupRelation="and">
<OriginalFileName condition="is any">wdscore.dll;dpx.dll;shell32.dll;NetSetupApi.dll;drvstore.dll</OriginalFileName>
<Image condition="contains all">\Windows\WinSxS\;TiWorker.exe</Image> <!-- Windows Updates Installer -->
</Rule>
<Rule groupRelation="and">
<OriginalFileName condition="is any">msvcr100.dll;msvcr100_clr0400.dll</OriginalFileName>
<ImageLoaded condition="contains">\Program Files\Microsoft Office\</ImageLoaded> <!-- Microsoft Office Noise -->
</Rule>
<Rule groupRelation="and">
<OriginalFileName condition="is any">msvcr100.dll;AppVPolicy.dll;msvcr100_clr0400.dll</OriginalFileName>
<ImageLoaded condition="contains all">\Common Files\;\ClickToRun\</ImageLoaded> <!-- Microsoft Office Noise -->
</Rule>
<Rule groupRelation="and">
<OriginalFileName condition="is any">rastls.dll;dbgeng.dll</OriginalFileName> <!-- Known legit location, not in excludes for Hijacklibs API -->
<ImageLoaded condition="contains">\Windows\System32\</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<OriginalFileName condition="is">mintdh.dll</OriginalFileName> <!-- Microsoft Microsoft Intune -->
<ImageLoaded condition="contains">\Windows\SysWOW64\</ImageLoaded>
</Rule>
<Rule groupRelation="and">
<OriginalFileName condition="is">d3dcompiler_47.dll</OriginalFileName>
<ImageLoaded condition="contains all">\Microsoft\Edge;\Application\</ImageLoaded> <!-- Expected/Common application usage -->
</Rule>
<Rule groupRelation="and">
<OriginalFileName condition="is">d3dcompiler_47.dll</OriginalFileName>
<ImageLoaded condition="contains">\Google\Chrome\Application\</ImageLoaded> <!-- Expected/Common application usage -->
</Rule>
<Rule groupRelation="and">
<OriginalFileName condition="is any">d3dcompiler_47.dll;acrodistdll.dll</OriginalFileName>
<ImageLoaded condition="contains all">\Adobe\;Acrobat</ImageLoaded> <!-- Expected/Common application usage -->
</Rule>
</ImageLoad>
</RuleGroup>
</EventFiltering>
</Sysmon>
Loading