Export names for dll component

Hunt Hypothesis

The rule detects an adversary potentially exporting DLL component names as part of reconnaissance or preparation for code injection or module loading activities. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify early-stage compromise attempts that may lead to deeper system infiltration.

YARA Rule

rule NetTravExports : NetTraveler Family {

	meta:
		description = "Export names for dll component"
		author = "Katie Kleemola"
		last_updated = "2014-05-20"
	
	strings:
		//dll component exports
		$ = "?InjectDll@@YAHPAUHWND__@@K@Z"
		$ = "?UnmapDll@@YAHXZ"
		$ = "?g_bSubclassed@@3HA"
		
	condition:
		any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Scenario: A system administrator is using Process Monitor to troubleshoot a DLL loading issue.
  Filter/Exclusion: Exclude processes associated with procmon.exe or ProcessMonitor.exe.

• Scenario: A scheduled job runs PowerShell scripts that dynamically load DLLs for automation tasks.
  Filter/Exclusion: Exclude processes with powershell.exe where the command line includes -File or -Command and contains known automation scripts.

• Scenario: A developer is using Visual Studio to debug a DLL component during local development.
  Filter/Exclusion: Exclude processes with devenv.exe or VisualStudio.exe running in a development environment.

• Scenario: A security tool like Windows Defender or Microsoft Defender ATP is scanning for malware and loading DLLs as part of its analysis.
  Filter/Exclusion: Exclude processes with MsMpEng.exe, MsCtfMonitor.exe, or WindowsDefenderATP.exe.

• Scenario: A system update or patching tool like Windows Update or WSUS is loading DLLs as part of the update process.
  Filter/Exclusion: Exclude processes with wuauserv.exe, svchost.exe (with specific service names like wuauserv), or WindowsUpdate.exe.