Detects DLL side-loading attacks (T1574.002) via Sysmon event ID 7 monitoring, DLL signature checks, hash validation, and process behavior correlation. For Windows threat hunting with EDR.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 调查企业环境中潜在的 DLL 劫持时
Detects DLL side-loading attacks via Sysmon Event ID 7 monitoring, signature verification, path anomaly checks, and process correlation for threat hunting in Windows environments.
Detects DLL side-loading attacks via Sysmon Event ID 7 monitoring, signature checks, path anomalies, and hash verification for threat hunting and incident response.
Hunts attacker abuse of LOLBins like certutil, mshta, rundll32 in EDR/SIEM logs to detect evasion via signed binary proxy execution (MITRE T1218). Useful for proactive threat hunting.
Share bugs, ideas, or general feedback.
| 概念 | 描述 |
|---|---|
| T1574.002 | DLL 侧加载（DLL Side-Loading） |
| T1574.001 | DLL 搜索顺序劫持 |
| T1574.006 | 动态链接器劫持 |
| T1574.008 | 通过搜索顺序劫持进行路径拦截 |
| DLL 搜索顺序 | Windows DLL 加载优先级路径 |
| 侧加载 | 将恶意 DLL 放置在合法应用程序加载的位置 |
| 幻影 DLL | 合法应用程序尝试加载但不存在的 DLL |
| DLL 代理 | 恶意 DLL 将调用转发给合法 DLL |
| 工具 | 用途 |
|---|---|
| Sysmon | 事件 ID 7 DLL 加载监控 |
| CrowdStrike Falcon | 带进程上下文的 DLL 加载检测 |
| Microsoft Defender for Endpoint | DLL 加载异常检测 |
| Process Monitor | 实时 DLL 加载跟踪 |
| DLL Export Viewer | 验证 DLL 导出函数 |
| Sigcheck | 数字签名验证 |
| pe-sieve | 代理 DLL 的 PE 分析 |
Hunt ID: TH-SIDELOAD-[DATE]-[SEQ]
Technique: T1574.002
Host Application: [合法已签名可执行文件]
Sideloaded DLL: [恶意 DLL 名称和路径]
Expected DLL Path: [DLL 应合法所在的位置]
DLL Signed: [是/否]
App Location: [预期/异常]
Host: [主机名]
Risk Level: [Critical/High/Medium/Low]