Added Sigma Rules DLL Hijack

signatures/sigma/sysmon_dcom_iertutil_dll_hijack.yml

@@ -0,0 +1,23 @@
+title: T1021 DCOM InternetExplorer.Application iertutil DLL Hijack
+description: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network and loading it for a DCOM InternetExplorer DLL Hijack scenario.
+status: experimental
+date: 2020/10/12
+author: Roberto Rodriguez @Cyb3rWard0g
+references:
+    - https://threathunterplaybook.com/notebooks/windows/08_lateral_movement/WIN-201009183000.html
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selection_one: 
+        EventID: 11
+        Image: System
+        TargetFilename: '*\Internet Explorer\iertutil.dll'
+    selection_two: 
+        EventID: 7
+        Image: '*\Internet Explorer\iexplore.exe'
+        ImageLoaded: '*\Internet Explorer\iertutil.dll'
+    condition: selection_one or selection_two
+falsepositives:
+    - Unknown
+level: critical

signatures/sigma/sysmon_wmiprvse_wbemcomn_dll_hijack.yml

@@ -0,0 +1,23 @@
+title: T1047 Wmiprvse Wbemcomn DLL Hijack
+description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.
+status: experimental
+date: 2020/10/12
+author: Roberto Rodriguez @Cyb3rWard0g
+references:
+    - https://threathunterplaybook.com/notebooks/windows/08_lateral_movement/WIN-201009173318.html
+logsource:
+    product: windows
+    service: sysmon
+detection:
+    selection_one: 
+        EventID: 11
+        Image: System
+        TargetFilename: '*\wbem\wbemcomn.dll'
+    selection_two: 
+        EventID: 7
+        Image: '*\wmiprvse.exe'
+        ImageLoaded: '*\wbem\wbemcomn.dll'
+    condition: selection_one or selection_two
+falsepositives:
+    - Unknown
+level: critical

signatures/sigma/win_dcom_iertutil_dll_hijack.yml

@@ -0,0 +1,20 @@
+title: T1021 DCOM InternetExplorer.Application iertutil DLL Hijack
+description: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.
+status: experimental
+date: 2020/10/12
+author: Roberto Rodriguez @Cyb3rWard0g
+references:
+    - https://threathunterplaybook.com/notebooks/windows/08_lateral_movement/WIN-201009183000.html
+logsource:
+    product: windows
+    service: security
+detection:
+    selection: 
+        EventID: 5145
+        RelativeTargetName: '*\Internet Explorer\iertutil.dll'
+    filter:
+        SubjectUserName: '*$'
+    condition: selection and not filter
+falsepositives:
+    - Unknown
+level: critical

signatures/sigma/win_wmiprvse_wbemcomn_dll_hijack.yml

@@ -0,0 +1,20 @@
+title: T1047 Wmiprvse Wbemcomn DLL Hijack
+description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
+status: experimental
+date: 2020/10/12
+author: Roberto Rodriguez @Cyb3rWard0g
+references:
+    - https://threathunterplaybook.com/notebooks/windows/08_lateral_movement/WIN-201009173318.html
+logsource:
+    product: windows
+    service: security
+detection:
+    selection: 
+        EventID: 5145
+        RelativeTargetName: '*\wbem\wbemcomn.dll'
+    filter:
+        SubjectUserName: '*$'
+    condition: selection and not filter
+falsepositives:
+    - Unknown
+level: critical