Threat video1:00
WsmSvc.dll Module Overloading PE Mapping: Detection & IOCs
Module Overloading maps a full PE over the mapped image of WsmSvc.dll so it runs as a DLL. Get 9 detection rules, 6 IOCs and a free Splunk SPL rule.
Read the full threat intel for WsmSvc.dll Module Overloading PE Mapping: Detection & IOCs →
Chapters
- 0:00The hookPE mapped in a carrier DLL.
- 0:04The storyTechnique 68 swaps DLL contents with malware.
- 0:11Attack pathResearcher mapped a legitimate system DLL.
- 0:26AttributionNo threat actor: this was defensive research.
- 0:30Indicators of compromise2 indicators to hunt: 2 file names.
- 0:35MITRE ATT&CK techniques8 ATT&CK techniques, from resource development to stealth.
- 0:40Remediation2 steps now: Hunt for processes/regions where VirtualQuery reports MEM_IMAGE and GetMappedFileNameW resolves.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00PE mapped in a carrier DLL.
0:05Technique 68 swaps DLL contents with malware.
0:08Published malware tradecraft.
0:11Researcher mapped a legitimate system DLL.
0:14Replaced headers and sections with malware.
0:17Applied relocations and imported needed symbols.
0:20Invoked the malware, running as legitimate DLL.
0:26No threat actor: this was defensive research.
0:302 indicators to hunt: 2 file names.
0:368 ATT&CK techniques, from resource development to stealth.
0:402 steps now: Hunt for processes/regions where VirtualQuery reports MEM_IMAGE and GetMappedFileNameW resolves.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.