DLLs

Jump to bottom

Tony Phipps edited this page Mar 16, 2018 · 5 revisions

LSASS Driver

Tactic: Execution, Persistence

Select DLLName where Process contains lsass

Monitor DLL load operations in lsass.exe

AppCert DLLs

Tactic: Persistence, Privilege Escalation

Select DLLName, Process aggregated by DLLName

Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process.

AppInit DLLs

Tactic: Persistence, Privilege Escalation

Select Process where DLLName contains user32

Monitor DLL loads by processes that load user32.dll and look for DLLs that are not recognized or not normally loaded into a process.