DynamicAPILoading

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing dynamic API loading to inject malicious code into legitimate processes while evading static signature-based defenses. Proactively hunting for this behavior in Azure Sentinel is critical because it allows the SOC team to identify stealthy execution patterns early, preventing potential lateral movement before high-severity alerts trigger.

YARA Rule

rule DynamicAPILoading: sharedcode
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - [email protected]"
		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"

	strings:
	/*
		83 C4 04           add     esp, 4
		50                 push    eax             ; lpProcName
		56                 push    esi             ; hModule
		FF 15 20 F0 40 00  call    ds:GetProcAddress
		68 A8 0C 41 00     push    offset aLo_adlIbr_arYw; "Lo.adL ibr.ar yW"
		A3 DC 3E 41 00     mov     GetProcAddress_0, eax
		E8 7D FF FF FF     call    CleanupString
		83 C4 04           add     esp, 4
		50                 push    eax             ; _DWORD
		56                 push    esi             ; _DWORD
		FF 15 DC 3E 41 00  call    GetProcAddress_0
		68 94 0C 41 00     push    offset aLoad_LibR_arYa; "Load. Lib r.ar yA"
		A3 D4 3E 41 00     mov     LoadLibraryW, eax
		E8 63 FF FF FF     call    CleanupString
		83 C4 04           add     esp, 4
		50                 push    eax             ; _DWORD
		56                 push    esi             ; _DWORD
		FF 15 DC 3E 41 00  call    GetProcAddress_0
		68 80 0C 41 00     push    offset a_frE_eliBr_arY; ".Fr e.eLi br.ar y"
		A3 D8 3E 41 00     mov     LoadLibraryA_0, eax
		E8 49 FF FF FF     call    CleanupString
	*/

	$a = {	83 C4 ?? 5? 5? 	FF 15 [4] 68 [4] A3 [4]	E8 [4]	83 C4 ?? 5? 5? 	FF 15 [4] 68 [4] A3 [4]	E8 [4] 83 C4 ?? 5?  5? 	FF 15 [4] 68 [4] A3 [4]	E8}


	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the DynamicAPILoading detection rule in an enterprise environment, along with recommended filters or exclusions:

• Microsoft Office Add-in Initialization

  • Scenario: When users launch Microsoft Excel or Word with enabled COM add-ins (e.g., Adobe Acrobat Pro PDFMaker or specialized ERP plugins), the host process (EXCEL.EXE or WINWORD.EXE) dynamically loads external DLLs containing API calls to render toolbars and sync data.
  • Filter/Exclusion: Create a whitelist rule excluding dynamic loading events where the parent process is MSOffice* and the loaded module path contains \Program Files\Microsoft Office\root\office16\ or specific known vendor folders (e.g., \Adobe\Acrobat Pro DC\).

• Scheduled Antivirus Definition Updates

  • Scenario: During off-hours, enterprise endpoint protection agents (such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender) execute scheduled jobs to download and integrate new threat intelligence definitions. These updates often involve loading dynamic libraries that hook into system APIs to scan file systems in real-time.
  • Filter/Exclusion: Exclude events where the initiating process is a known security agent (e.g., CrowdStrike.exe, SentinelOneAgent.exe) and the loaded module name matches the pattern of update components (e.g., *.update.dll or specific hash ranges for definition files).

• Java/JDK Runtime Class Loading

  • Scenario: Enterprise applications built on Java (such as SAP GUI, Oracle Client, or custom internal dashboards) utilize the Just-In-Time (JIT) compiler to load classes dynamically. The java.exe process frequently loads numerous .jar and .dll files into memory to handle API requests without restarting the application instance.
  • **Filter/Ex