DLL Hijacking Via Print Spooler WBEM And WER Paths

Query

let SuspiciousWrites =
    DeviceFileEvents
    | where Timestamp >= ago(2h)
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | where FileName in~ ("Printconfig.dll", "tzres.dll", "phoneinfo.dll")
    | where FolderPath matches regex @"(?i)^[a-z]:\\windows\\system32\\(spool\\drivers\\(x64|w32x86)\\3\\printconfig\.dll|wbem\\tzres\.dll|phoneinfo\.dll)$"
    | where InitiatingProcessIntegrityLevel in~ ("Low", "Medium", "Untrusted")
    | where isnotempty(InitiatingProcessAccountSid)
    | where InitiatingProcessAccountSid !in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
    | where isnotempty(SHA1)
    | project DeviceId,
        DllPath = tolower(FolderPath),
        PayloadSHA1 = tolower(SHA1),
        WriteTime = Timestamp,
        WriteAction = ActionType,
        WriterAccountSid = InitiatingProcessAccountSid,
        WriterAccount = strcat(InitiatingProcessAccountDomain, @"\", InitiatingProcessAccountName),
        WriterProcess = InitiatingProcessFileName,
        WriterCommandLine = InitiatingProcessCommandLine,
        WriterIntegrity = InitiatingProcessIntegrityLevel,
        WriterProcessUniqueId = InitiatingProcessUniqueId;
DeviceImageLoadEvents
| where Timestamp >= ago(1h)
| where FileName in~ ("Printconfig.dll", "tzres.dll", "phoneinfo.dll")
| where InitiatingProcessAccountSid in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
| where isnotempty(SHA1)
| project Timestamp, DeviceId, DeviceName, ReportId, FileName,
    DllPath = tolower(FolderPath),
    PayloadSHA1 = tolower(SHA1),
    LoaderProcess = InitiatingProcessFileName,
    LoaderCommandLine = InitiatingProcessCommandLine,
    LoaderAccountSid = InitiatingProcessAccountSid,
    LoaderProcessUniqueId = InitiatingProcessUniqueId
| join kind=inner SuspiciousWrites on DeviceId, DllPath, PayloadSHA1
| where Timestamp >= WriteTime and Timestamp <= WriteTime + 30m
| summarize arg_max(WriteTime, *) by Timestamp, DeviceId, ReportId
| extend AttackPath = case(
    FileName =~ "Printconfig.dll", "Print Spooler DLL hijacking",
    FileName =~ "tzres.dll", "WBEM DLL hijacking",
    "WER phoneinfo.dll hijacking")
| project Timestamp, DeviceId, DeviceName, ReportId, AttackPath,
    DllPath, PayloadSHA1, WriteTime, WriteAction,
    WriterAccount, WriterAccountSid, WriterProcess, WriterCommandLine,
    WriterIntegrity, WriterProcessUniqueId,
    LoaderProcess, LoaderCommandLine, LoaderAccountSid, LoaderProcessUniqueId

About this query

Explanation

This query is designed to detect a specific type of security threat known as DLL hijacking, which can lead to privilege escalation on Windows systems. Here's a simplified breakdown of what the query does:

Monitoring File Events: It looks for suspicious file activities (like file creation, modification, or renaming) involving three specific DLL files: Printconfig.dll, tzres.dll, and phoneinfo.dll. These files are known to be vulnerable to DLL hijacking.
Integrity and Account Checks: The query checks if these file activities are initiated by processes running at low, medium, or untrusted integrity levels and not by highly privileged accounts (like SYSTEM, LOCAL SERVICE, or NETWORK SERVICE).
SHA1 Hash Verification: It ensures that the files involved have a recorded SHA1 hash, which is crucial for tracking and verifying the files.
Monitoring Image Load Events: After identifying suspicious file activities, the query checks if these DLL files are loaded by a process running under a privileged account (SYSTEM, LOCAL SERVICE, or NETWORK SERVICE) within a 30-minute window after the file activity.
Correlation and Detection: If a low-privileged file write is followed by a privileged image load of the same file, it indicates a successful DLL hijacking attempt. The query labels the result with the specific hijack path (Print Spooler, WBEM, or WER).
Output: The query provides detailed information about the suspicious activity, including timestamps, device details, account information, and the processes involved.

Overall, this query helps security teams identify potential DLL hijacking attempts that could lead to unauthorized privilege escalation on Windows systems.