Uncommon DLL-sideloading from a logical CD-ROM (ISO) device
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
XDR Agent
Detector Tags
DLL Hijacking Analytics
ATT&CK Tactic
Execution (TA0002), Stealth (TA0005)
ATT&CK Technique
Hijack Execution Flow: DLL (T1574.001), User Execution: Malicious File (T1204.002)
Severity
Medium
Description
A DLL was loaded by an executable from the same folder on a logical CD-ROM device (ISO).
Attacker's Goals
An attacker is attempting to load untrusted code into trusted contexts to avoid detection or escalate privileges.
Investigative actions
Investigate the loaded module and verify if it is malicious.
Check if the disk is a mounted CD-ROM (for example from an ISO file), and if it contains hidden files and folders.
Check the content of an 'autorun.inf' or '*.lnk' files if they exist.
Was this helpful?