name: DLL Side-Loading via a copied binary
id: 80798e2c-6c37-472b-936c-1d2d6b95ff3c
version: 1.0.0
description: |
  Identifies when a binary is copied to a directory and shortly followed
  by the loading of an unsigned DLL from the same directory. Adversaries may
  opt for moving legitimate signed binaries to a random directory and use them
  to side-load a malicious library.
labels:
  tactic.id: TA0005
  tactic.name: Defense Evasion
  tactic.ref: https://attack.mitre.org/tactics/TA0005/
  technique.id: T1574
  technique.name: Hijack Execution Flow
  technique.ref: https://attack.mitre.org/techniques/T1574/
  subtechnique.id: T1574.002
  subtechnique.name: DLL Side-Loading
  subtechnique.ref: https://attack.mitre.org/techniques/T1574/002/

condition: >
  sequence
  maxspan 8m
    |create_file and file.is_exec and ps.sid not in ('S-1-5-18', 'S-1-5-19', 'S-1-5-20')
      and
     thread.callstack.symbols imatches ('*CopyFile*', '*MoveFile*')
    | by file.name
    |(load_dll) and dir(image.name) ~= dir(ps.exe)
      and
     pe.cert.subject icontains 'Microsoft' and pe.is_trusted
      and
     (image.signature.type = 'NONE' or image.signature.level = 'UNCHECKED' or image.signature.level = 'UNSIGNED')
    | by ps.exe

min-engine-version: 2.2.0
