Match Loaded_DLLs with AND/OR check

This Expert rule describes the usage of Loaded_DLL extension file along with the AND/OR matching on the loaded DLL files.

Note

Exploit Prevention is not supported in the ARM architecture.

This Expert rule matches if "Test_DLL_Loaded.exe" has loaded "TestA.dll" AND "TestB.dll" AND "TestC.dll" AND ("TestD.dll" OR "TestE.dll"), then tries to launch "notepad.exe". The -xtype name must be unique as shown in the example. This is primarily useful in narrowing initiator matches.

Important

Ensure to test this Expert rule on a client system before enforcing.

Rule  {
              Reaction BLOCK
                Process {
                                Include OBJECT_NAME { -v Test_DLL_Loaded.exe }
                                Include AggregateMatch -xtype "testa" {
                                                Include DLL_LOADED -name "testa" { -v 0x1 }
                                }
                                Include AggregateMatch -xtype "testb" {
                                                Include DLL_LOADED -name "testb" { -v 0x1 }
                                }
                                Include AggregateMatch -xtype "testc" {
                                                Include DLL_LOADED -name "testc" { -v 0x1 }
                                }
                                Include AggregateMatch -xtype "testd_or_teste" {
                                                Include DLL_LOADED -name "testd" { -v 0x1 }
                                                Include DLL_LOADED -name "teste" { -v 0x1 }
                                }
                }
                Target {
                                Match FILE {
                                                Include OBJECT_NAME { -v notepad.exe }
                                                Include -access "EXECUTE"
                                }
                }
}

For more Expert Rules examples, visit the Trellix Github repository.