Module

Executable files consisting of one or more shared classes and interfaces, such as portable executable (PE) format binaries/dynamic link libraries (DLL), executable and linkable format (ELF) binaries/shared libraries, and Mach-O format binaries/shared libraries[1][2]

ID: DS0011
Platforms: Linux, Windows, macOS
Collection Layer: Host
Contributors: Center for Threat-Informed Defense (CTID)
Version: 1.0
Created: 20 October 2021
Last Modified: 30 March 2022

Data Components

Module: Module Load

Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)

Module: Module Load

Attaching a module into the memory of a process/program, typically to access shared resources/features provided by the module (ex: Sysmon EID 7)

Domain ID Name Detects
Enterprise T1547 Boot or Logon Autostart Execution

Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Look for abnormal process behavior that may be due to a process loading a malicious DLL.

.002 Authentication Package

Monitor the LSA process for DLL loads. Windows 8.1 and Windows Server 2012 R2 may generate events when unsigned DLLs try to load into the LSA by setting the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe with AuditLevel = 8. [3] [4]

.003 Time Providers

There is no restriction on the number of custom time providers registrations, though each may require a DLL payload written to disk. [5]

.004 Winlogon Helper DLL

New DLLs written to System32 that do not correlate with known good software or patching may also be suspicious. Look for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

.005 Security Support Provider

Monitor the LSA process for DLL loads. Windows 8.1 and Windows Server 2012 R2 may generate events when unsigned SSP DLLs try to load into the LSA by setting the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe with AuditLevel = 8. [3] [4]

.008 LSASS Driver

Also monitor DLL load operations in lsass.exe. [6]

.010 Port Monitors

Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal. New DLLs written to the System32 directory that do not correlate with known good software or patching may be suspicious.

.012 Print Processors

Monitor for abnormal DLLs that are loaded by spoolsv.exe. Print processors that do not correlate with known good software or patching may be suspicious. New print processor DLLs are written to the print processor directory.

Enterprise T1059 Command and Scripting Interpreter

Monitor for events associated with scripting execution, such as the loading of modules associated with scripting languages (ex: JScript.dll or vbscript.dll).

Analytic 1 - Look for unusual module loads associated with scripting languages.

sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational| search EventCode=7 ImageLoaded IN ("C:\Windows\System32\JScript.dll", "C:\Windows\System32\vbscript.dll", "System.Management.Automation.dll")

.001 PowerShell

Monitor for loading and/or execution of artifacts associated with PowerShell specific assemblies, such as System.Management.Automation.dll (especially to unusual process names/locations).[7][8]

Analytic 1 - Processes loading PowerShell assemblies

sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational| search EventCode=7 ImageLoaded IN ("C:\Windows\System32\System.Management.Automation.dll", "C:\Windows\System32\powershell.exe")

.005 Visual Basic

Monitor for the loading of modules associated with VB languages (ex: vbscript.dll).

Note: For Windows, Sysmon Event ID 7 (Image loaded) can be used to alert on the loading of DLL modules (e.g., vbscript.dll) associated with Visual Basic into processes. Due to the high frequency of image load operations, Event ID 7 can generate a large volume of events. Therefore, we recommend tuning the Sysmon configuration file to exclude common, benign image loads that may result in false positives. This query focuses on monitoring the loading of specific VB-related modules such as vbe6.dll, vbscript.dll, and vba7.dll, which are commonly associated with VB script execution.

Analytic 1 - Look for unusual VB module loads.

sourcetype=windows_security OR sourcetype=wineventlog OR sourcetype=linux_secure OR sourcetype=macos_secure| search (module="vbe6.dll" OR module="vbscript.dll" OR module="vba7.dll")| eval suspicious_module=if(like(module, "vbe6.dll" OR "vbscript.dll" OR "vba7.dll"), "Yes", "No")| where suspicious_module="Yes"

.007 JavaScript

Monitor for the loading of modules associated with scripting languages (ex: JScript.dll).

Enterprise T1546 Event Triggered Execution

Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Look for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as making network connections for Command and Control, learning details about the environment through Discovery, and conducting Lateral Movement.

.006 LC_LOAD_DYLIB Addition

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

.007 Netsh Helper DLL

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

.009 AppCert DLLs

Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Tools such as Sysinternals Autoruns may overlook AppCert DLLs as an auto-starting location. [9] [10]

.010 AppInit DLLs

Monitor DLL loads by processes that load user32.dll and look for DLLs that are not recognized or not normally loaded into a process.

.011 Application Shimming

Monitor DLL loads by processes that load user32.dll and look for DLLs that are not recognized or not normally loaded into a process.

.015 Component Object Model Hijacking

Likewise, if software DLL loads are collected and analyzed, any unusual DLL load that can be correlated with a COM object Registry modification may indicate COM hijacking has been performed.

ICS T0823 Graphical User Interface

Monitor DLL file events, specifically creation of these binary files as well as the loading of DLLs into processes associated with remote graphical connections, such as RDP and VNC. Remote Services may be used to access a host’s GUI.

Enterprise T1574 Hijack Execution Flow

Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths.

.001 DLL Search Order Hijacking

Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths.

.002 DLL Side-Loading

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

.004 Dylib Hijacking

Monitor for dynamic libraries being loaded. Run path dependent libraries can include LC_LOAD_DYLIB, LC_LOAD_WEAK_DYLIB, and LC_RPATH. Other special keywords are recognized by the macOS loader are @rpath, @loader_path, and @executable_path.[11] These loader instructions can be examined for individual binaries or frameworks using the otool -l command. Objective-See's Dylib Hijacking Scanner can be used to identify applications vulnerable to dylib hijacking

.005 Executable Installer File Permissions Weakness

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

.006 Dynamic Linker Hijacking

Monitor library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.

.012 COR_PROFILER

Monitor DLL files that are associated with COR_PROFILER environment variables.

.014 AppDomainManager

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of .NET assemblies into processes (which may not always create standard image load events).

Look for image loads that are not recognized or not normally loaded into a process.[12][13]

Enterprise T1559 Inter-Process Communication

Monitor for the loading of unusual modules or DLLs into processes. Specifically focus on modules that are not typically loaded or associated with IPC mechanisms.

Analytic 1 - Unrecognized DLLs.

sourcetype=Sysmon EventCode=7| search module_path != "/usr/lib/" OR module_path != "/windows/system32/" OR module_path != "/lib/*"| stats count by module_path process_name user| where module_path IN ("suspicious_modules.dll", "unknown.so")

.001 Component Object Model

Monitor for COM objects loading DLLs and other modules not typically associated with the application.[14]

.002 Dynamic Data Exchange

Monitor processes for abnormal behavior indicative of DDE abuse, such as Microsoft Office applications loading DLLs and other modules not typically associated with the application or these applications spawning unusual processes (such as cmd.exe).

Enterprise T1556 Modify Authentication Process

Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer. Password filters will also show up as an autorun and loaded DLL in lsass.exe.[15] If AD FS is in use, monitor the AD FS server for the creation of DLLs as well as the loading of unrecognized or unsigned DLLs into the Microsoft.IdentityServer.Servicehost application.[16]

Analytic 1 - Unauthorized DLL loads in critical systems.

index=security sourcetype IN ("WinEventLog:Microsoft-Windows-Sysmon/Operational", "linux_secure", "macos_secure")(EventCode=7 OR EventCode=10 OR sourcetype="linux_secure" OR sourcetype="macos_secure")| eval ImageLoaded=coalesce(Image, file_path, target_file)| eval Process=coalesce(ProcessGuid, pid, process_id)| eval User=coalesce(User, user, user_name)| eval Platform=case( sourcetype=="WinEventLog:Microsoft-Windows-Sysmon/Operational", "Windows", sourcetype=="linux_secure", "Linux", sourcetype=="macos_secure", "macOS", true(), "Unknown")| search ImageLoaded IN ( "\lsass.exe", "\services.exe", "\winlogon.exe", "/usr/libexec/", "/usr/bin/", "/etc/pam.d/", "/Library/Preferences/com.apple.loginwindow.plist")| search ImageLoaded IN ("\.dll", "/.so", "/.dylib")| eval isSuspicious=if(match(ImageLoaded, ".\(?!\")(lsass|services|winlogon).exe\.\.dll$|/usr/libexec/.\.so$|/usr/bin/.\.so$|/etc/pam.d/.\.so$|/Library/Preferences/com.apple.loginwindow.plist.\.dylib$"), "Yes", "No")| where isSuspicious="Yes"| bin _time span=1m| stats count by _time, User, ImageLoaded, Process, Platform, host| where count > 1| table _time, User, ImageLoaded, Process, Platform, host, count| sort -count </code

.002 Password Filter DLL

Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer. Password filters will also show up as an autorun and loaded DLL in lsass.exe.[15]

Analytic 1 - Unauthorized DLL loads in critical systems.

index=windows_logs sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"| search EventCode=7 [search index=windows_logs EventCode=4688 (ProcessName="lsass.exe" OR ProcessName="winlogon.exe") | fields ProcessID]| eval dll_path=coalesce(ImageLoaded, Image)| search dll_path="\System32\" OR dll_path="\SysWOW64\"| rex field=dll_path ".*\(?[^\]+.dll)$"

.007 Hybrid Identity

Monitor the hybrid identity solution in use for the loading of unauthorized DLLs. For example, monitor all PTA agent servers for the creation of DLLs as well as the loading of DLLs into the AzureADConnectAuthenticationAgentService process.[17] If AD FS is in use, monitor the AD FS server for the creation of DLLs as well as the loading of unrecognized or unsigned DLLs into the Microsoft.IdentityServer.Servicehost application.[16]

Enterprise T1106 Native API

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Utilization of the Windows APIs may involve processes loading/accessing system DLLs associated with providing called functions (ex: ntdll.dll, kernel32.dll, advapi32.dll, user32.dll, and gdi32.dll). Monitoring for DLL loads, especially to abnormal/unusual or potentially malicious processes, may indicate abuse of the Windows API. Though noisy, this data can be combined with other indicators to identify adversary activity.

Analytic 1 - Look for unusual or abnormal DLL loads, processes loading DLLs not typically associated with them

sourcetype=Sysmon EventCode=7| stats count by module_name process_name user| where module_name IN ("ntdll.dll", "kernel32.dll", "advapi32.dll", "user32.dll", "gdi32.dll")

Enterprise T1027 Obfuscated Files or Information

Monitoring module loads, especially those not explicitly included in import tables, may highlight obfuscated code functionality. Dynamic malware analysis may also expose signs of code obfuscation.[18]

.007 Dynamic API Resolution

Monitoring module loads, especially those not explicitly included in import tables, may highlight obfuscated API function calls. Dynamic malware analysis may also expose signs of function obfuscation, such as memory reads that correspond to addresses of API function code within modules.[18]

Enterprise T1137 Office Application Startup

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

.002 Office Test

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

Enterprise T1055 Process Injection

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

.001 Dynamic-link Library Injection

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process. Sysmon Event ID 7 (Image loaded) can be used to monitor the loading of DLLs into processes. This is a particularly noisy event and can generate a large volume of data, so we recommend baselining and filtering out any known benign processes and module loads to help reduce the number of events that are produced.

.014 VDSO Hijacking

Monitor library load events, especially unusual creation of these binary files followed by loading into processes. Look for libraries that are not recognized or not normally loaded into a process.

Enterprise T1620 Reflective Code Loading

Monitor for artifacts of abnormal process execution. For example, a common signature related to reflective code loading on Windows is mechanisms related to the .NET Common Language Runtime (CLR) -- such as mscor.dll, mscoree.dll, and clr.dll -- loading into abnormal processes (such as notepad.exe)

Enterprise T1021 Remote Services

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes, that may use Valid Accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.

Note: On Windows, Sysmon Event ID 7 (Image loaded) can be used to monitor the loading of DLLs into processes, including those designed to accept remote connections. This is a particularly noisy event and can generate a large volume of data, so we recommend baselining and filtering out any known benign processes and module to help reduce the number of events that are produced.

.003 Distributed Component Object Model

Monitor for COM objects loading DLLs and other modules not typically associated with the application.[19]

Note: Sysmon Event ID 7 (Image loaded) can be used to monitor for suspicious DLLs loaded by the DCOM Server Process Launcher which runs inside of svchost.exe. This is a particularly noisy event and can generate a large volume of data, so we recommend baselining and filtering out any known benign svchost.exe module loads that occur as part of its typical operation.

ICS T0886 Remote Services

Monitor DLL file events, specifically creation of these files as well as the loading of DLLs into processes specifically designed to accept remote connections, such as RDP, Telnet, SSH, and VNC.

ICS T0853 Scripting

Monitor for events associated with scripting execution, such as the loading of modules associated with scripting languages (e.g., JScript.dll, vbscript.dll).

Enterprise T1505 .005 Server Software Component: Terminal Services DLL

Monitor module loads by the Terminal Services process (ex: svchost.exe -k termsvcs) for unexpected DLLs (the default is %SystemRoot%\System32\termsrv.dll, though an adversary could also use Match Legitimate Name or Location to potentially conceal a malicious payload).

Enterprise T1129 Shared Modules

Monitor shared module loading, focusing on .dll, .so, and .dylib files, and look for suspicious paths or abnormal module loads that deviate from system norms.

Limiting module loads to trusted directories, such as %SystemRoot% and %ProgramFiles% on Windows, may protect against module loads from unsafe paths.

Enterprise T1553 Subvert Trust Controls

Enable CryptoAPI v2 (CAPI) event logging [20] to monitor and analyze error events related to failed trust validation (Event ID 81, though this event can be subverted by hijacked trust provider components) as well as any other provided information events (ex: successful validations). Code Integrity event logging may also provide valuable indicators of malicious SIP or trust provider loads, since protected processes that attempt to load a maliciously-crafted trust validation component will likely fail (Event ID 3033). [21]

.003 SIP and Trust Provider Hijacking

Enable CryptoAPI v2 (CAPI) event logging [20] to monitor and analyze error events related to failed trust validation (Event ID 81, though this event can be subverted by hijacked trust provider components) as well as any other provided information events (ex: successful validations). Code Integrity event logging may also provide valuable indicators of malicious SIP or trust provider loads, since protected processes that attempt to load a maliciously-crafted trust validation component will likely fail (Event ID 3033). [21]

Enterprise T1218 System Binary Proxy Execution

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

.002 Control Panel

Monitor for DLL/PE file events, such as the Control_RunDLL and ControlRunDLLAsUser API functions in shell32.dll.

.007 Msiexec

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

.008 Odbcconf

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

.010 Regsvr32

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

Note: This looks for unsigned images that may be loaded by regsvr32, while attempting to eliminate false positives stemming from Windows/Program Files binaries.

Analytic 5 - Loading Unsigned Images

(sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode="7") (Image="C:\Windows\System32\regsvr32.exe" OR Image="C:\Windows\SysWOW64\regsvr32.exe") Signed=false ImageLoaded!="C:\Program Files" ImageLoaded!="C:\Windows\"|stats values(ComputerName) as "Computer Name" count(ImageLoaded) as ImageLoadedCount by ImageLoaded

.011 Rundll32

Analyzing DLL exports and comparing to runtime arguments may be useful in uncovering obfuscated function calls. Static Portable Executable (PE) analysis tools can be used to examine and dump the exports of a particular DLL.

Enterprise T1127 Trusted Developer Utilities Proxy Execution

Monitor trusted developer utility activity with unsigned module loads.

.002 ClickOnce

Monitor dfsvc.exe child process activity with unsigned module loads, as well as activity associated with dfshim.dll. Compare with baseline of ClickOne activity to whitelist applications with valid business use-cases.[22]

Enterprise T1220 XSL Script Processing

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.

References