Execution, Persistence

Monitor DLL load operations in lsass.exe

SELECT DLLName 
WHERE Process CONTAINS lsass

• Mitre - LSASS Driver

Persistence, Privilege Escalation

Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process.

SELECT DLLName, Process 
GROUP BY DLLName

• Mitre - AppCert DLLs

Persistence, Privilege Escalation

Monitor DLL loads by processes that load user32.dll and look for DLLs that are not recognized or not normally loaded into a process.

SELECT Process 
WHERE DLLName CONTAINS user32

• Mitre - AppInit DLLs

Defense Evasion, Persistence, Privilege Escalation

Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious.

SELECT *

• Mitre - DLL Search Order Hijacking