Potential DLL Sideloading via MonitoringHost.exe

Rule Info

Name
Potential DLL Sideloading via MonitoringHost.exe
Author
MalGamy (Nextron Systems)
Description
Detects potential DLL sideloading of 'HealthServiceRuntime.dll'
Reference
https://www.elastic.co/security-labs/under-the-sadbridge-with-gosar
Date
2024-12-20 00:00:00
Modified
None
Id
0de30f37-866a-4a55-913a-7592fec09d47
Tags
attack.defense-evasion attack.privilege-escalation attack.t1574.001
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022