Potential DLL Sideloading Of MsCorSvc.DLL

Rule Info

Name
Potential DLL Sideloading Of MsCorSvc.DLL
Author
Wietze Beukema
Description
Detects potential DLL sideloading of "mscorsvc.dll".
Reference
https://hijacklibs.net/entries/microsoft/built-in/mscorsvc.html
Date
2024-07-11 00:00:00
Modified
None
Id
cdb15e19-c2d0-432a-928e-e49c8c60dcf2
Tags
attack.defense-evasion attack.t1574.002 DEMO
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=cdb15e19-c2d0-432a-928e-e49c8c60dcf2

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
598d29f81
fornotes
Merge PR #4906 from @fornotes - Update and add new dll sideloading rules
2024-07-11
d4cb9fde6
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022