Add System32 entries from WFH_Dridex

yml/microsoft/built-in/aclui.yml

@@ -0,0 +1,17 @@
+---
+Name: aclui.dll
+Author: Chris Spehn
+Created: 2021-08-17
+Vendor: Microsoft
+ExpectedLocations:
+  - "%SYSTEM32%"
+  - "%SYSWOW64%"
+VulnerableExecutables:
+  - Path: '%SYSTEM32%\shrpubw.exe'
+    Type: Sideloading
+Resources:
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
+Acknowledgements:
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/activeds.yml

@@ -7,10 +7,26 @@ ExpectedLocations:
   - "%SYSTEM32%"
   - "%SYSWOW64%"
 VulnerableExecutables:
+  - Path: '%SYSTEM32%\applysettingstemplatecatalog.exe'
+    Type: Sideloading
   - Path: '%SYSTEM32%\agentservice.exe'
     Type: Sideloading
+  - Path: '%SYSTEM32%\dsadd.exe'
+    Type: Sideloading
+  - Path: '%SYSTEM32%\dsget.exe'
+    Type: Sideloading
+  - Path: '%SYSTEM32%\dsmod.exe'
+    Type: Sideloading
+  - Path: '%SYSTEM32%\dsrm.exe'
+    Type: Sideloading
+  - Path: '%SYSTEM32%\gpfixup.exe'
+    Type: Sideloading
 Resources:
   - https://wietze.github.io/blog/hijacking-dlls-in-windows
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
 Acknowledgements:
   - Name: Wietze
     Twitter: "@wietze"
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/apphelp.yml

@@ -9,11 +9,17 @@ ExpectedLocations:
 VulnerableExecutables:
   - Path: '%SYSTEM32%\compmgmtlauncher.exe'
     Type: Sideloading
+  - Path: '%SYSTEM32%\sdbinst.exe'
+    Type: Sideloading
   - Path: '%WINDIR%\explorer.exe'
     Type: Search Order
 Resources:
   - https://wietze.github.io/blog/hijacking-dlls-in-windows
   - https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
 Acknowledgements:
   - Name: Wietze
     Twitter: "@wietze"
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/appvpolicy.yml

@@ -0,0 +1,16 @@
+---
+Name: appvpolicy.dll
+Author: Chris Spehn
+Created: 2021-08-16
+Vendor: Microsoft
+ExpectedLocations:
+  - "%SYSTEM32%"
+VulnerableExecutables:
+  - Path: '%SYSTEM32%\appvclient.exe'
+    Type: Sideloading
+Resources:
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
+Acknowledgements:
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/atl.yml

@@ -7,6 +7,10 @@ ExpectedLocations:
   - "%SYSTEM32%"
   - "%SYSWOW64%"
 VulnerableExecutables:
+  - Path: '%SYSTEM32%\dsquery.exe'
+    Type: Sideloading
+  - Path: '%SYSTEM32%\filescrn.exe'
+    Type: Sideloading
   - Path: '%SYSTEM32%\msconfig.exe'
     Type: Sideloading
     AutoElevate: true
@@ -20,6 +24,8 @@ VulnerableExecutables:
     AutoElevate: true
   - Path: '%SYSTEM32%\quickassist.exe'
     Type: Sideloading
+  - Path: '%SYSTEM32%\storrept.exe'
+    Type: Sideloading
   - Path: '%SYSTEM32%\vds.exe'
     Type: Sideloading
   - Path: '%SYSTEM32%\vdsldr.exe'
@@ -30,6 +36,10 @@ VulnerableExecutables:
     Type: Sideloading
 Resources:
   - https://wietze.github.io/blog/hijacking-dlls-in-windows
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
 Acknowledgements:
   - Name: Wietze
     Twitter: "@wietze"
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/batmeter.yml

@@ -0,0 +1,17 @@
+---
+Name: batmeter.dll
+Author: Chris Spehn
+Created: 2021-08-17
+Vendor: Microsoft
+ExpectedLocations:
+  - "%SYSTEM32%"
+  - "%SYSWOW64%"
+VulnerableExecutables:
+  - Path: '%SYSTEM32%\mblctr.exe'
+    Type: Sideloading
+Resources:
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
+Acknowledgements:
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/bcd.yml

@@ -9,6 +9,8 @@ ExpectedLocations:
 VulnerableExecutables:
   - Path: '%SYSTEM32%\bootim.exe'
     Type: Sideloading
+  - Path: '%SYSTEM32%\cidiag.exe'
+    Type: Sideloading
   - Path: '%SYSTEM32%\genvalobj.exe'
     Type: Sideloading
   - Path: '%SYSTEM32%\mdsched.exe'
@@ -20,6 +22,8 @@ VulnerableExecutables:
   - Path: '%SYSTEM32%\recdisc.exe'
     Type: Sideloading
     AutoElevate: true
+  - Path: '%SYSTEM32%\recoverydrive.exe'
+    Type: Sideloading
   - Path: '%SYSTEM32%\resetengine.exe'
     Type: Sideloading
   - Path: '%SYSTEM32%\rstrui.exe'
@@ -61,6 +65,10 @@ VulnerableExecutables:
     Type: Sideloading
 Resources:
   - https://wietze.github.io/blog/hijacking-dlls-in-windows
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
 Acknowledgements:
   - Name: Wietze
     Twitter: "@wietze"
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/bootux.yml

@@ -0,0 +1,16 @@
+---
+Name: bootux.dll
+Author: Chris Spehn
+Created: 2021-08-16
+Vendor: Microsoft
+ExpectedLocations:
+  - "%SYSTEM32%"
+VulnerableExecutables:
+  - Path: '%SYSTEM32%\bootim.exe'
+    Type: Sideloading
+Resources:
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
+Acknowledgements:
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/cabinet.yml

@@ -17,6 +17,8 @@ VulnerableExecutables:
   Type: Sideloading
 - Path: '%SYSTEM32%\extrac32.exe'
   Type: Sideloading
+- Path: '%SYSTEM32%\iesettingsync.exe'
+  Type: Sideloading
 - Path: '%SYSTEM32%\licensingdiag.exe'
   Type: Sideloading
 - Path: '%SYSTEM32%\makecab.exe'
@@ -32,6 +34,8 @@ VulnerableExecutables:
   Type: Sideloading
 - Path: '%SYSTEM32%\plasrv.exe'
   Type: Sideloading
+- Path: '%SYSTEM32%\pnputil.exe'
+  Type: Sideloading
 - Path: '%SYSTEM32%\reagentc.exe'
   Type: Sideloading
 - Path: '%SYSTEM32%\recdisc.exe'
@@ -44,6 +48,8 @@ VulnerableExecutables:
 - Path: '%SYSTEM32%\sdclt.exe'
   Type: Sideloading
   AutoElevate: true
+- Path: '%SYSTEM32%\sihclient.exe'
+  Type: Sideloading
 - Path: '%SYSTEM32%\systemreset.exe'
   Type: Sideloading
   AutoElevate: true
@@ -61,6 +67,10 @@ VulnerableExecutables:
 Resources:
 - https://wietze.github.io/blog/hijacking-dlls-in-windows
 - https://wietze.github.io/blog/save-the-environment-variables
+- https://securityintelligence.com/posts/windows-features-dll-sideloading/
+- https://github.com/xforcered/WFH
 Acknowledgements:
 - Name: Wietze
   Twitter: '@wietze'
+- Name: Chris Spehn
+  Twitter: "@ConsciousHacker"

yml/microsoft/built-in/certcli.yml

@@ -0,0 +1,21 @@
+---
+Name: certcli.dll
+Author: Chris Spehn
+Created: 2021-08-16
+Vendor: Microsoft
+ExpectedLocations:
+  - "%SYSTEM32%"
+  - "%SYSWOW64%"
+VulnerableExecutables:
+  - Path: '%SYSTEM32%\certreq.exe'
+    Type: Sideloading
+  - Path: '%SYSTEM32%\certutil.exe'
+    Type: Sideloading
+  - Path: '%SYSTEM32%\repadmin.exe'
+    Type: Sideloading
+Resources:
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
+Acknowledgements:
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/certenroll.yml

@@ -7,10 +7,16 @@ ExpectedLocations:
   - "%SYSTEM32%"
   - "%SYSWOW64%"
 VulnerableExecutables:
+  - Path: '%SYSTEM32%\certenrollctrl.exe'
+    Type: Sideloading
   - Path: '%SYSTEM32%\dmcertinst.exe'
     Type: Sideloading
 Resources:
   - https://wietze.github.io/blog/hijacking-dlls-in-windows
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
 Acknowledgements:
   - Name: Wietze
     Twitter: "@wietze"
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/clusapi.yml

@@ -7,6 +7,8 @@ ExpectedLocations:
   - "%SYSTEM32%"
   - "%SYSWOW64%"
 VulnerableExecutables:
+  - Path: '%SYSTEM32%\dfsrdiag.exe'
+    Type: Sideloading
   - Path: '%SYSTEM32%\msdtc.exe'
     Type: Sideloading
   - Path: '%SYSTEM32%\tieringengineservice.exe'
@@ -15,6 +17,10 @@ VulnerableExecutables:
     Type: Sideloading
 Resources:
   - https://wietze.github.io/blog/hijacking-dlls-in-windows
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
 Acknowledgements:
   - Name: Wietze
     Twitter: "@wietze"
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/cmutil.yml

@@ -0,0 +1,17 @@
+---
+Name: cmutil.dll
+Author: Chris Spehn
+Created: 2021-08-16
+Vendor: Microsoft
+ExpectedLocations:
+  - "%SYSTEM32%"
+  - "%SYSWOW64%"
+VulnerableExecutables:
+  - Path: '%SYSTEM32%\cmstp.exe'
+    Type: Sideloading
+Resources:
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
+Acknowledgements:
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/configmanager2.yml

@@ -0,0 +1,16 @@
+---
+Name: configmanager2.dll
+Author: Chris Spehn
+Created: 2021-08-16
+Vendor: Microsoft
+ExpectedLocations:
+  - "%SYSTEM32%"
+VulnerableExecutables:
+  - Path: '%SYSTEM32%\hvsievaluator.exe'
+    Type: Sideloading
+Resources:
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
+Acknowledgements:
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/coredplus.yml

@@ -0,0 +1,16 @@
+---
+Name: coredplus.dll
+Author: Chris Spehn
+Created: 2021-08-17
+Vendor: Microsoft
+ExpectedLocations:
+  - "%SYSTEM32%"
+VulnerableExecutables:
+  - Path: '%SYSTEM32%\omadmclient.exe'
+    Type: Sideloading
+Resources:
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
+Acknowledgements:
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/coremessaging.yml

@@ -9,8 +9,14 @@ ExpectedLocations:
 VulnerableExecutables:
   - Path: '%SYSTEM32%\dwm.exe'
     Type: Sideloading
+  - Path: '%SYSTEM32%\sihost.exe'
+    Type: Sideloading
 Resources:
   - https://wietze.github.io/blog/hijacking-dlls-in-windows
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
 Acknowledgements:
   - Name: Wietze
     Twitter: "@wietze"
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/coreuicomponents.yml

@@ -0,0 +1,17 @@
+---
+Name: coreuicomponents.dll
+Author: Chris Spehn
+Created: 2021-08-16
+Vendor: Microsoft
+ExpectedLocations:
+  - "%SYSTEM32%"
+  - "%SYSWOW64%"
+VulnerableExecutables:
+  - Path: '%SYSTEM32%\dwm.exe'
+    Type: Sideloading
+Resources:
+  - https://securityintelligence.com/posts/windows-features-dll-sideloading/
+  - https://github.com/xforcered/WFH
+Acknowledgements:
+  - Name: Chris Spehn
+    Twitter: "@ConsciousHacker"

yml/microsoft/built-in/credui.yml

@@ -11,15 +11,25 @@ VulnerableExecutables:
   Type: Sideloading
 - Path: '%SYSTEM32%\fxssvc.exe'
   Type: Sideloading
+- Path: '%SYSTEM32%\gpfixup.exe'
+  Type: Sideloading
+- Path: '%SYSTEM32%\licmgr.exe'
+  Type: Sideloading
 - Path: '%SYSTEM32%\mstsc.exe'
   Type: Sideloading
+- Path: '%SYSTEM32%\netdom.exe'
+  Type: Sideloading
+- Path: '%SYSTEM32%\nlbmgr.exe'
+  Type: Sideloading
 - Path: '%SYSTEM32%\perfmon.exe'
   Type: Sideloading
   AutoElevate: true
 - Path: '%SYSTEM32%\rekeywiz.exe'
   Type: Sideloading
 - Path: '%SYSTEM32%\rpcping.exe'
   Type: Sideloading
+- Path: '%SYSTEM32%\runas.exe'
+  Type: Sideloading
 - Path: '%SYSTEM32%\systempropertiesadvanced.exe'
   Type: Sideloading
   AutoElevate: true
@@ -38,6 +48,10 @@ VulnerableExecutables:
 Resources:
 - https://wietze.github.io/blog/hijacking-dlls-in-windows
 - https://wietze.github.io/blog/save-the-environment-variables
+- https://securityintelligence.com/posts/windows-features-dll-sideloading/
+- https://github.com/xforcered/WFH
 Acknowledgements:
 - Name: Wietze
   Twitter: '@wietze'
+- Name: Chris Spehn
+  Twitter: "@ConsciousHacker"