This rule identifies processes that are loaded as dynamic-link libraries, a common technique adversaries use to inject malicious code into legitimate processes or hide their presence through process hollowing. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to detect subtle fileless or in-memory attacks that traditional endpoint detections might miss due to their low severity and reliance on standard OS mechanisms.
rule IsDLL : PECheck
{
condition:
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
(uint16(uint32(0x3C)+0x16) & 0x2000) == 0x2000
}This YARA rule can be deployed in the following contexts:
Antivirus/EDR Self-Update or Component Installation: Security agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne often install or update DLLs (e.g., falcon.dll, MsMpEng.dll, S1Agent.dll) during scheduled maintenance windows or upon new policy pushes.
FalconService.exe, MsMpEng.exe, S1Service.exe) or where the file path resides in the vendor’s specific installation directory (e.g., C:\Program Files\CrowdStrike\, C:\Program Files\Microsoft Security Client\).Application Deployment via Group Policy or SCCM: Enterprise IT teams use Group Policy Software Installation or System Center Configuration Manager (SCCM) to push updates for Java, .NET Framework, Adobe Reader, or custom line-of-business applications. These deployments frequently extract or overwrite DLLs into C:\Windows\System32 or C:\Program Files directories.
gpupdate.exe, gpedit.msc, ccmexec.exe, or wuaexhost.exe (Windows Update Agent), or where the file path matches known application directories like C:\Program Files\Java\ or C:\Program Files\Adobe\.Driver or Firmware Updates via Vendor Tools: Hardware vendors (Dell, HP, Lenovo) or chipset manufacturers (Intel, AMD, NVIDIA) run scheduled update tasks that install or replace driver DLLs (e.g., nvlddmkm.dll for NVIDIA, igfxcore.dll for Intel) in C:\Windows\System32\drivers or C:\Windows\System32.