From 25060eaa08a91674d71ef49f8e9b6cce0d1335c3 Mon Sep 17 00:00:00 2001 From: rabbitstack Date: Fri, 7 Aug 2026 00:46:52 +0200 Subject: [PATCH] feat(rules): DLL loading of a file transferred over SMB Identifies the loading of an unsigned or untrusted DLL shortly after it has been dropped to disk via an SMB file transfer. This behavior is indicative of lateral movement techniques where an attacker transfers a malicious library over an administrative SMB share and immediately executes it on the remote host. --- ...loading_of_a_file_transferred_over_smb.yml | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 rules/lateral_movement_dll_loading_of_a_file_transferred_over_smb.yml diff --git a/rules/lateral_movement_dll_loading_of_a_file_transferred_over_smb.yml b/rules/lateral_movement_dll_loading_of_a_file_transferred_over_smb.yml new file mode 100644 index 000000000..ff77f66ae --- /dev/null +++ b/rules/lateral_movement_dll_loading_of_a_file_transferred_over_smb.yml @@ -0,0 +1,33 @@ +name: DLL loading of a file transferred over SMB +id: e8747023-1cec-4549-b4ac-d272f10bef90 +version: 1.0.0 +description: | + Identifies the loading of an unsigned or untrusted DLL shortly after it has + been dropped to disk via an SMB file transfer. This behavior is indicative + of lateral movement techniques where an attacker transfers a malicious library + over an administrative SMB share and immediately executes it on the remote host. +labels: + tactic.id: TA0008 + tactic.name: Lateral Movement + tactic.ref: https://attack.mitre.org/tactics/TA0008/ + technique.id: T1021 + technique.name: Remote Services + technique.ref: https://attack.mitre.org/techniques/T1021/ + subtechnique.id: T1021.002 + subtechnique.name: SMB/Windows Admin Shares + subtechnique.ref: https://attack.mitre.org/techniques/T1021/002/ +references: + - https://www.elastic.co/security-labs/hunting-for-lateral-movement-using-event-query-language + +condition: > + sequence + maxspan 8m + |create_file and evt.pid = 4 and thread.callstack.kernel_summary imatches ('*|srv2.sys|*', '*|srvnet.sys|*')| by file.path + |load_dll and + ps.name iin ('rundll32.exe', 'regsvr32.exe', 'svchost.exe', 'lsass.exe') and dll.signature.trusted = false and + not (dll.path imatches '?:\\Windows\\VeeamVssSupport\\VeeamVssHook.dll' and ps.exe imatches '?:\\Windows\\System32\\svchost.exe') + | by dll.path + +severity: high + +min-engine-version: 3.1.0